Purportedly AI-Driven Phishing Scam Uses Spoofed Google Call to Attempt Gmail Breach of Security Expert

Scammers allegedly used a purportedly AI-generated voice to impersonate a Google representative in an attempt to steal Gmail account credentials from security expert Sam Mitrovic. The reportedly AI-driven phishing call used a spoofed Google phone number and a fabricated email, making the scam appear legitimate. Mitrovic reportedly noted that the caller's professional demeanor, coupled with AI-generated speech and a Google-related number, could easily deceive unsuspecting users.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves cybercriminals using AI-generated voices to execute highly realistic impersonation scams targeting specific individuals for personal and financial gain.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The ultimate objective of the AI-driven phishing scam is account takeover, which directly threatens the privacy of sensitive personal data stored in Gmail accounts.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The phishing campaign and the deployment of the AI voice bot were intentionally orchestrated by human cybercriminals to defraud users.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the use of AI-generated content such as deepfakes and synthetic voices, which falls under the transparency obligations of Risk Level 3.

AI system and alleged parties

• AI system: unspecified
• AI purpose: Voice Generation; Chatbot
• Behaviour type: Tool
• Alleged developer: Unknown voice cloning technology developers, Unknown deepfake technology developers
• Alleged deployer: Unknown scammers
• Alleged harmed parties: Sam Mitrovic, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Minor
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report describes attempted privacy violations through unauthorized account takeover attempts targeting Gmail accounts.

Directly caused: Scammers attempted to obtain credentials to take over Gmail accounts of Mitrovic, Tan, and others.

Indirectly caused: One reported victim had their account taken over, compromising all personal data within.

Inferred additional harm: It is likely that many of the inferred victims had their personal data, emails, and credentials compromised.

People affected

• Occurrences reported: 4
• People reportedly harmed: 1
• People reportedly exposed: 4

Potential causes

Management

• Lack of default passkey enforcement: Standard security settings relied on phishable recovery options by default.
• Delayed security integration: Collaborative scam signal exchanges were only recently initiated.
• Lack of human-based support: Lack of human support channels makes it hard for users to verify calls.

Technology

• Realistic AI voice generation: Generative AI voice models simulate perfect human pronunciation and spacing.
• Scalable automated calling: AI voice bots allow simultaneous execution of thousands of scam calls.
• Email and phone number spoofing: Attackers mask true identities by spoofing Google domains and phone numbers.

Data Inputs

• Abuse of CRM sender fields: Salesforce CRM allowed custom sender addresses to bypass validation.
• Abuse of Google Forms data: Google Forms response receipts sent via Google servers added legitimacy.
• Fake recovery request triggers: Maliciously triggered account recovery notifications initiated the workflow.

Human Factors

• Susceptibility to panic: Scammers engineered panic through false claims of compromised accounts.
• Cognitive overload from busy users: Busy individuals are more likely to miss subtle red flags during calls.
• Trust in official caller ID: Users trusted caller IDs matching legitimate Google business numbers.

Process and Methods

• Inadequate recovery verification: Recovery processes lacked robust checks on device name fields.
• Permissive CRM email routing: Salesforce allowed setting unverified sender addresses through Google servers.
• Lack of real-time signal sharing: Sectors historically lacked a shared database for real-time scam signals.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide consistent, detailed, and first-hand accounts from cybersecurity experts (Sam Mitrovic and Garry Tan) regarding the mechanics of the AI-driven scam. The technical details of the spoofing and voice generation are well-documented across multiple reputable sources.
• Ambiguities identified: The specific AI voice generation model or platform used by the scammers is not identified.
• Alternative interpretations: None. The incident is clearly a malicious phishing campaign leveraging synthetic voice technology.

Cybercriminals executed a sophisticated phishing campaign using highly realistic AI-generated voices to impersonate Google support staff, aiming to compromise Gmail accounts. While the national security impact is minor, the incident highlights how AI voice-cloning advances the scale and credibility of social engineering attacks against high-profile individuals and the broader public.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Australia, United States
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Near-term. Active campaign targeting users globally, requiring ongoing monitoring and defensive updates by email and telecom providers.
• Autonomy: Human-controlled. The AI voice generation tool is directly controlled and deployed by human scammers to execute specific parts of the phishing script.
• Novelty: Evolved capability. Represents a significant advancement in vishing by integrating highly realistic AI-generated voices with sophisticated multi-channel phishing techniques.

Impact by dimension

• Physical security: Negligible. No physical infrastructure or kinetic systems were targeted or affected by this voice phishing campaign.
• Information security: Minor. Use of highly realistic AI voice cloning to bypass security and compromise personal or professional accounts, posing minor risks to information security of targeted individuals.
• Sovereignty: Negligible. The incident is a cybercrime campaign targeting individual commercial email accounts with no impact on government operations or state sovereignty.
• Economic security: Minor. Targets include high-profile tech and investment figures, presenting minor risks of corporate data exposure and financial fraud, though no systemic economic damage occurred.
• Societal stability: Minor. While the realistic nature of the scam threatens digital privacy rights for targeted individuals, it does not threaten wider societal stability or cause mass human rights violations.