HIGHPhishing
Verified
United States

Scattered Spider Uses AI Voice Cloning to Bypass Voice-Based MFA

Monday, March 16, 2026 at 01:00 PM UTC·Source: FS-ISAC

Updated: Tuesday, March 17, 2026 at 10:00 AM UTC

Executive Summary

Scattered Spider adopts AI voice cloning to defeat voice verification MFA at financial institutions. Three banks confirm successful bypass.

Analysis

Scattered Spider has adopted AI voice cloning technology to defeat voice-based multi-factor authentication used by financial institutions. Attackers clone customer voices from social media and publicly available audio, then use the cloned voices to authenticate to banking systems via phone. Three major banks have confirmed successful MFA bypass incidents. Industry group recommends transitioning away from voice-based authentication.

Timeline

Discovered
Mar 10, 2026
Exploitation Detected
Mar 10, 2026
Published
Mar 16, 2026
Source Attribution

Originally published by FS-ISAC on Mar 16, 2026. Verified by: FS-ISAC, FBI.

Related Threats

CRITICALPhishing

Yokogawa CENTUM VP

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-092-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker to login as the PROG user and modify permissions.</strong></p> <p>The following versions of Yokogawa CENTUM VP are affected:</p> <ul> <li>CENTUM VP >=R5.01.00|</li>

CVE-2025-7741
CISA Advisories
LOWPhishing

New EvilTokens service fuels Microsoft device code phishing attacks

A new malicious kit called EvilTokens integrates device code phishing capabilities, allowing attackers to hijack Microsoft accounts and provide advanced features for business email compromise attacks. [...]

BleepingComputer
CRITICALPhishing

PX4 Autopilot

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker with access to the MAVLink interface to execute arbitrary shell commands without cryptographic authentication.</strong></p> <p>The following versions of PX4 Autopil

CVE-2026-1579
CISA Advisories