Full Report
Creating a convincing video impersonation has gone from requiring specialized expertise and substantial computing power to something an ordinary computer user can set up in under an hour, according to iProov Chief Technology Officer Dominic Forrest. That shift puts tools for fraud and unauthorized access within reach of almost anyone willing to use them. Forrest…
Analysis Summary
# Tool/Technique: Real-Time Video Deepfake Impersonation (Identity Spoofing)
> **Scope note:** The article is a news piece about the general accessibility of deepfake video impersonation. It does not describe a specific malware family, named tool, threat actor campaign, or sample. Sections that require such data are marked N/A rather than filled with speculation.
## Overview
Real-time, convincing video impersonation (deepfakes) can now be produced by non-experts using free software on a consumer PC. According to iProov CTO Dominic Forrest, setup takes roughly 30 to 60 minutes, where it once required doctoral-level computer vision expertise and large compute resources. The technique lets attackers impersonate trusted colleagues, executives, or relatives on video calls, and it undermines identity verification based on recognizing a person's face or voice. The article highlights three uses: fraudulent payment approvals, fraudulent employment (including North Korean remote-worker schemes), and account takeover.
## Technical Details
- **Type:** Technique (social engineering / identity spoofing, with video injection as a delivery method)
- **Platform:** Any general-purpose computer capable of running consumer deepfake software; targets include video conferencing platforms (e.g., Microsoft Teams), identity verification workflows, and voice/video-based account recovery
- **Capabilities:**
- Real-time face replacement on live video feeds
- Injection of synthetic video into camera pipelines, which can defeat static facial matching against a reference photo
- Impersonation of known individuals for fraud or unauthorized access
- **First Seen:** Not specified as a tool. Forrest reports first encountering a video fake he could not distinguish from reality in 2020, when producing one required specialized expertise and substantial compute.
## MITRE ATT&CK Mapping
*Mappings below are analyst inferences from the article's described behavior, not attributions from the article.*
- **TA0005 - Defense Evasion**
- T1656 - Impersonation
- **TA0001 - Initial Access**
- T1078 - Valid Accounts (account takeover after identity verification is bypassed)
- **TA0042 - Resource Development**
- T1585 - Establish Accounts (fraudulent employment or account creation under false identities)
- T1585.001 - Social Media Accounts (if applicable to impersonation personas)
## Functionality
### Core Capabilities
- Generate a convincing synthetic face or video of a target individual in real time
- Pass visual identity checks on live video calls
- Support fraudulent requests such as payment approvals and urgent family-emergency scams
### Advanced Features
- Video injection: feeding synthetic streams into the capture pipeline, bypassing the physical camera (the article cites this as the reason static facial matching fails)
- Use of impersonation to gain employment, then obtain legitimate privileged access to sensitive systems
- Account takeover as a fallback when account creation is tightened
## Indicators of Compromise
- **File Hashes:** N/A (no malware sample described)
- **File Names:** N/A
- **Registry Keys:** N/A
- **Network Indicators:** N/A (no C2 infrastructure or domains described)
- **Behavioral Indicators:**
- Video feeds with unnatural facial artifacts, lighting inconsistencies, or latency when the participant is asked to turn, move, or occlude their face (general observations, not from the article)
- Requests for urgent payments, credential resets, or account changes arriving over video or voice
- New hires who cannot be verified against their interview identity
- Camera drivers or virtual camera devices present on endpoints where no legitimate need exists
## Associated Threat Actors
- **North Korean IT worker operations:** The article cites North Korean workers obtaining remote jobs under false identities as an example of the risk. The article does not tie deepfake tooling specifically to this group.
## Detection Methods
- **Signature-based detection:** Not applicable in the traditional sense. No known signatures for the technique are described.
- **Behavioral detection:**
- Injection attack detection that checks whether the video stream originates from a physical sensor (the article points to the European standard CEN/TS 18099 as a benchmark)
- Liveness detection during identity verification
- Monitoring for virtual camera drivers or unexpected video-input device changes on endpoints
- **YARA rules:** None available from the article.
## Mitigation Strategies
- **Prevention measures:**
- Verify that the person receiving an account is the person who was interviewed, using identity checks during the hiring process
- Require out-of-band verification (a known callback number or a separate channel) for payment approvals and sensitive transactions
- Do not rely on a face or voice match as the sole factor for high-risk requests
- Tighten credential recovery and account-takeover controls, since attackers pivot to these when account creation is hardened
- **Hardening recommendations:**
- Apply additional scrutiny to privileged access, sensitive transactions, and credential resets
- Evaluate identity verification tools against injection-detection benchmarks such as CEN/TS 18099 and confirm they receive continuous threat intelligence updates
- Use independent, real-time verification that an authorized individual is physically present, rather than static facial matching against a reference photo
- Train staff on the existence of deepfake impersonation, while recognizing that the article argues individuals alone cannot reliably detect sophisticated fakes; protection should be built into processes and tools
## Related Tools/Techniques
- **Business Email Compromise (BEC):** Impersonation-driven payment fraud that deepfakes extend into voice and video
- **Voice cloning / vishing:** Audio-only impersonation used in family-emergency scams, as the article describes for consumers
- **Phishing (T1566):** Forrest compares deepfake defense to phishing defense, arguing neither should rest entirely on the employee or consumer
- **Remote IT worker fraud:** Fraudulent employment schemes that use false identities to gain legitimate access