Researchers Test Vishing Attacks Using Real-Time Voice Cloning :
Cybersecurity researchers on Tuesday revealed that artificial intelligence can be used to clone human voices in real-time and launch voice phishing attacks on unsuspecting organizations.
The NCC group of researchers stated in their blog that real-time voice cloning can be used to attack real organizations and extract sensitive and confidential data successfully.
Researchers Pablo Alobera, Pablo López, and Víctor Lasa wrote:
“They revealed not only sensitive information, but also how techniques can convince key operational personnel to work on behalf of attackers.”
Researchers performed actions such as resetting passwords, changing email addresses, etc., and conducted security assessments that simulated real-world attack situations.
Before starting this project, they observed that the biggest challenge was technology. Most deepfake technologies focus on using pre-recorded voices and are not capable of real-time voice conversion.
They noted: “Real-time vishing requires instant voice cloning, which systems relying on offline TTS (text-to-speech) models do not easily provide.”
How Real-Time Voice Copying Powers Vishing Attacks :
Researchers have pointed out that attackers have only two options when working with this technology. Either they use pre-recorded voices, which make real-time conversation impossible, or they use TTS (text-to-speech) models to insert sentences that introduce unnatural delays into the cloned voice.
But researchers used a new trick: they routed attackers’ single-player voice to a real-time voice modular, using ML (machine learning) models to clone a human’s voice, meaning whenever the attacker speaks about the target, his voice is cloned.
They have also said that real-time AI voice impressions can be made possible by using audio signals directly from popular applications like Google Meet, Microsoft Teams. In the proof of concept, a victim’s phone number was spoofed (with their permission), as in vishing, so that the victim trusts the familiar caller ID.
Earlier, this technology was not mature enough to make real-time voice cloning possible, but today all this has become possible. All these tools infrastructure have become easily accessible that even those with limited technical and financial resources can use them.
Researchers have also noted that they have made this possible with “good enough” hardware and software. This means that no extraordinary or expensive tools are required. Any ordinary individual can also achieve all these things.
Rapidly Growing Tech :
What makes real-time voice cloning believable and successful is that it now presents a huge opportunity for scammers. Matthew Harris (Senior Product Manager, Fraud Protection – Crane Authentication) explained that people trust the caller’s number, voice, and messages—and all of these can be easily spoofed or cloned.
Earlier, scammers had a lot of difficulty with realism. Their fake voices and virtual flows were easy to catch. But all of this is now possible thanks to open source LLMs (large language models), making virtual faults realistic has become much easier. The AI model is learning from its past mistakes and making the voices or faces so realistic that it is difficult to differentiate from the real one.
Brandon Kovacs (Senior Security Consultant, Bishop Fox) has told that through real-time voice conversion, attackers can handle anything from the user. The biggest problem arises in deepfake videos which can be used in Zoom or Teams.
In real-time voice conversion, attackers can easily clone the voice, face and tone of the user, which can make no difference between real and clone. T. Frank Downs (BlueVoyant) called it a force multiplier – because it gives attackers the ability to adapt tone and context during a call, creating the illusion of complete authenticity.
Roger Grimes (CISO Advisor, KnowBe4) said that not all voice cloning is easy. Some patterns are simple, and some require skill. But new AI tools are improving every month, making cloning possible even without expert skills.
He explained that the AI’s probabilistic pattern matching is at its most powerful level yet. This has made cloning results more accurate. Yes, some voices (like African native languages) are still tough due to lack of data.
They predict that by 2026, most voice-based social engineering attacks will be based on real-time voice cloning, without human voices. This will be a shift that will permanently change hacking.
Deepfake Voice Phishing Incidents Rising :
AI has become so powerful that it can do anything, just like it is very easy to create fake voice messages of CEOs even without AI. Just by using a recording of them and some AI tools like ElevenLabs, a realistic fake can be created, said Alex Quilici (CEO, YouMail).
He said that not many cases are being seen but in the future it may become more, because some reports are increasing and this can also become a major cyber-attack.
Currently, the most common scams are being perpetrated through text messages, where scammers pose as CEOs and talk to employees, forcing them to take action. Text messages are increasingly popular because they are easy and effective.
Marc Maiffret (CTO, BeyondTrust) has warned that AI-based dissimulation attacks are increasing, requiring strong identity security, monitoring, and limited access to protect against them. He said, “Identity is the new security perimeter.”
NCC researchers are also working on deepfake video. Syncing audio and video remains a challenge. With such rapid progress in AI, realistic audio and video deepfake solutions are just a matter of time.
AI New Era- 2025
AI can completely change our interactions, just like mobile apps have changed the mobile web. This is why AI can become a superpower app.
1 Comment
[…] Real-Time Voice Cloning : 2025 […]