Deepfake impersonation attempt targeting WPP leadership

Fraudsters impersonated the chief executive of advertising group WPP and another senior executive in a Microsoft Teams meeting, using an AI voice clone and YouTube footage, in an unsuccessful attempt to extract money and personal details. The Guardian reported the attempt on 10 May 2024, based on an internal email from the chief executive to company leadership.

What happened

The attackers set up a WhatsApp account showing a publicly available photo of the chief executive and used it to arrange a Teams meeting that appeared to include him and a second senior WPP executive. During the call they played a cloned voice and video footage taken from YouTube, while typing in the chat window as the chief executive. The target was an agency leader, who was asked to set up a new business. The date of the attempt has not been disclosed; WPP did not answer questions on timing.

Impact

No loss was reported. A WPP spokesperson said the attempt was stopped thanks to the vigilance of staff, including the executive who was approached. WPP also said on its website that its name and agency brands had been used by third parties on unofficial sites and apps, and that it was working with authorities on that separate fraud.

Response

The chief executive warned leaders by email to watch for calls claiming to come from top executives. The email listed red flags such as requests for passports or money transfers and any mention of a secret acquisition, transaction or payment.

Lessons for security leaders

Executives with public video and audio are easy to clone, and attackers mix cheap tricks, such as a borrowed profile photo, with generated voices. Set a rule that no business request arriving over consumer messaging apps is acted on without confirmation through a known internal channel. Brief leadership teams on the red flags WPP circulated, and rehearse the verification step so that staff feel able to challenge someone who appears to be a senior leader.