Attackers can now stage ultra-realistic video calls using deepfakes of executives or colleagues to trick employees into granting access to internal systems and sensitive data. Arsen Deepfake video-based CEO fraud simulations let your team experience these attacks safely, before real attackers make their move. Built on the same simulation engine, philosophy, and reporting as Arsen's phishing and vishing simulations.
TL;DR: Arsen's deepfake video call simulation feature is built to train on advanced "CEO fraud". Employees receive a realistic meeting invite, join a pixel-accurate replica of a Microsoft Teams call, and meet an AI-generated likeness of one of your own executives. Whoever fails lands straight in just-in-time coaching, and results report through the same funnel and dashboard as every other Arsen campaign.
What is a deepfake video call attack?
A deepfake video call attack is executive impersonation carried out live on a video conference, using an AI-generated likeness (and potentially voice) of a real leader to authorize a payment, a credential reset, or a process exception. It carries no malware and no suspicious sender domain. The trust signal being exploited is the face on the screen, which is why technical controls have almost no visibility and verification behavior becomes the only real control.
Arup lost 25 million dollars in a single deepfake video call fraud in which every other participant on the call, including the CFO, was AI-generated.
Learn more about deepfake fraud →
What does a deepfake simulation scenario look like?
The most common tactic in these attacks is a four-step kill chain known as the "fake bug." It starts with a legitimate-looking video call invite impersonating a trusted tool like Teams, and a senior executive. It is a proven technique that threat actors continue to evolve.
| Step | What the employee experiences |
|---|---|
| 1. Realistic fake meeting invite | A realistic phishing email impersonating a Teams invitation (or another video call tool) and a selected executive, inviting the target to an "urgent" call. |
| 2. Deepfake video call with your exec | An interactive, pixel-accurate call interface. The deepfake exec appears to speak, a manufactured glitch hits, and an in-call chat message lands asking "can you hear me?" |
| 3. Payload delivery moment | The call drops, and a system prompt appears, standing in for a malware link or credential-harvesting page. |
This is the most common variant. Arsen also offers multiple variations and other deepfake-based scenarios inspired by real-world attacks.
Scenarios are built around your own executives, not a generic stock avatar, and around your internal workflows, because that is how a real threat actor constructs the pretext.
Employees experience deepfake fraud firsthand, with just-in-time coaching that builds lasting knowledge. Deepfakes are also covered across our broader security awareness program.
What is included?
- Realistic fake meeting invite lure
- Interactive, pixel-accurate replicas of the video call interface
- Deepfake-generated executive likeness
- System prompt standing in for the attacker's malware link or credential-harvesting page
- Just-in-time coaching tied to the employee's action
- Compliance-ready reporting integrated with your existing Arsen data
Arsen builds the deepfake persona, the video call scenario, the follow-up assets, and the send calendar. You approve; you don't build.
What can you measure?
Deepfake campaigns report through the same funnel as every other Arsen simulation: invitations sent, invitations opened, calls opened, and compromised. Within hours of rollout you know exactly which departments, executives, and employees would fall for a deepfaked call, with audit-ready evidence mapped to your compliance framework.
Line managers see who was fooled and follow up directly, so the security team stops being the one chasing every employee down.
What is available today?
- Microsoft Teams environments.
- Scenarios built by Arsen around a selected executive from your organization. This is a collaborative process with your security team, to build realistic scenarios and profiles.
- Results integrated with your existing Arsen data, so deepfake campaigns sit alongside phishing and vishing results in the same program view.
What is coming next?
- Google Meet and Zoom interfaces.
- Two-way AI conversations, multi-channel follow-ups, and live calendar invitations.
- Simulations extended to trusted profiles such as clients, vendors, partners, and synthetic identities.
Where does deepfake simulation fit alongside vishing and phishing?
Deepfake impersonation sits at the cutting edge of what a human training program should be testing. With one platform, you can test and train for every channel attackers use:
| Deepfake simulations | Vishing simulations | Advanced phishing |
|---|---|---|
| Realistic deepfake calls with executive impersonation or strategic internal profiles, using AI deepfakes. | Real-time realistic AI voice-phishing calls that adapt as the conversation moves, training employees against phone-based social engineering. Learn more → |
ClickFix, business email compromise, conversational scenarios, and other complex, AI-enhanced phishing tactics. Learn more → |
Same engine, same dashboard, same report: one program covering voice, video, and text, because that is what a real attacker's kill chain actually looks like.
How does the product grow with the deepfake threat?
- Turn simulations into immersive pentests. Combine Arsen-built executive deepfakes with realistic attack flows tailored to your organization. Use your own executives, not generic avatars, to mirror how real threat actors build their pretexts.
- Simulate attacks where your teams work. Run realistic social engineering scenarios directly in the tools employees already use, starting with Microsoft Teams. Cross-train your teams across multiple attack vectors to build strong resistance to social engineering.
- Measure resilience and compliance. Get compliance-ready reporting on deepfake-based simulations, integrated with your existing cyber awareness data. Report to your board on vulnerability and risk management progress.
Key Takeaways
- Deepfake Video Call Simulation is generally available, running on the same engine, dashboard, and report as Arsen's phishing and vishing simulations.
- The fake bug kill chain runs in four steps: fake meeting invite, deepfake call with a manufactured glitch, payload delivery prompt, just-in-time coaching.
- Scenarios are built around your own executives, not a generic stock avatar.
- Microsoft Teams today. Google Meet, Zoom, and multi-channel follow-ups are coming next.
- It closes the last untested channel, the video call, alongside voice and conversational email.
FAQ
-
A deepfake video call simulation is a controlled exercise in which an employee receives a fake meeting invitation, joins a realistic replica of a video call interface, and encounters an AI-generated likeness of a real executive from their own organization making a request. It measures whether the employee verifies the request when the face and voice appear legitimate, and coaches them immediately afterward. Arsen is a social engineering simulation and security awareness training platform covering phishing, vishing, and smishing, and deepfake video call simulation extends that program to video.
-
Microsoft Teams today, including the meeting invite lure and a pixel-accurate replica of the call interface. Google Meet, Zoom, and multi-channel follow-ups are coming next.
-
Yes. Scenarios are built around your organization's actual executives, not a generic stock avatar, because that is how a real threat actor constructs the pretext.
-
They cover voice and video against the same threat model, on the same engine, dashboard, and report. Attackers frequently chain them, so testing only one channel leaves the other unmeasured.
-
They land immediately in just-in-time coaching tied to exactly what they just experienced, not a generic awareness module. Results feed the standard Arsen reporting layer for manager visibility and audit evidence.
