Hyper-realistic social engineering. Is this the real life?

The use of generative AI allows malicious actors to launch hyper-realistic social engineering campaigns and carry out fraud or infiltrate organizations

Have you seen young versions of David Beckham, Zinedine Zidane, or Alessandro Del Piero in an ad related to the 2026 World Cup alongside Bad Bunny or Lamine Yamal? You’re not dreaming—AI has been used to rejuvenate these stars and restore their appearance to how they looked when they were still professional players.

We are all well aware of the amazing things that can be created using AI tools, but we must not forget that this technology can also be used for malicious purposes.

Hyper-realistic social engineering is a dangerous trend looming over companies, institutions, and citizens.

Cybercriminals are exploiting the potential of generative AI solutions to impersonate people and create synthetic identities that allow them to commit fraud against individuals (for example, through romance scams) and, above all, against companies: ordering money transfers by impersonating executives, infiltrating organizations using synthetic identities, obtaining access credentials to corporate software, etc.

Next, we’ll discuss how malicious actors are leveraging AI to design and execute hyper-realistic social engineering campaigns that make it difficult for victims to discern whether what they see and hear is real or fake.

Hyper-realistic social engineering is fueling investment scams

One study estimated that frauds carried out using deepfakes resulted in losses of $1.65 billion in 2025. Half of this amount stemmed from scams related to the investment market.

In recent years, so-called investment platforms have proliferated, featuring celebrities who encourage people to invest in them based on their success stories. These platforms are promoted on Facebook, X, and other platforms by exploiting hacked social media accounts to create fake profiles.

As a result, many criminal groups have been able to create image and video deepfakes of political leaders, businesspeople, artists, or athletes that are so convincing that some people are willing to invest their money in fake investment platforms. Obviously, no such investment platform actually exists, so once the money is transferred through a website that pretends to be legitimate, the victim loses their money.

This dangerous form of hyper-realistic social engineering not only poses a threat to people who invest their money through digital channels but also affects business leaders, public figures, and organizations whose identities are impersonated, as it damages their credibility—even if they have nothing to do with the scams.

The creation of synthetic identities poses a threat to the financial sector

One of the most dangerous aspects of hyper-realistic social engineering is the use of AI to generate extremely credible synthetic identities.

How are these synthetic identities created? Real data about real people (such as ID numbers or Social Security numbers) is combined with AI-generated personal information. This results in identities that appear to be real but are not. The goal? To gain access to financing through companies in the sector.

Consequently, campaigns aimed at defrauding companies in specific areas—such as auto financing and consumer loans—have been detected.

AI enables malicious actors to generate identities so realistic that they bypass the controls imposed by financial institutions to access financing channels.

It should therefore come as no surprise that the financial sector—which has always been at the forefront of cybersecurity—is leading the effort to adopt strategies, policies, and security mechanisms that enable organizations to detect fraud based on hyper-realistic social engineering.

Hyper-realistic social engineering: a weapon in geopolitical conflicts that puts tech companies on the defensive

In April 2026, an American man was sentenced to nine years in prison for contributing to the success of a fraudulent operation that involved convincing U.S. and European tech companies to hire North Koreans who used synthetic identities to pose as Western workers providing remote services.

In other words, this type of fraud combines the theft of data on real people with the AI-generated creation of images, video, and voice recordings to corroborate their identities. In fact, some professionals made video calls using AI to, for example, eliminate their accents and pass themselves off as Americans.

According to the United Nations, this system of creating synthetic identities to secure employment for North Koreans at technology companies generates between $250 million and $600 million for North Korea and, along with cryptocurrency theft, serves as a key source of revenue to finance the regime in a particularly challenging geopolitical context.

Furthermore, we must consider other objectives related to this criminal system: infiltrating companies with workers who can steal industrial and intellectual property, gain access to trade secrets, or facilitate attacks from within by spreading malware throughout corporate systems.

It is also important to consider the use of hyper-realistic social engineering in manipulating public opinion. The war in Iran and the growing military tensions between Pakistan and India are just two examples of how deepfakes are being used on social media to spread disinformation.

Hyper-realistic social engineering exploits professionals’ trust in corporate hierarchies

Returning to the business world, it is clear that hyper-realistic social engineering has become a major threat to companies of all sizes and across all industries.

Cybercriminals can use AI to generate sophisticated deepfakes of virtually anyone—not just well-known businesspeople or executives. Why? In the digital age, our image and voice are easily traceable through social media, the news, or corporate websites.

As a result, malicious actors use AI systems to create voice or audiovisual deepfakes of senior executives. To what end? To deceive professionals working in their finance departments—that is, people authorized to make bank transfers.

For example, the director of a multinational company in Singapore participated in a Zoom meeting that included her company’s CFO, as well as other executives. As a result of this meeting, she authorized a transfer of half a million dollars. Not a single person participating in the meeting, except for her, was real.

This case is not an isolated incident; there are an increasing number of frauds targeting companies that rely on hyper-realistic social engineering made possible by the use of AI tools.

Furthermore, cybercriminals leverage two key factors to their advantage:

1. The lack of cybersecurity training among company staff—and especially among professionals working in finance departments.
2. The power of hierarchy. No professional wants to question a direct order from a superior. As a result, they don’t even consider the possibility that the order might not be genuine.

Can these hyper-realistic social engineering campaigns be prevented by using tools to verify whether audio or images are AI-generated? This type of technology already exists, but malicious techniques are becoming more sophisticated at a faster rate than automated detection and protection mechanisms can be optimized. As a result, cybercriminals have tools and techniques that allow them to deceive deepfake detection solutions.

The Expansion of the Deepfake-as-a-Service Model Is Fueling the Spread of Hyper-realistic Social Engineering

As if the threat of using AI to carry out hyper-realistic social engineering campaigns weren’t dangerous enough, Deepfake-as-a-Service models have proliferated in recent months.

As a result, criminal groups have developed AI-powered tools that enable malicious actors—even those without extensive knowledge or resources—to carry out social engineering attacks in exchange for payment.

For example, Haotian AI is malicious AI-based software of Chinese origin that enables the creation of deepfakes via WhatsApp, Microsoft Teams, Zoom, or Instagram. This goes so far that cybercriminals can alter their appearance in real time and thus perpetrate all kinds of fraud against businesses, as well as against citizens.

The expansion of Deepfake-as-a-Service models increases the number of potential malicious actors capable of launching hyper-realistic social engineering attacks, ranging from fake video calls to impersonating the voices of specific individuals during phone calls.

All of this means that in the coming months and years, the number of attacks—as well as their success rate—could increase significantly.

What can organizations do to protect themselves against hyper-realistic social engineering?

Faced with such a challenging and dangerous threat landscape, it is essential for companies to take into account the risks posed by hyper-realistic social engineering. Therefore, it is crucial for companies to have cybersecurity services that enable them to be better prepared against frauds designed and executed using AI systems:

• Threat Intelligence. This type of service helps identify the most plausible attack scenarios for an organization based on its lines of business. In this way, companies can analyze the threats they face related to hyper-realistic social engineering, determine the associated risk levels, and implement measures to prevent fraudulent activity.
• Digital Surveillance Service. Cyberintelligence experts detect organizational risks related to individuals and verify professionals’ employment and educational histories to prevent synthetic identity fraud.
• Social engineering tests adapted to use AI for identity impersonation and the creation of synthetic identities. These types of tests simulate 100% realistic attacks to assess a company’s ability to withstand hyper-realistic social engineering campaigns and to train and raise awareness among professionals and executives about the risks.

Ultimately, advances in AI and the development of tools and techniques that enable hyper-realistic social engineering campaigns pose a major threat to businesses today. That is why it is critical for companies to take this type of threat into account when designing their cybersecurity strategy, thereby preventing themselves from falling victim to financial fraud or espionage.

If Freddy Mercury asked, «Is this the real life? Is this just fantasy?», hyper-realistic social engineering confronts us with a new question: Is what we see real, or is it a nightmare? Millions of euros may be at stake.