Do you hire ghosts? Companies are victims of “Ghost employees”

New social techniques become more dangerous than classic ransomware campaigns.

Deepfake instead of a CV. A new face of cyber criminals

More and more companies are conducting online interviews, without realizing that they can talk to … a product of artificial intelligence. Palo Alto Networks analysts conducted tests that show that the creation of a convincing Deepfake takes only an hour. Cybercriminals willingly use this method – especially in the era of remote work, where the recruitment process is fully online.

How does modern ransomware work?

Instead of sending emails with viruses, criminals use Deepfake technology to impersonate candidates. Generated images appear on video conferences, convincing recruiters to employ a fictitious person. After employment, the fraudster gains access to company resources, which may result in data theft and a ransom demand.

– Cybercriminals recognize human weaknesses and use them to gain an advantage. Deepfake gives them new lead tools attacks – explains Wojciech Gołębiowski, managing director of Palo Alto Networks in Eastern Europe.

A false employee is real losses

Modern technology allows you to create deepfakes even using a several -year -old computer. Companies must learn to verify the identity of the candidates – e.g. by showing an identity card during interactive verification, known, among others from the banking sector.

– The principle of limited trust is needed. Candidates must know that checking their identity is a part of Nowoczesna cyberhigiene – emphasizes Gołębiowski.

How to defend yourself?

Organizations should implement multilayer security systems – both technological and procedural. It can help, among others Recording conversations (with consent), training recruiters and limiting access to new employees to key systems before they undergo additional verification.