A new report has identified that cybercriminals are conducting highly organized, AI driven voice phishing (“vishing”) attacks against senior U.S. crypto executives, generating operatives upwards of $20,000 a month.
According to reports, these attacks have changed a lot from traditional phishing emails, and now involve professional impersonators, deepfake tools, datasets, and the targeting of high-value individuals directly.
The cybercriminals’ goal is to fool the executive into giving sensitive information that could impact custody infrastructure & private keys, leading to larger crypto theft.
Criminal Recruitment in Underground Forums
In June, GK8 researchers found recruiting ads on private cybercriminal forums, which indicates that organized groups are explicitly soliciting skilled “callers” for these campaigns.
The recruiting ads included example target matrices that contained five crypto executives in the U.S., including senior legal officers, engineers, finance controllers, and CTOs, all of whom had a minimum net worth of $500,000.
Tanya Bekker, Head of Research at GK8, said her team determined that the groups were legitimate by evaluating the reputation of the accounts, vendor ratings, and community vouches.
She emphasized that the datasets of executives being used seemed to come from new compromises of confidential information.
Also Read: VanEck Warns Small-Caps’ Multi-Million XRP And Solana Treasury Claims Could Be Scam
Sophisticated Voice and Video Impersonation Tactics
Modern vishing attacks are tailored and sophisticated, as opposed to common phishing methods.
As Bekker noted, attackers utilize voice and video impersonation technologies powered by AI, and also use deepfake technology to closely replicate someone you trust, or an institution you trust.
Attackers will use Voice over Internet Protocol (VoIP) systems to set up dedicated phone numbers in addition to SMS messaging services to impersonate banks, government agencies, or crypto platforms.
These elaborate and believable techniques enhance the likelihood of the victim surrendering sensitive data.
Wider Trend of Social Engineering Threats in Crypto
The Eliza report highlights a growing trend of social engineering campaigns within the crypto sector.
UnoCrypto reported on June 20th that independent investigations found North Korean operatives posing as applicants by infiltrating crypto firms, even using deepfake videos during interviews.
In distributing PylangGhost malware that was disguised as video drivers, they successfully stole $1.34 billion in 47 incidents in 2024.
The malware collected cookies and credentials from more than 80 browser extensions, including crypto wallets and password managers, demonstrating the increasing sophistication of these campaigns.
Also Read: Cointelegraph Front-End Hacked, Warns Users After Fake Airdrop Scam
Experts Warn Industry of Escalating Risks
Security professionals have stated that the combination of AI technology with conventional social engineering techniques is a scary advancement in cybercrime.
Binance’s Chief Security Officer Jimmy Su confirmed that his exchange gets fake resumes almost daily from suspected North Korean actors, many of whom use deepfakes and voice changers when conducting interviews.
While slow internet speeds often reveal their true identities, Su noted that there are still challenges with detection as attackers hone their craft.
With the rise of AI-enabled impersonation, the industry needs to reconsider its authentication practices, ramp up training, and create a more proactive security posture through the cryptocurrency industry.
Also Read: Shiba Inu Ally Warns of ‘Honeypot Scam’ Exploiting Zama Name: Details Below