Cyble’s Research and Intelligence Labs has identified an active global social engineering campaign that uses AI-generated code to trick users into granting browser-level hardware permissions, enabling attackers to capture live facial images and audio recordings directly from victim devices.
Unlike conventional phishing attacks that target login credentials, this campaign exploits legitimate browser APIs governing access to cameras and microphones. Targets are deceived through lures impersonating TikTok, Telegram, Instagram, and Google Chrome, with prompts framing the permission requests as required steps for identity verification or service recovery. Once permissions are granted, the malicious pages capture high-resolution facial images and audio that can be used to construct deepfakes or to bypass video-based Know Your Customer verification protocols.
Cyble’s researchers assessed that the campaign’s malicious infrastructure was developed with the assistance of generative AI tools. The operational code contains structured annotations and emoji-formatted comments consistent with AI-assisted development, a pattern the team said reflects the broader accessibility of AI coding tools to threat actors. Exfiltrated data is routed through Telegram Bot APIs functioning as command-and-control channels, with hosting provided via edgeone.app infrastructure.
The breadth of data collected extends beyond biometrics. Attackers also harvest approximate geographic location, device contact lists, and device telemetry, enabling comprehensive victim profiling. The combination of a facial image, an audio sample, and location data provides enough material to support account takeover through compromised identity verification channels, Business Email Compromise, or extortion using captured multimedia.
KYC protocols that rely on video selfie or liveness checks are a specific downstream risk. Attackers who obtain a clear facial image and a synchronized audio sample from a victim can potentially use that material to spoof liveness detection systems that do not implement challenge-response or behavioral analysis layers. Cyble recommends users deny camera and microphone permission requests from unrecognized sites. For organizations, the firm advises domain monitoring for suspicious infrastructure and restricting outbound traffic to unauthorized messaging APIs within corporate environments.
The campaign adds to a growing pattern of attacks targeting biometric data collection points. Biometric data breaches and deepfake-enabled fraud have driven increased investment in liveness detection and anti-spoofing controls across the identity verification sector.
Sources: CXO Digital Pulse
–
By the ID Tech Editorial Team
