Deepfake Video Call Leads to Cryptocurrency Analyst's Account Compromise
Cryptocurrency analyst Mai Fujimoto's social media and financial accounts were compromised after she participated in a Zoom video call with someone using deepfake technology to impersonate an acquaintance. The attacker used the fabricated video call to trick her into installing malware that led to unauthorized access of her X, Telegram, and MetaMask accounts.
What happened
Cryptocurrency analyst Mai Fujimoto received a video call invitation through Zoom from someone using a compromised friend's Telegram account. During the 10-minute call, she saw what appeared to be her acquaintance's face via deepfake technology, but experienced audio issues.
The impersonator provided a link claiming to resolve the audio problem and gave step-by-step instructions to adjust settings. Fujimoto believes malware was installed during this process, which led to compromise of her X account (@missbitcoin_mai) on June 14.
Reported impact
Fujimoto lost control of her main X account. The attackers also gained access to her Telegram and MetaMask accounts.
Fujimoto expressed concern that her likeness could be used in future deepfake attacks against her contacts. Binance founder Changpeng Zhao warned that video call verification is no longer reliable and cautioned users against installing software from unofficial sources.
Index analysis
The attack exploited a trusted relationship by compromising the friend's Telegram account and using deepfake technology to create a convincing facial impersonation. The sophistication of the deepfake was sufficient to convince the victim she was communicating with a known acquaintance throughout the call.
The attacker combined deepfake video with social engineering tactics, providing technical justifications for audio failures and step-by-step instructions to encourage malware installation.
Governance controls
Changpeng Zhao emphasized that users should not install software from unofficial sources even if requests come from friends, as accounts may be compromised. He highlighted how cybercriminals exploit trusted relationships to distribute malware.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.