Associated Incidents
The FBI said Thursday that malicious actors have been impersonating senior U.S. government officials in a text and voice messaging campaign, using phishing texts and AI-generated audio to trick other government officials into giving up access to their personal accounts.
The warning provided few details about the campaign, which started in April and appears to be ongoing. The messages have come in the form of either texts or deepfaked audio messages of senior U.S. officials and were primarily sent to "current or former senior U.S. federal or state government officials and their contacts" to gain access to their accounts.
The FBI is now advising the public that "if you receive a message claiming to be from a senior U.S. official, do not assume it is authentic."
It is the latest example of malicious actors using AI and deepfake techniques to realistically mimic the voice and likeness of others. As large language models have proliferated and improved their abilities to create lifelike video and audio images, their use in phishing schemes and scam campaigns has exploded.
Perhaps the most well-known use of the technology thus far has been the deepfake impersonation of then-President Joe Biden in the lead-up to the New Hampshire presidential primary in 2024. Political consultant Steve Kramer, working with Democratic primary challenger Dean Phillips, oversaw the creation of the audio, which advised Democrats not to go to the polls and was sent to voters days before the primary.
Kramer was fined $6 million by the FCC for the incident and is facing criminal charges for attempted voter suppression by falsely impersonating a candidate in New Hampshire.
But the use of deepfake audio in more routine financial scams and more sophisticated espionage and cybercriminal schemes has risen sharply since the technology emerged.
Adding to the concerns, the apparent targeting of personal accounts in this campaign comes as news outlets have reported that multiple high-ranking members of the Trump administration are communicating and coordinating U.S. government policy from their personal phones and using insecure third-party versions of encrypted messaging apps like Signal.
There are limited protections against exploitation by these technologies, aside from being vigilant and following standard security advice, like not trusting unknown callers, verifying identities by calling the official numbers, and using multifactor authentication to secure accounts.
In a hearing in the House the same day, Federal Trade Commission Chair Andrew Ferguson said addressing AI impersonation is one of the agency's top priorities through new legislation like the Take It Down Act.
"I don't know if anyone has ever gotten a call of an impersonated loved one, but I have friends that have gotten calls from impersonated family members," Ferguson told lawmakers. "It's like a truly terrifying experience."
John Hultquist, chief analyst at Google Threat Intelligence Group, said in an email to CyberScoop that "adversaries could fake content before, but AI has certainly made it easier, and enabled them to do it at scale."
"They have been using AI to fabricate video, text, and audio for a few years now," he added. "And they are clearly getting better."
This story was updated May 15 with comments from the FTC chair Google's Hultquist.