Synthetic Media Social Engineering

Attackers combine AI-generated voice, video, images, personas, and fabricated digital content with traditional social engineering to create highly credible, adaptive interactions designed to manipulate employees into disclosing information, transferring funds, granting access, or bypassing security controls.

Synthetic Media Social Engineering represents the broader evolution of traditional social engineering through generative AI.

Instead of relying solely on convincing emails, scripts, or impersonation, attackers can create coordinated synthetic identities capable of interacting with victims across multiple communication channels.

An attacker may begin with an AI-generated email, continue through a cloned voice call, appear through synthetic video, provide fabricated documents as supporting evidence, and maintain the same false identity throughout the operation.

This convergence weakens a long-standing enterprise defense: verifying suspicious communications through another channel.

When attackers can reproduce identity across email, voice, messaging, video, and documents, organizations must shift from recognition-based trust to independently verifiable identity and authorization.

1. Target Reconnaissance
The attacker identifies employees, executives, vendors, customers, relationships, processes, and potential trust paths.

2. Persona Construction
A legitimate identity is impersonated or a believable synthetic identity is created.

3. Synthetic Asset Generation
Voice, video, imagery, documents, messages, and supporting artifacts are generated.

4. Initial Engagement
The attacker contacts the victim through email, messaging, telephone, social media, or another channel.

5. Trust Reinforcement
Additional synthetic media or communication channels are introduced to strengthen perceived authenticity.

6. Psychological Manipulation
Authority, urgency, familiarity, fear, confidentiality, or organizational context is used to influence the victim.

7. Sensitive Request
The victim is asked to disclose credentials, transfer funds, provide information, approve access, modify an account, or circumvent normal procedures.

8. Exploitation
The attacker uses the resulting access, information, authorization, or financial transaction to achieve the objective.

1. Target Reconnaissance
The attacker identifies employees, executives, vendors, customers, relationships, processes, and potential trust paths.

2. Persona Construction
A legitimate identity is impersonated or a believable synthetic identity is created.

3. Synthetic Asset Generation
Voice, video, imagery, documents, messages, and supporting artifacts are generated.

4. Initial Engagement
The attacker contacts the victim through email, messaging, telephone, social media, or another channel.

5. Trust Reinforcement
Additional synthetic media or communication channels are introduced to strengthen perceived authenticity.

6. Psychological Manipulation
Authority, urgency, familiarity, fear, confidentiality, or organizational context is used to influence the victim.

7. Sensitive Request
The victim is asked to disclose credentials, transfer funds, provide information, approve access, modify an account, or circumvent normal procedures.

8. Exploitation
The attacker uses the resulting access, information, authorization, or financial transaction to achieve the objective.

• Email systems
• Collaboration platforms
• Video conferencing
• Enterprise telephone systems
• Help desks
• Identity-verification workflows
• Financial approval systems
• HR and recruiting
• Vendor management
• Customer support
• Messaging applications
• Account recovery
• Privileged-access workflows
• Remote-work environments
• Executive communications

Synthetic media can transform social engineering from a single deceptive communication into a coordinated multi-channel attack on enterprise trust.

Successful operations may result in credential theft, fraudulent payments, account takeover, unauthorized access, sensitive-data disclosure, malicious account recovery, insider-like access, or compromise of third-party relationships.

The most important enterprise implication is that traditional verification assumptions are changing.

An email can be fabricated. A voice can be cloned. A face can be generated. A document can be synthesized. Even multiple matching signals may originate from the same attacker.

Security controls must increasingly establish identity through independently trusted mechanisms rather than familiarity alone.

Authorized testing should evaluate whether organizational controls remain effective during coordinated, multi-channel synthetic impersonation.

Scenarios may include:

• Synthetic phishing communications
• Voice-cloned follow-up calls
• Controlled deepfake video interactions
• Fabricated supporting documentation
• Executive impersonation
• Vendor impersonation
• Help-desk manipulation
• Credential-reset requests
• Financial approval requests
• Sensitive-data requests
• Multi-channel identity verification
• Attempts to bypass established procedures

Assess whether changing channels actually produces independent verification or merely allows the same claimed identity to authenticate itself again.

Testing should use approved identities, controlled synthetic media, and clearly defined engagement boundaries.

Monitor for:

• Sensitive requests spanning multiple communication channels
• Unexpected changes in established communication patterns
• Lookalike or newly created accounts
• Requests involving urgency or secrecy
• Voice or video interactions following suspicious messages
• Inconsistent device, network, or account telemetry
• Unusual credential-reset activity
• Requests to bypass established controls
• Changes to payment information
• New contact information introduced during sensitive requests
• Synthetic-media indicators
• Communications inconsistent with authoritative business records

Security teams should correlate identity, communication, endpoint, and transaction telemetry rather than evaluating each interaction independently.

MITRE ATT&CK T1656 – Impersonation Additional mappings depend on execution, including phishing, credential access, valid accounts, or other techniques resulting from successful social engineering.

OWASP Mapping No direct OWASP LLM Top 10 mapping. Generative AI enables the synthetic content used in the attack, but the primary security boundary being targeted is enterprise identity and human trust rather than an LLM application.