AI-generated voice used in Gmail phishing scam targeting millions
A Microsoft security consultant reported receiving AI-generated voice calls impersonating Google support staff attempting to trick Gmail users into confirming account recovery actions. The scam reportedly targets billions of Gmail users and uses voice cloning and email spoofing to increase credibility.
What happened
Sam Mitrovic, a Microsoft security consultant, received an email requesting Gmail account recovery and later received phone calls from a number appearing to be from Google Sydney. The caller, speaking with an American accent and claiming to be a Google Support representative, reported that suspicious activity had been detected on Mitrovic's account with someone allegedly from Germany logging in over seven days and downloading account data.
Mitrovic checked the phone number and found it led to a legitimate Google business page, which initially appeared to validate the call's authenticity. However, when Mitrovic requested an email confirmation, the message contained a non-Google domain address cleverly disguised in the recipient field. When the caller repeated 'hello' twice with artificially perfect pronunciation and spacing, Mitrovic recognized it as AI-generated speech and disconnected.
Reported impact
The scam reportedly targets approximately 2.5 billion Gmail users globally. Mitrovic warned that most people lack the technical knowledge to identify such sophisticated phishing attempts and could be deceived into confirming account recovery actions or providing credentials.
Index analysis
The attack combines multiple social engineering techniques: phishing via email, spoofed caller ID showing a legitimate Google number, voice cloning to impersonate support staff, and carefully crafted follow-up emails with subtle domain spoofing. The use of generative AI significantly increases success likelihood compared to standard phishing methods.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.