Full Report
Group-IB’s Fraud Protection team examines how fraudsters use deepfake technology to bypass biometric security in financial institutions, including facial recognition and liveness detection. This blog highlights the use of emulators, app cloning, and virtual cameras to exploit vulnerabilities, and highlights the financial and societal impacts of deepfake fraud.
Analysis Summary
# Tool/Technique: Deepfake Biometric Bypass
## Overview
This technique involves the use of AI-generated synthetic media (deepfakes) to circumvent biometric security measures, specifically facial recognition and liveness detection systems, during the onboarding or authentication processes of financial institutions. Attackers leverage virtualization and manipulation tools to feed synthetic video streams into mobile applications instead of a real-time camera feed.
## Technical Details
- **Type**: Technique / Attack Framework
- **Platform**: Android, iOS, Web
- **Capabilities**: Facial reenactment, liveness spoofing, camera hijacking, environment virtualization.
- **First Seen**: Increasing prevalence noted in late 2023 and throughout 2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566 - Phishing]**: Used to acquire legitimate user credentials or PII to facilitate identity theft.
- **[TA0005 - Defense Evasion]**
- **[T1036 - Masquerading]**: Presenting a synthetic face as a legitimate user.
- **[T1564.010 - Virtualization/Sandbox Evasion]**: Using emulators and app cloners to hide the true nature of the device environment.
- **[TA0006 - Credential Access]**
- **[T1056.002 - GUI Input Capture]**: Using overlays to steal PINs/passwords.
## Functionality
### Core Capabilities
- **Virtual Cameras/Camera Hijacking**: Replacing the hardware camera output with a pre-recorded or AI-generated video file using tools like "Virtual Camera" or modified OS drivers.
- **App Cloning**: Utilizing tools (e.g., AppCloner, Parallel Space) to run multiple instances of banking apps in a controlled, manipulated environment.
- **Emulators**: Running mobile applications on PCs to easily inject synthetic media and script automated interactions.
### Advanced Features
- **Real-time Facial Reenactment**: Using AI models to map a fraudster's facial movements onto a victim's static photo in real-time to pass dynamic liveness checks (e.g., blinking, head turning).
- **GPS Spoofing**: Overriding the device's actual location to match the victim's known location or to bypass regional restrictions.
- **Accessibility Service Exploitation**: Automating interactions within the app to speed up the fraudulent onboarding process.
## Indicators of Compromise
- **File Names**: Often associated with common cloning/rooting tools: `com.applisto.appcloner`, `com.lbe.parallel.intl`, `Magisk`.
- **Behavioral Indicators**:
- Presence of `allow_mock_location` settings enabled.
- Device identified as "Rooted" or "Jailbroken."
- Detection of developer tools or USB debugging active during a high-stakes transaction.
- Discrepancy between hardware metadata and the video stream properties (e.g., fixed resolution, abnormal frame rates).
## Associated Threat Actors
- GoldFactory (associated with GoldPickaxe and GoldDigger malware families).
- Various unnamed cybercriminal syndicates focused on Business Email Compromise (BEC) and financial fraud.
## Detection Methods
- **Behavioral Detection**: Monitoring for "improbable travel" (GPS jumps) and analyzing typing rhythm/navigation patterns that deviate from human norms.
- **Environment Attestation**: Using Google Play Integrity API or Apple DeviceCheck to verify the device is not an emulator or a cloned environment.
- **Liveness Anomaly Detection**: Identifying synthetic textures, unnatural blinking patterns, or "ghosting" artifacts in the video stream.
## Mitigation Strategies
- **Multi-modal Biometrics**: Combine facial recognition with voice, behavioral biometrics, and hardware-based tokens.
- **Device Fingerprinting**: Flagging devices that exhibit signs of rooting, hooking frameworks (like Xposed), or virtualization.
- **Cross-Channel Analysis**: Correlating web and mobile session data to identify inconsistencies in user behavior.
- **Step-up Authentication**: Requiring a video call with a human agent or a physical document verification when high-risk indicators are present.
## Related Tools/Techniques
- **GoldPickaxe**: A sophisticated trojan designed specifically to harvest facial recognition data.
- **ManyCam / OBS Virtual Camera**: Legitimate tools repurposed by fraudsters to inject video streams.
- **GPS JoyStick / Fake GPS**: Tools used to spoof geolocation during biometric enrollment.