CEO Doppelgänger Injection: Defeating “Live” Video Verification

The Death of “I’ll Believe It When I See It”

For decades, the live video call was the gold standard of digital trust. If a CEO hopped on a Zoom call, waved hello, and authorized a wire transfer, the transaction was considered verified. That era is over.

As we move through 2026, a sophisticated attack vector known as CEO Doppelgänger Injection has rendered traditional video verification dangerously obsolete. Attackers are no longer relying on pre-recorded deepfake videos or static masks. Instead, they are utilizing low-latency, real-time generative adversarial networks (GANs) to hijack live camera feeds, effectively “injecting” a synthetic persona into a secure verification session.

In this article, we dissect the mechanics of these attacks, analyze the landmark Arup case, the March 2025 Singapore incident, and the explosion of real-time voice fraud, and explore the Injection Attack Detection technologies that are now the critical line of defense against a face that looks, moves, and speaks exactly like your boss.

The Numbers Don’t Lie

Before diving into the mechanics, the scale of the problem deserves its own moment.

Financial losses from deepfake-enabled fraud exceeded $200 million in the first quarter of 2025 alone — and that figure only covers reported cases. Deepfake-related incidents surged to 580 in the first half of 2025, nearly four times the total for all of 2024. Fraud analysts at Deloitte project that AI-enabled fraud will grow from roughly $12.3 billion in 2024 to $40 billion by 2027, driven by a 32% compound annual growth rate. CEO fraud now targets at least 400 companies per day using synthetic media, and a 2025 iProov study found that only 0.1% of participants correctly identified all fake and real media shown to them in testing. We are, statistically speaking, nearly blind.

The barrier to creating these attacks has also effectively collapsed. Modern AI tools can clone a voice using as little as 3–5 seconds of clear audio. Video deepfakes convincing enough to fool employees can be generated using freely available open-source software running on a high-end consumer GPU. This is no longer nation-state territory.

The Evolution: From Presentation Attacks to Digital Injection

To understand the threat, we must distinguish between the two primary methods of biometric fraud that have evolved in parallel over the last five years.

Presentation Attacks (The Old Way) involved holding a high-resolution photo, a tablet playing a video, or wearing a 3D-printed silicone mask in front of a webcam. Security systems countered these with “Liveness Detection” — asking users to blink, smile, or turn their heads. Depth sensors and texture analysis could spot the glare on a screen or the absence of natural skin texture in a silicone mask.

Digital Injection Attacks (The New Way) bypass the physical camera lens entirely. The attacker does not stand in front of a webcam. Instead, they use Virtual Camera software or malware to feed a synthetic digital video stream directly into the application — Zoom, Microsoft Teams, or a KYC verification app. Because the data enters the system digitally, there is no screen glare, no resolution degradation, and no tell-tale artifacts from a physical presentation. To the verification software, the feed looks like a pristine, high-definition stream from a premium webcam. The face on the other end just happens to be someone else’s, rendered in real time.

Case Studies: The Multi-Million Dollar Wake-Up Calls

The Arup Incident — $25.6 Million on a Fake “All-Hands” Call

The Arup engineering firm scam, which came to public light in early 2024, remains the defining case study for Doppelgänger Injection at scale. A finance employee in Hong Kong received a message from what appeared to be the company’s CFO regarding a confidential transaction. Suspicious, the employee requested a video call to verify before proceeding.

On that call, the employee saw not just the CFO, but outside legal counsel and other familiar colleagues — all present, all conversing naturally, all authorizing the transaction. Every single person on that call was a deepfake. The attackers had used publicly available footage of Arup executives to train real-time face-swapping models. When the employee asked questions, the deepfake CFO answered in real-time. The employee authorized fifteen transfers totaling HK$200 million — approximately $25.6 million USD — to five separate Hong Kong bank accounts.

Arup’s global CIO Rob Greig, reflecting on the incident, noted that “the number and sophistication of these attacks has been rising sharply.” The key psychological insight the attackers exploited was what we might call the “safety in numbers” bias: we can imagine one deepfake being possible, but a room full of convincing, interactive ones feels impossible. It isn’t.

The March 2025 Singapore Incident — $499,000 and a Deliberate Trust Trap

By March 2025, attackers had learned from Arup and evolved their social engineering. A finance director at a multinational firm in Singapore received contact from someone posing as the company’s CFO regarding an urgent wire transfer for a confidential acquisition. The finance director, aware of deepfake threats, hesitated. The attackers, anticipating this, proactively suggested a video call to verify the request — turning the verification mechanism itself into the weapon.

The finance director joined a Zoom call where the CFO and other executives appeared on screen. Everyone looked right. Everyone sounded right. The director authorized a $499,000 transfer. Every face on that call was AI-generated using publicly available media of the actual executives.

This evolution is critical: the attack no longer relies on a victim failing to seek verification. It relies on weaponizing verification itself. The willingness to “hop on a quick call” is now a red flag, not a safety net.

The Ferrari Near-Miss — A Question That Saved Millions

Not every attack succeeds. In a widely reported incident, fraudsters attempted to impersonate Ferrari CEO Benedetto Vigna through an AI-cloned voice call that, by all accounts, perfectly replicated his distinctive southern Italian accent. The call was only terminated after a Ferrari executive asked the caller a question only Vigna himself would know the answer to. It was a question no training dataset could have anticipated. Similar attempts have been documented against WPP CEO Mark Read and executives across multiple industries.

These near-misses validate the human out-of-band verification approach — but they also illustrate how close the margin is.

Technical Deep Dive: How Doppelgänger Injection Works

The attack relies on a stack of technologies working in concert to minimize latency and maximize realism.

The Engine: Real-Time Face Swapping

Attackers use software like Deep-Live-Cam, DeepFaceLive, or proprietary tools built on the InsightFace library. These tools work by taking a “target” image (the CEO) and a “source” stream (the attacker’s own live feed). The AI maps the facial landmarks — eyes, nose, mouth geometry — of the attacker’s live face onto the texture map of the target. Modern consumer GPUs such as the NVIDIA RTX 4090 or 5090 can process these swaps at 30+ frames per second with under 50ms of latency, which is imperceptible in a standard Zoom or Teams call where network jitter routinely hides minor sync discrepancies.

Investigative reporting from 404 Media has confirmed that scammers now use tools like DeepFaceLive, Magicam, and Amigo AI to alter their face, voice, gender, and race during live video calls — in real time, interactively, and without specialized hardware beyond a gaming PC.

The Vector: Virtual Camera Injection

The deepfake video feed is routed into the call using Virtual Camera drivers. On a PC or Mac, attackers use OBS (Open Broadcaster Software), ManyCam, or custom virtual camera drivers, selecting them as the video input source in Zoom or Teams just as a legitimate user would select their webcam.

On mobile devices — a vector that directly threatens banking and KYC applications — the attack is more invasive. Attackers use function hooking frameworks such as Frida or Xposed on rooted Android devices to intercept the android.hardware.camera2 system call, replacing the camera buffer with their own synthetic video stream. The banking or verification app believes it is communicating directly with camera hardware. It is not.

The Audio: Real-Time Voice Conversion

The visual feed is only half the attack surface. Attackers use RVC (Retrieval-based Voice Conversion) models alongside the video pipeline. The attacker speaks into a microphone and the AI re-skins their voice into the target’s timbre, pitch, and cadence in real time. Platforms documented on dark web forums — including tools like Xanthorox AI — automate this pipeline, allowing a single operator to toggle between multiple synthetic “voices” across different callers on the same conference call.

Why Traditional Liveness Detection Fails Completely

Most active liveness tests rely on challenge-response prompts: “Please blink twice,” “Turn your head left,” “Read these numbers aloud.” Doppelgänger Injection defeats every one of these trivially, for a simple and inescapable reason: the attacker is a real, live human being. The deepfake is not autonomous. A human operator sits behind the synthetic mask and performs every requested action. When the app asks the deepfake to blink twice, the human blinks twice, and the real-time face-swapping maps that blink onto the target’s face perfectly. The system sees a live human performing the correct biological actions. It just happens to be a human wearing a photorealistic digital mask.

This is the fundamental design failure of challenge-response liveness detection against injection attacks. Gartner research confirms this inflection point, projecting that by 2026, 30% of enterprises will no longer trust identity verification tools that rely on face biometrics alone — not because the tools are poorly designed, but because the threat model they were designed for no longer exists.

The New Defense: Injection Attack Detection (IAD)

If the eye can be fooled, we must trust the code. The security industry is undergoing a paradigm shift from asking “Is this a real person?” to asking “Is this a real camera?”

Virtual Camera Detection

Security SDKs from vendors including Mitek, FaceTec, and iProov now inspect the source of the video stream itself rather than the content of the video. This involves driver inspection — checking whether the device name contains strings like “Virtual,” “OBS,” or “ManyCam” — and driver signature verification, confirming whether the camera driver is cryptographically signed by a known hardware manufacturer such as Logitech, Apple, or Realtek, as opposed to a generic software publisher.

Modern defense tools, as summarized by the AKATI Sekurity Enterprise Defense Guide, analyze both whether the video feed is originating from a physical camera driver or a virtual software driver, and pixel-level compression artifacts that the human eye cannot perceive.

Photographic Noise and Sensor Artifact Analysis

Real camera hardware is imperfect by nature. Physical sensors produce ISO grain (sensor noise), focus breathing (slight magnification changes as the lens adjusts), and chromatic aberration (subtle color fringing at lens edges). Generative AI, by contrast, produces mathematically “perfect” pixels. Injection detection algorithms analyze video frames for the absence of natural sensor noise or the presence of GAN artifacts — inconsistent subsurface lighting on teeth, blurring near the hairline and ears, or repeating texture patterns in the skin.

Challenge-Response 2.0: Environmental Light Reflection

The most robust passive liveness tests now interact with the physical environment rather than the user’s facial muscles. In a “flash test,” the phone or application screen emits a rapid, random sequence of colors — Red, Blue, Green — and the camera system checks for the corresponding light reflections appearing on the user’s skin and environment in real time. A pre-injected synthetic video stream cannot reflect the light from the user’s actual physical screen in real time. Unless an attacker constructs an elaborate physical simulator, this Light Reflection Analysis detects that the video feed is disconnected from the physical reality of the device running the call.

The C2PA Standard: Cryptographic Video Provenance

The Coalition for Content Provenance and Authenticity (C2PA) — a coalition originally founded by Adobe, Arm, Intel, Microsoft, and Truepic, now comprising over 200 member organizations including Deloitte, Sony, the BBC, and the New York Times — has developed a freely available open specification for embedding cryptographic provenance directly into digital content.

The standard works by packaging cryptographic signatures, file metadata, and a complete edit history into a tamper-evident manifest that accompanies the content itself. If the content is altered, the signature breaks. In January 2025, the NSA and NSS released guidance endorsing C2PA Content Credentials as a key layer of organizational media defense. The EU AI Act, effective August 2025, now mandates that AI-generated or AI-edited content carry machine-readable authentication markings.

Looking toward the near future, corporate video conferencing tools from Microsoft Teams and Zoom are being evaluated for “Verified Capture” support, which would cryptographically sign a video stream at the hardware level using the device’s Trusted Platform Module (TPM), certifying that the feed originated directly from a specific physical camera lens and was not modified by any intermediate software layer. Once adopted at scale, an unsigned video stream would be inherently suspicious by default.

Strategic Mitigation for Organizations

If you are a CFO, CISO, or security director, checking the ID is no longer sufficient. You need protocols that route around human perception entirely.

Establish Out-of-Band Authentication for every high-value action. Never authorize wire transfers, executive approvals, or credential changes solely on the basis of a video call, regardless of how convincing it appears. The protocol should be simple and non-negotiable: any request initiated via video must be confirmed through a second, unrelated, pre-established channel — an encrypted message to a verified personal number, a confirmation token in the company’s ERP system, or a separate call placed to a known number independently. Not a number provided during the suspicious call.

Deploy detection tools that analyze the stream, not the face. Work with KYC and verification vendors who have implemented virtual camera detection, driver signature verification, and sensor artifact analysis. Ask specifically whether their platform can detect injection attacks, not just presentation attacks.

Engage with C2PA adoption. Begin internal documentation of how your organization handles video-based authorizations and assess where C2PA-signed content could add a provenance layer to official communications. Major banks and fintech organizations are already implementing cryptographic signature verification in document intake processes; corporate communications should follow.

Train employees to challenge passivity on calls. In the Arup case, the deepfakes were convincing but relatively passive. Training employees to issue spontaneous, specific, and unpredictable challenges — “Can you hold up today’s newspaper and read the headline?” or “What was the topic of the message I sent you this morning about the Sydney project?” — remains surprisingly effective because real-time GANs still struggle with complex hand-object interaction and genuinely novel conversational ground.

Implement an escalating skepticism culture around urgency. Both the Arup and Singapore attacks relied heavily on manufactured urgency — confidential acquisitions, time-sensitive wire windows — to compress the time available for verification. A standing policy that any request framed as urgent and confidential on a video call triggers automatic out-of-band delay is a low-cost, high-value control.

The Near Future: Fully Automated Vishing at Scale

The next frontier requires no human operator at all. We are beginning to see the emergence of LLM-driven deepfake bots, where an autonomous AI agent generates both the synthetic video and the conversational responses in real time, based on a script or a continuously adapting language model.

The implications for scale are profound. Current attacks require a skilled human operator manually “piloting” a CEO persona through a single call. An autonomous system could theoretically run the same attack — with the same face, the same voice, drawing on intercepted internal communications for contextual authenticity — against thousands of mid-level managers simultaneously, without any human involvement beyond initial deployment.

This is not a distant hypothetical. The tooling convergence — real-time face swapping, voice cloning, large language models, and virtual camera injection — has already been demonstrated in individual components. Integration is a matter of engineering effort, not research breakthrough.

Conclusion: Stop Trusting the Face

The era of video liveness as a standalone proof of identity is over. The technology to inject a realistic, real-time synthetic persona into a live video call is now consumer-accessible, open-source, and actively being deployed against organizations of every size.

Security in 2026 demands what the industry is beginning to call Zero Trust Video: a default assumption that any video feed could be synthetic unless cryptographically proven otherwise. We must stop looking at the face and start interrogating the data stream. We must stop treating the request to “jump on a quick call” as a trust signal and start treating it as a potential attack vector.

The $25.6 million Arup loss happened because one employee trusted what they saw and heard on a video call. The Singapore finance director lost half a million dollars for the same reason. The Ferrari executive who asked the one question the AI couldn’t answer got lucky.

Luck is not a security strategy.

Sources: World Economic Forum, Keepnet Labs Deepfake Statistics 2026, Brightside AI Blog, iProov, Gartner, AKATI Sekurity Enterprise Defense Guide, Axis Intelligence, Deloitte Deepfake Disruption Analysis, NSA/NSS C2PA Guidance (January 2025), C2PA.org, Australian Cyber Security Centre Content Credentials Guidance, EU AI Act (August 2025), 404 Media investigative reporting.

CEO Doppelgänger Injection: Defeating "Live" Video Verification