The Security Guy and CIA Spy PodBroadcast- Don’t Take the Bait: AI Scams, Deepfakes & Phishing Texts

Come on, internet! And welcome to the Security Guy and CIA Spy Pod broadcast. I'm Robert Siciliano and this is This is Peter Wormka.

He is the security guy and I am the CIA spy, in case there's any confusion.

Yeah, and you are the tan CIA spy.

Yeah, and that's without a tanning bed. It's just all, all natural, okay? Exercising in the morning and just absorbing that, those rays.

Good for you, man. Lots of vitamin D, exercise. Yeah, man, keep it, keep, keep moving. That's it, that's it, that's the key to everything.

Keep moving. It is. It is like, how are you doing up there?

I'm good, man. Uh, it's, it's back to being 40-something degrees, but, uh, what are you gonna do, you know? It's, it is what it is. I'm actually gonna be in Florida myself not too, uh, in distant future, and, uh, spending an entire week with my wife without my kids, which is I think the first ever, which is kind of a big deal. Uh, you know, kids aren't exactly young anymore, and so, uh, she's, uh, had the hardest time as mama bear. Leaving the cave and without them. And, you know, I'm on planes all the time, but, you know, this is going to be a big deal, so I'm kind of excited.

Well, that's wonderful. Don't bring very many clothes, and don't read too much into this. I'm saying that you can have your— you can have your reasons for not bringing that many clothes, but I'm saying from the standpoint it's so warm down here and hot down here, you're not going to need many clothes. I mean, you're talking about 40 degrees up there. I mean, we're getting the mid-90s. With high humidity already here in Orlando.

Now, does it, does it rain every night of the week, like the thunderstorm type of deal?

Well, typically in the summertime it does, but we haven't reached that point yet. We haven't had these afternoon rain showers. Uh, it was only like maybe a week ago that we had a couple of nights that were like that, but we're still not in that— I mean, you might— I mean, it might change, right? But we're not there yet where you get those daily showers.

I'm so excited. Yeah, man. All right, cool. Uh, all right, so, so we, we've got like Look at the AI thing is something that I think is just going to be a topic of discussion with these, uh, pod broadcasts for quite some time in the near future due to the fact that we are at a, at a, at a what I would consider a tipping point. It's getting just so, so bad, and I don't know that, um, consumers are getting any more aware. I think that companies are really chasing their tail right now. They don't quite know what to do, and I think that that's because they're just simply still relying on phishing simulation training. Peter, what are you seeing right now?

Yeah, I agree. I mean, I'm normally— I'm, as you know, Robert, and, and the guests can also, you know, attest to that— I'm normally a very optimistic person, uh, but over the last few days when I've been out and about and giving courses and giving presentations and asking questions, I just feel right now, I, I just feel a bit of like real serious frustration, like I just don't think people get it. They don't, you know, some do of course, but so many just don't get it. They don't understand it. I'm talking about some concepts that we've been talking about for a long time here. It doesn't seem to resonate because they haven't really thought about— I'll give you, I'll give you an example. We've talked a lot about pig butchering, right?

That's—

I mean, I see that everywhere. There's a lot of this going on, but yet people, there's so many people that have never heard of it. And I gave a presentation to a group of law enforcement okay, that are supposedly out and they're in touch with the civilian population and they're, they're trained to be able to help individuals that might, you know, be approached or, you know, victims of scamming. And they've never even heard of pig butchering. It was a group of, uh, you know, 35 people. And I just, I was like, you know, what are we doing, Robert? What are we doing? You know, it's like we're the, the person out there, you know, trying to yell and bring this to the attention of people, but we're a We're just a couple of voices here that's kind of drowned out with all these other distractions that people are having. And I mean, I'm just at this point, I'm a bit— I'm not giving up. Of course, we got a lot of work to do, but I'm a bit frustrated because I just don't think people are tuned in and paying attention to this stuff.

Yeah, I just wrote a 1,400-word article for a financial service professionals consultancy, meaning that this company not only provides, you know, financial security for their clients, but what they really do with it, their big moneymaker, is they work with financial service professionals to help them build out their businesses. And, you know, so they've got, you know, hundreds of financial service professionals that subscribe to their newsletter and all of their trainings and such. And the article that I wrote on pig butchering, the CEO, the COO of the company had never heard of it. Which, which I find to be alarming. You know, I think that every financial service advisor, every banker, uh, should know right now already what pig butchering is and how deeply it's affecting the population. Uh, without a doubt, I'm— I see this as being the biggest, most lucrative fraud for the next 15 to 20 years, potentially, due to the fact that you and I have talked about the that there's $85 trillion in wealth that's being distributed right now as we speak for the next 15, 20 years by the baby boomers and the greatest generation to my generation, the, you know, Gen X, Gen Y, and, um, the millennials. And that money, uh, is being targeted by criminals worldwide, organized crime syndicates, many in Eastern Asia that are utilizing victims of human trafficking as the perpetrators of these crimes to send off text messages on a regular basis to correspond and engage with potential victims via the wrong number text. And then once the victim doesn't know that the text is a wrong number, or actually that the text is actually a scam, Once they respond saying, "Hey, you've got the wrong number," that's when the dialogue begins. That's when the, those walking around that are moneyed, not technically savvy, victims of the ache of loneliness respond, and they begin the dialogue, and 3 to 6 months later, they're out 6 and 7 figures. That's what pig butchering is. The fact that your group of law enforcement officers didn't know what it was, and that my, uh, financial service professionals consultancy client didn't know what it is, means that we are just the lone voices talking about this and nobody's listening. And it's bad.

It is bad. And you know, there's so many companies that also, they don't— they're not aware that they are— they are unwitting accomplices. Let me explain how this is. There are so many of these, for these individuals that are, that are involved in the pig butchering that create these fake personas, right? They're not using, of course, their real name. They're creating these fake personas, and many of them are creating these fake personas, uh, on social media to include LinkedIn. And what they will do is they will put prominent companies as their employer on their profiles. I mean, I talked about this some time ago, uh, in 2019, 2020. Actually, SpaceX identified over 1,000 profiles like that claim that SpaceX was their employer. They were young, attractive— the images are young, attractive Asian females who had worked in China, got their first degree in China, relocated to the United States, got their master's degree from one of 5 different prominent U.S. universities, and then ended up working at SpaceX. And this is not only SpaceX, there's a lot of other companies that their, you know, their reputation— at the end of the day, it's their brand reputation. If you allow your company to serve as the employer, at least on paper, for these individuals. I mean, it's— you're, you're, you're unwitting accomplices. There's a movie, I don't know if you've seen it, Robert, um, if you haven't, I highly recommend it. I highly recommend it to your, to your customers too. It's called, uh, No More Bets. It is produced by a Chinese filmmaker and, uh, about 2016, I think. And it's, it's a fictitious story, but it's basically modeled after how these criminal syndicates are operating predominantly in China and moving, you know, moving their operations onward to Cambodia, Thailand, uh, and Myanmar, and, and, you know, using human trafficking to get these individuals. You know, they're kidnapping these individuals and then they're holding them hostage in, in these gigantic, like, telemarketing centers where they have, you know, if they don't produce, they're, they're tortured. Anyway, this movie, okay, it's in Chinese with English subtitles, but there's also, if you do a little bit of a search, there's also a, a summary video in English that explains very, very well, you know, what's going on in this movie. And I think it's highly educational. No More Bets, I highly recommend it.

You know, interesting. Uh, definitely, thank you. Uh, I will watch that, and I recommend that all of your— our listeners and watchers watch as well. This Gina, uh, Jin, uh, who is one of the stars of the movie, so You know, uh, I hope nobody takes this the wrong way. I, I've, I've received what I think is, you know, dozens and dozens of, uh, of fraudulent false, uh, invites to, um, WhatsApp and Instagram and Facebook from a woman that looks exactly like Gina Yin. Now again, when I say don't take this the wrong way, like, you know, they all look the same to me. No, I, I do believe that they are using the likeness of this Gina Yin and as, as the, the, the model for a lot of these scams. And companies like LinkedIn and X and Facebook that have facilitated allowing others to set up profiles with this woman's photograph, that they could easily do a reverse image search automatically using biometric technologies and be able to identify right away all the various profiles that are using this photo. I, I, and I think that they'd be able to squash that pretty quickly. I am one of those people that has a very open profile on Facebook and other platforms, which means that I allow anybody and everybody to see what I have to say, meaning that they can connect with me, they can read my stuff, that there's no privacy settings at all. But what I do do is I do look to see who's connecting with me, and I don't generally connect with somebody who basically, uh, is relatively new to the platform and is often— and there's no other way to say it— a, an attractive young Asian female, because that is the scam that is being used to build these profiles. Uh, and often when I do check out the profile, she has 10 male friends and that's it. Uh, and, um, and I don't connect with them. And the reason why I don't connect with them is because they're looking to me and others essentially to connect, to facilitate the scam, and to give the fake platform, you know, credibility. And I'm not going to do that. I'm not going to contribute to that. All that said, look, like you said, these companies have the responsibility to squash this, and they're not. And I know that they can, and I know that they're not. Because when I do receive these invites, I always, by habit, respond to Facebook and LinkedIn and others and say, this is a scam. Uh, and, you know, just basically say, you know, through their own tools to let them know that this is, this is fraud. 9 out of 10 times I get a response back from Facebook, LinkedIn, and others saying, nope, we believe that this profile is fine, there's nothing wrong here. Um, they're all good, which could be one of two things: either I'm exceedingly racist, or they just don't know what they're talking about. And I don't think they know what they're talking about.

Well, I would, I would go even further, Robert. In many cases, they don't know what they're talking about, but also it— I shouldn't say this, but I believe in it. I believe it. I believe it. It goes against their business model. These platforms make increasingly more money when there's more engagement. So it's anything you put out there that's going to increase engagement, it means more profits for the company. So it's— I think they're only going to be really taking this seriously and properly, I mean, if you want to call it policing or, or monitoring this, is if there are regulations in place that if they don't, they're going to have serious repercussions, whether it's fines. You know, I'm not, I'm not for a lot of government regulations, but I think this is an example where we need to have more government regulations in regard to social media because the platforms themselves— expecting them to self-police and to, you know, do everything into the benefit of mankind— I don't think it's going to happen, sad to say.

Yeah, so basically, if their, their financial model, uh, there's no reason for them to, um, squash these fake profiles. That, that just pisses me off, Peter.

Me too.

It's not good. All right, so listen, the growing and changing threat of deep fake attacks. This is via securityboulevard.com. Accenture Cyber Intelligence has conducted extensive research on the evolving deepfake threat landscape and found that cyber threat actors have high and rising intent, capability, and opportunity to use deepfakes. This is just, you know, last week, May 15th, 2025, Peter, you know, and like, this is new. Ish, but the bad guys have been established using deepfake technologies, AI, to commit various forms of fraud for at least 2 years now, have been very effective at it, I'd say for at least a year and a half. And here, this article coming out like last week, and us talking about it for quite an extended period of time, as far as I'm concerned, me, like, everybody's too far behind the curve, all right? So here, the anatomy of a deep— of a successful deepfake. Research determines that successful or failure of a deepfake centers on 3 parameters, they say, Peter. The quality of the deepfake, and we're there.

Yep.

Um, the accuracy of the content, that's easy. And the delivery mechanism. Let's talk more about all 3, including the delivery mechanism. If any of these elements fall short, so does the deep fake ploy. OK, so skyrocketing demand for deepfakes by filtering a dark web search for verified offerings from reputable sellers, typically designed for targeting enterprises. They identified a continuous increase in demand between '22 and '24, right? A shift to targeting enterprises, big companies. Threat actors also significantly changing how they use deepfakes, and here's why. In 2021, underground actors focused on using deepfake for common fraud and cryptocurrency theft. However, 2024, they instead focus on using deepfakes to bypass enterprise security measures and gain access to corporate accounts, indicating a shift to broader enterprise compromise. And a lot of it, I think, has to do with the combination has resulted in a sophisticated attack and significant BEC compromises, including, as we've talked about, the loss of $25 million against a British engineering company that occurred basically in Hong Kong. Uh, that was back in, I believe it was 2022. That changed the game of everything, which they basically used malware to obtain a company's credentials, which they then used to join a company enterprise video conference call. In the call, the actors employed a dynamic deepfake, which allows for real-time face swapping, which I'm seeing in the pig butchering scam, and so are you, and vocal changes to help convince employees to download a security update that was malware. Although the attack was mitigated by automated tools stopping it from unfolding, the deepfake component of the attack was seemingly very successful, which resulted in transferring $25 million out of the company. Oh man. That was the model. That fraud was the model that they're seeking.

Well, remember, you know, a lot of times, I mean, this has happened in corporate, you know, in corporations, but it's also impacting a lot of individuals, right? Especially if we talk about these romance scams or pickpocketing scams. People used to say, well, you know, if this person, if this person doesn't want to transition to live chat, you know, uh, like video chat, they only want to stick to sending pictures and maybe talking, you know, speaking audio, that's an indication that it could be fraudulent, right? If that person doesn't want them to see them live. But now with this technology and how it's used, that's, that, that's out the window. I mean, because they can pick up and anytime be able to layer on that, that mask over their body and be able to talk. And I've seen demonstrations of this. It's, it's really amazing. And, and this is just getting started. We're just getting started.

Yeah, Peter, and, and we, we've discussed— I In the pig butchering scams that I'm engaged in, because I, I'm engaged— look, when we receive these wrong number text messages, most people mark them as spam, uh, you reject them, you, you know, delete them, you block them. I respond to them, hey, how you doing? Yes, I'm available for dinner tomorrow, right? I'm responding to all of them. And when I respond to them, generally the conversation moves to WhatsApp because it's much more private for the bad guy. And not going to be picked up by the various algorithms that Facebook might have to bump those fake profiles off. But they're still allowing way too many of them. But here, you know, once I engage, once I respond, usually— and what I found is after 6 to 7 days, less than a week, they're saying, hey, let's get on a video chat and really get to know each other.

Uh-huh.

Which, when that started to occur, when— as I'm engaging these frauds, these scams, as I'm scam baiting, and they start to say so quickly, let's move to video chat. I was astonished because it's like, that never happened in the past as a romance scam. That never occurred in the past. They would just provide all these reasons why they could not do that, right? Now, oh man, now it's like, as quickly as possible, get them on a video chat because that increases the faith and trust in the person on the other end of the line. Yes, they are so confident in the technology now that a week, uh, after— before a week is over, getting on video chat is like, yes, get them on video chat as quickly as possible. The technology is here. The time has arrived. The worst case scenario is right in front of us right now.

Yeah, it's, it, it's, you know, it's, it's scary because With AI, it's basically two things here. I mean, in addition to increasing the credibility, it's lower— has lowered significantly the barrier for so many scammers to get into this because they don't need to have, you know, a background in technology at all. A lot of this is offered, you know, they've got to pay, you know, and even the money they pay is not that much. And they can have, you know, there's access to forums where they can also get sort of insight, uh, mentors. And so a lot more the barrier for entry is lower, meaning more people can get involved, and the quality of these scams is also increasing. So we're, you know, we're heading to that perfect storm.

Yeah, we're here. Deepfake offering on dark web forum. In the post, the threat actors specify their tool works within WhatsApp, Telegram, Discord, and many other services, which the actor later specified includes any platform that uses a camera, making it useful for enterprise targeting. Right? Real-time deepfakes, dynamic deepfakes, are a much rarer dark web offering than static pre-recorded deepfakes, making the offer particularly vulnerable. The service is priced around $2,500 for indefinite rights, while the researchers observed deepfake solutions advertised between $400 and $1,000 per minute. They also observed a sample video from the scammers and assessed the quality of was surprisingly good for the cost. The solution worked well with, with head turns, blinking, and mouth gestures, all typically giveaways for a potential deepfake. I found the exact same experience in the WhatsApp live video calls that I've been involved in, where I'd be talking to my cryptocurrency girlfriend, let's say, who in most cases was from the accent, a Southeast Asian female with the face overlay, from my experience, usually of an Australian or Russian female. But again, they do not incorporate the— from my experiences, the dialect or the general, you know, Australian or even American dictation. Which is surprising, but that's coming. But it's, it's, it's, it's there, but they're not using that as widely. But oh man, the video is perfect.

Yeah, it's already available. Uh, I think it's important to point out, because people may be confused, is thinking, well, AI tech, how can, you know, how are they able to do this on the dark web? Or are they creating these, all these other technologies that are doing all these evil things? I think it's important to understand that when this technology is rolled out by these AI companies and much of it already has guardrails so that it cannot be used for unethical or illegal purposes. But on the dark web, that same technology is, if you want to call it a jailbreak, I mean, they take it out, take those parameters away, take those guardrails off where they can use the extent of that technology now for nefarious purposes in an area where there's actually no, you know, no, no, no, uh, it doesn't matter if it's illegal. I mean, nothing's going to happen to them. The dark web. Illegal or unethical, doesn't matter. It's the Wild West, and you can use this technology to the extent without worrying about the guardrails. Guardrails are taken off.

Taken off. This particular article, which again is about a week old, um, is probably, let's just say, about 1,500 words in general, right? And when you get down to the how to fight deepfake attacks, there's probably about 200 words there, which tells you two things. Number one, it tells you like there aren't a whole lot of things that are being done or can be done or technologies that are available to recognize that you're— you've encountered a deepfake. But what it also says is that the things that need to be done that are available to us right now are pretty simple, actually. So the combination of high-quality deepfake tools, readily available leaked enterprise data, and compromised internal accounts has made deepfake attacks significantly more effective, which means basically that those on the inside of the organization that aren't doing their basic cybersecurity 101 stuff, right? And the IT directors, the CISOs that aren't providing basic cybersecurity awareness that you and I offer way beyond phishing simulation aren't being implemented, Peter. It says that in response, organizations and individuals alike should be proactive at combining this emerging challenge. Employees should practice good cyber personal hygiene, and enterprises should consider a standard practice when profiling and assessing risks affecting the organization to understand available data on key employees and assess whether it could be sufficient to enable deepfake generation. Additionally, Enterprises should extend deepfake awareness training, which is what we do, uh, and mitigation techniques beyond C-suite executives and address the increasingly likely threat against other roles in the company. That's it. Yeah, pay attention, update your passcodes, use two-factor authentication, engage in awareness training, like pay attention what's going on out there, and you should be able to reduce that risk. But they're not doing that. As, as examples, like with you and me, law enforcement doesn't know what this is. Yeah, the financial service professionals don't know what this is. All of the Merrill Lynch's and JP Morgan Chase's and Fidelity Investments, they should all be telling their people this is what's going on. You need to tell everybody in your network what's happening and how to protect themselves and us and your clients from it.

Mm-hmm. And as you mentioned earlier, a lot of this training that's out there today is focusing on this anti-phishing training, like what's the flavor of today? And so it's not really cutting it when it comes to talking about this more advanced use of deepfakes and other AI tools. I mean, that training is just not cutting it. I think more companies need to evaluate, not just say, oh, we have this, oh, our employees are already getting this. They need to evaluate, is it really hitting the mark?

Is it? And it's not. But we are, Peter.

We are. It's got the whole battle, but we're not— I'm not giving up.

I'm not giving up.

Robert, I get more excited too. I said, anyway, we're gonna, we're gonna keep on fighting this battle because there's people out there that— I mean, if, if just if you're able to save one person, you know, who can hear us, from saving, you know, a couple hundred thousand dollars of their life savings, uh, and not be victimized by fraud, to me it's all worth It's all $100,000 is generous.

I'm seeing $600,000, $800,000, $2 million, $3 million. I've seen $3 million. I've never seen the volume of fraud being perpetrated in, in the incredibly astonishing dollar amounts being lost by so many people in such a short period of time. There was a day when the only time you'd ever see six figures being lost was in a Ponzi scheme. I an investment scheme. Yeah, buy a boots-on-the-ground human being that's one-on-one in contact with their clients. We're talking Bernie Madoff, right? Okay, who's dead, right? Now you're seeing that same level of fraud like daily with thousands of people all the time. And the most interesting thing that I found about these scams that I'm engaged in, Peter, is that as the potential victim as the, um, you know, victim of these scams that's responding to all of them, right? If I'm busy, which means that like I don't have time to respond to the scammer, if I'm busy and I don't respond for a day, they drop me, Peter. They drop me. They're like, we have— I haven't talked to you in so long, I miss you, but if you're not gonna respond to me, I have to move on with my life. They literally say like— they're like, they're like They're like showing that they're needy, that if I don't respond to them, like, they're moving on with their lives. And if I don't respond to them, they're gone. And that is because the victims of human trafficking, in this case, there's only so many of them that can actually respond to the victims. They have so many opportunities right now that they're moving on to the people who are responding on a regular basis, 6 to 8 times a day. That are fully invested in their new friend, and there is only so many perpetrators available to actually engage.

Yeah, no, it is a very good point. It is true. If they do not have a— I mean, back in my, my days in the intelligence world, if we were trying to, like, develop somebody, you know, you would, you would have to be able to gain access to that person and have that regular communication with them, because if you did not, you know, it was not going to go anywhere. We would, we would drop a person from, from active development to potentially recruit them because, hey, you can sense that. So, you know, they're probably, they're probably dealing with at least 7 to 10 active people each day that they can— that they're, they're doing this with, right? They're just like going non-stop, you know, moving on from one to another. And they're probably like 7 to 10 individuals that they're actively developing at any one time.

So at least, yeah, I would say, yeah, at least that volume is just going to go up and up and up. So Peter, tell everybody where you're at, what you got going on, how they can find you.

Well, you can find me at counterintelligence-institute.com or on my LinkedIn profile. Work is picking up, doing a number of traveling as well as virtual presentations in the States. What's really picking up, I'm finding, is overseas. A number of places overseas now that seem to be more engaged and more interested in these things than our fellow Americans, which kind of, you know, I think people here need to wake up a little bit more as well. But yeah, that's where you can reach me. And once again, think about upcoming Cybersecurity Month in October for both myself and And Robert, I mean, we're available, uh, we're available. Reach out to us and find out if we're able to provide you with the presentation to your group.

Thank you, Peter. And I am online at protectnowllc.com or safer.me, uh, not too difficult to find if you search, uh, Robert Siciliano. I'm all over the web and pretty much on the first 3 pages of search. Uh, other than that, uh, Peter, last words.

Watch no more bets this weekend. Have a great, uh, have a great weekend and, uh, watch out. And these things are all around us. And even if you think you've got a handle on it, you know, you got— we have loved ones, we have families, friends. Make sure that you can talk to them about these, these threats.

Awesome, man. I appreciate you.

You too.

Good luck, everybody.