Audio-Visual Content (T1683.002) is a sub-technique of Generate Content. Adversaries create or manipulate audio, images and video to support targeting and malicious operations. MITRE lists the Resource Development tactic and the PRE platform.
How attackers use it
MITRE names several forms:
- Synthetic voice recordings.
- Real-time altered audio or video during live conversations.
- Fabricated profile photos and identity documents.
- Video depicting fabricated or impersonated people.
The content may come from editing tools, AI-assisted generation or third-party synthetic services. MITRE observes that AI tools have made it possible to produce synthetic media at scale that is harder to recognize as fake.
It supports other behavior, including Phishing (T1660), Spearphishing via Service (T1566.003), Phishing for Information (T1598), Internal Spearphishing (T1534), Social Engineering (T1684), Financial Theft (T1657) and Establish Accounts (T1585).
The technique page lists examples such as phishing pages that look like bank login portals, fictitious social media profiles with fake photos, AI-cloned video-conferencing applications and deepfake videos, job-themed websites, fake Outlook login prompts, and a branded wallpaper graphic placed on a victim's desktop.
How to detect it
MITRE notes that most of this happens outside the target's visibility. Detection should focus on the stages where this content is used, such as Initial Access.
How to reduce the risk
The Pre-compromise mitigation applies. Since a voice or a face can now be faked, do not make either one the proof of identity.
- Agree on a verification step for sensitive requests that does not rely on recognizing a person, such as a call back to a number from your directory.
- Require two approvers for payments and for changes to bank details.
- Tell staff that a video call from a known face is not enough to approve a transfer or a credential reset.
- Check meeting links and conferencing software against official sources before installing or joining.
- Treat unexpected login prompts as suspicious, and go to the real site directly.
Quick check
What should replace a familiar voice as proof of identity?
A process that does not depend on recognition, such as a call back to a verified number, a second approver, or an authenticated approval system.
Sources
- MITRE ATT&CK, Audio-Visual Content (T1683.002): https://attack.mitre.org/techniques/T1683/002
