A LastPass employee was reportedly targeted by an audio deepfake impersonating CEO Karim Toubba via WhatsApp. The message used voice-cloning AI in a social engineering attempt to create urgency and bypass security protocols. The employee recognized red flags, reported the incident, and no breach occurred.
Curated from incidentdatabase.ai · 10 April 2024 →
April 2024. The calls and voice messages came over WhatsApp, outside every channel LastPass uses internally, and pressed for urgency. The employee ignored them and told the security team, and LastPass published the attempt the same day rather than sitting on it. It is the third failed attempt on this page, with Ferrari and WPP, and the three share a shape worth copying: in each one the voice was convincing and the wrapper around it was not. A finance request arriving on WhatsApp is a fact about the process, and a process fact is checkable in a way that a voice no longer is.