HIGHPhishing
Verified
United States

FBI Warns of AI-Generated Deepfake Voice Attacks Targeting Corporate Executives

Friday, March 6, 2026 at 09:00 AM UTC·Source: FBI IC3

Updated: Saturday, March 7, 2026 at 02:00 PM UTC

Executive Summary

FBI issues alert on rising deepfake voice attacks using AI-cloned executive voices to authorize fraudulent wire transfers. $68M stolen in Q1 2026.

Analysis

FBI warns of a surge in AI-generated deepfake voice attacks targeting corporate finance teams. Threat actors clone C-suite executive voices from earnings calls, conference presentations, and social media. The cloned voices are used in real-time phone calls to authorize urgent wire transfers. At least $68M has been stolen across 15 confirmed incidents in Q1 2026. FBI recommends implementing verbal code words for financial authorization.

Timeline

Discovered
Jan 15, 2026
Published
Mar 6, 2026
Source Attribution

Originally published by FBI IC3 on Mar 6, 2026. Verified by: FBI, CISA.

Related Threats

CRITICALPhishing

Yokogawa CENTUM VP

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-092-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker to login as the PROG user and modify permissions.</strong></p> <p>The following versions of Yokogawa CENTUM VP are affected:</p> <ul> <li>CENTUM VP >=R5.01.00|</li>

CVE-2025-7741
CISA Advisories
LOWPhishing

New EvilTokens service fuels Microsoft device code phishing attacks

A new malicious kit called EvilTokens integrates device code phishing capabilities, allowing attackers to hijack Microsoft accounts and provide advanced features for business email compromise attacks. [...]

BleepingComputer
CRITICALPhishing

PX4 Autopilot

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker with access to the MAVLink interface to execute arbitrary shell commands without cryptographic authentication.</strong></p> <p>The following versions of PX4 Autopil

CVE-2026-1579
CISA Advisories