Ledger / 27 Aug 2023
Retool breached via SMS phishing and deepfaked employee voice
Confirmed
Retool's own post-mortem says the caller deepfaked the employee's voice.
An employee clicked an SMS phishing link to a fake portal. The attacker then phoned the employee, using a deepfaked voice of a real colleague, and obtained the MFA code needed to take over the account.
“the attacker called the employee. The caller claimed to be one of the members of the IT team, and deepfaked our employee's actual voice.”Retool
Sources
- Retool: MFA isn't MFARetool · 13 Sep 2023 · primary source
- Date
- 27 Aug 2023
- Disclosed
- 13 Sep 2023
- Actor
- unknown (criminal), as attributed by Retool
- Targets
- Retool (software), crypto customers
- What the AI did
- Social engineering, Deepfake
- Model
- unspecified voice-clone/deepfake tool
- Model family
- Deepfake / voice
- Model basis
- stated by victim
- Autonomy
- assist
- Outcome
- Attacker obtained an MFA code by phone and took over an employee's account; 27 cloud customers were affected and crypto customers lost funds.