Introduction
Impersonation has been in existence for a very long time. One of the earliest documented cases of fraudulent impersonation dates back to the biblical story of Jacob and Esau. In this account, Jacob deceives his blind father, Isaac, by pretending to be his brother Esau to receive the paternal blessing intended for the firstborn.
Deepfakes are a form of impersonation, but in more recent times, it has attained new heights with the introduction of artificial intelligence. So what is a deepfake? A deepfake is any type of media that has either been generated or manipulated using Artificial Intelligence.
From a cybersecurity perspective, deepfakes are a very serious threat. They are likely to take center stage in the coming years. According to Deloitte 91% of all breaches start with some form of social engineering. Social engineering has become more realistic and have the ability to fool even the most vigilant people. Lets talk about two ways that social engineering will become more dangerous with the introduction of deepfakes and the readily available D
Vishing
Vidshing (Video phishing)
Vishing is when a malicious actor calls a victim and attempts to fool them into doing something that would be harmful to them, someone they know of their organization. Vishing has been in existence for a long time, some prominent cases of vishing include:
IRS Phone Scam: During tax filing season, scammers often pose as IRS representatives in alarming or threatening phone calls to dupe unsuspecting taxpayers into handing over money or personal information. In one notorious example of vishing (voice phishing), a group posing as both IRS and immigration officials contacted over 50,000 individuals, stealing hundreds of millions of dollars by threatening arrest or deportation.
COVID-19 Scams: During the pandemic, scammers offered fraudulent products claiming to prevent or cure COVID-19. The Federal Communications Commission warned against such vishing schemes.
Drumroll.... this is the first time this term has been coined..... vidshing also known as Deepfake Phising. Vidshing (or Deepfake Phising.) is when a malicious actor makes a video call to someone using a deep fake for the conversation. Vidshing is already being used. In a case reported by CNN, a finance employee at a multinational firm was tricked into transferring $25 million after fraudsters used deepfake technology to impersonate the company's chief executive during a video call.
Deepfake Attack Scenario (the Trump Zoom call demo)
In this blog post we walk through a live deepfake scam scenario to demonstrate the tech in action Here is the scenario:
President Trump has chosen you for an award of $1million dollars. He calls you on zoom to personally congratulate you. For this scenario, we will use an existing speech that we can download from youtube. We start by cloning the target's voice.
Clone the targets voice
Voice cloning, the process of replicating a person's voice using technology, has evolved significantly over the centuries, progressing from mechanical devices to advanced artificial intelligence systems.
In the late 18th century, inventors like Wolfgang von Kempelen developed mechanical devices to emulate human speech. Von Kempelen's "acoustic-mechanical speech machine," described in 1791, used bellows and models of the tongue and lips to produce both consonant and vowel sounds.
The 1930s and 1940s saw the emergence of electronic devices such as the VODER (Voice Operated Demonstrator) and the VOCODER (Voice Operated Coder), developed by engineers like Homer Dudley at Bell Labs. The VODER was an electro-mechanical device that generated speech sounds by filtering waveforms, while the VOCODER analyzed speech into its fundamental tones and resonances.
In 1962, Bell Laboratories' researchers, including Max Mathews, used a computer (IBM 704) to synthesize singing, marking a significant milestone in digital speech synthesis.
The computer performed a rendition of "Daisy Bell," demonstrating the potential of computers to generate human-like speech.
The 21st century introduced deep learning techniques that revolutionized voice cloning. In 2016, by directly modeling raw audio waveforms, producing highly natural-sounding voices. Now virtually any voice can be cloned using deeplearning techniques provided that you have a reference audio
We will be using Llasa, a text-to-speech (TTS) system built upon the text-based LLaMA language model (in 1B, 3B, and 8B configurations). Llasa incorporates 65,536 speech tokens derived from the XCodec2 codebook and has been trained on 250,000 hours of bilingual Chinese-English speech. As a result, it can generate audio entirely from text input or by using a supplied speech prompt. To sync the audio generated to a video so that it looks like the person in the video is speaking the words, we will use the video-retalking library.
System Overview
For this demonstration our setup features four NVIDIA GPUs—one RTX 3080, one RTX 3060, and two RTX 3080 Ti cards—running on driver version 555.42.06 with CUDA 12.5. On the CPU side, we’re using an Intel® Core™ i7-9700K with 8 cores clocked at up to 5 GHz and support for virtualization (VT-x). This combination offers plenty of parallel horsepower for deep learning tasks, 3D rendering, or any GPU-accelerated workload.
Creating the audio impersonation.
Llasa-3B can be found here. The following Python script uses a pre-trained model (Llasa-3B) to clone the voice and generate a deepfake audio clip.
Running the above is easy, just pass in your audio file (the audio that contains the voice of the speaker you want to clone), add the text you want the speaker to say, and it will generate an output file that contains whatever you want it to say.
Thats it! you have generated your first cloned audio! Next we will sync the audio to some video that we fetch off the internet. Here is the audio we generated for our scenario:
Syncing the audio to video
To download a video from youtube you can use yt-dlp
Like we mentioned earlier, to sync this video to the audio, we will use video-retalking
Instructions are available on the github page. So we go ahead and run the script by passing in our audio and video, and the result is:
If you pay close attention to the mouth area, you might see some tiny inconsistencies, but this will only get better with time.
PS: take care that for whatever video you select, ensure the person being impersonated is not too close to the camera, video-retalking is not very good with such videos. Also, the audio and video must be of the same length.
Streaming the Deepfake Live (or System Setup)
Now to stream it live to zoom. Below is a step-by-step guide on how to create a virtual (software) camera device on Ubuntu and feed video frames to it using Python. This allows other applications (like Zoom, Skype, etc.) to recognize your software-generated or processed stream as if it were coming from a normal webcam.
Here are the instructions:
Install and Load v4l2loopback
This installs the kernel module v4l2loopback, which lets you create one or more virtual video devices (e.g., /dev/videoX).
Load the Kernel Module
After installing, load the module:
This creates a single virtual camera at /dev/video10 labeled “deepfake. To confirm that it was created, you can run the following commands:
Then log out and log back in.
Next we Install Python Dependencies:
Now we write the python script. The python script below demonstrates how to capture frames from a video file and stream them to a virtual camera device. It uses the argparse module to allow users to specify the video path, virtual camera device, and optional frames-per-second override. Internally, OpenCV (cv2) reads each video frame in a loop, while pyvirtualcam sends the frames to the specified virtual camera mimicking a live video feed. If the video ends, the script loops back to the beginning, ensuring an uninterrupted stream. The code also includes best practices such as a main function guard, docstrings for clarity, type hints, and structured error handling.
After running the script, start zoom, you should be able to select video10, (deepfake) as a source. Here is the script running on zoom:
Thats it! in this blog, we discussed the history of deepfakes, we talked about vishing and eventually vidshing. We discuss how dangerous deepfakes already are and what they could be in the future. In the next series we will discuss how to protect yourself and your organization.