Loading…
Combined Attacks
The most dangerous attacks combine voice cloning, AI exploitation, and human social engineering into a single coordinated operation. This is the frontier of call center threats.
The Full Kill Chain
A combined attack follows a structured sequence — each phase builds on the last. Understanding the full chain helps defenders recognize an attack at any stage.
Phase 1: Recon & Voice Capture
Obtain target voice samples from earnings calls, YouTube, voicemail greetings, conferences. 10-30 seconds is sufficient for modern cloning.
OSINT tools, social media scraping, conference recordings
Phase 2: Voice Clone & Agent Setup
Clone the target's voice using AI tools. Set up a voice agent with the cloned voice that can interact naturally, armed with researched PII and context.
XTTS/RVC for cloning, LiveKit for real-time agent, llama.cpp for conversation
Phase 3: AI Probe
Use automated tools to probe the target organization's AI defenses. Map their IVR, discover agent capabilities, test prompt injection vectors.
Automated call scripts, systematic prompt injection testing
Phase 4: The Attack Call
Call the target using the cloned voice in real-time. The AI agent handles natural conversation while the human attacker directs the strategy. Hybrid human-AI attack.
Real-time voice conversion, AI agent for consistency, human for strategy
Phase 5: Exploitation
Execute the objective: wire transfer, account takeover, data extraction, credential harvesting. The cloned voice provides credibility throughout.
Depends on objective
Human-in-the-Loop AI Attacks
The most sophisticated attacks use AI as a force multiplier while a human attacker makes strategic decisions.
AI handles small talk
The AI agent manages natural conversation flow — fillers, pleasantries, holding patterns, and routine responses. This keeps the call sounding natural while the human attacker listens, analyzes, and plans the next strategic move. The AI never gets flustered, never forgets its cover story, and can maintain the cloned voice perfectly throughout.
Human handles pivots
When the target gets suspicious, asks an unexpected question, or the conversation takes an unanticipated turn, the human attacker takes over for the critical moment. Humans are still better at reading emotional cues, improvising under pressure, and making judgment calls about when to push and when to back off.
AI maintains voice
Real-time voice conversion keeps the cloned voice consistent throughout the entire call, even when the human attacker speaks in their natural voice. The AI handles the voice transformation layer so the human can focus entirely on strategy without worrying about maintaining a vocal disguise.
Human decides escalation
The human attacker reads the overall situation and makes strategic decisions: when to escalate the request, when to retreat and try a different angle, when to end the call and try again later, and when to push for the final objective. This judgment is what separates a successful attack from one that gets flagged.
Attack Scalability: Why This Matters Now
AI hasn't just made attacks more convincing — it's made them scalable. What used to require one skilled attacker per target can now be automated across thousands.
2020: Manual SE
One attacker, one phone, one target at a time. Required significant skill and improvisation — the attacker needed to be fluent in the target's language, understand the organization's internal processes, and think on their feet for every unexpected question. A single failed call meant hours of preparation wasted. Didn't scale beyond a handful of targets per day.
2025+: AI-Augmented SE
One attacker with AI tools can run dozens of simultaneous attacks with cloned voices, automated conversation, and real-time adaptation. The AI handles language fluency, maintains consistent cover stories, and never gets tired or flustered. The human attacker supervises multiple concurrent calls, stepping in only for critical moments. Scales to thousands of targets with minimal additional effort per target.
Check Your Understanding
Question 1 / 3
During a human-in-the-loop AI attack, when does the human attacker typically take direct control?