Conference Call Phishing Simulation
Your people were trained to distrust the email. Nobody trained them to distrust the meeting.
We run live social engineering simulations on Microsoft Teams, Zoom, and Google Meet. A meeting invite arrives, someone joins, and the person on camera is synthetic: generated video, cloned voice, responding in real time. You find out whether the request gets verified or gets actioned. Fully managed and external, with no integrations, no tenant admin consent, and nothing installed.
Built for security, GRC, fraud, and finance teams.
Why the invite works when the email does not
Years of phishing training taught people to hesitate over links. It taught them nothing about a face on a screen.
The calendar carries the trust
A meeting invite does not ask to be clicked. It asks to be attended. It lands inside the workflow people already accept dozens of times a week, from a colleague, a client, or a partner, with a subject line that matches something genuinely in flight.
Seeing and hearing is the verification
On a call, identity feels confirmed the moment the camera turns on. That instinct is the whole attack. A face that responds and a voice that sounds right replace the step where someone would have picked up the phone to check.
Your controls do not attend meetings
Mail gateways inspect headers, links, and attachments. None of them are present for the twenty minutes where a request is made, pressure is applied, and an approval is given verbally.
Nothing to install, nothing to approve, nothing to maintain
Most simulation platforms need to live inside your environment before they can run. This one never enters it.
Six surfaces, one meeting
Run the full set for a complete picture, or scope down to the platform and pretext your organization actually lives in.
Invites and chat lures that follow the shape of your internal Teams traffic, including external and guest access join paths. The pretext arrives where people already coordinate work, so nobody stops to reread it.
Scheduled and ad hoc Zoom sessions, waiting rooms, and reused meeting links, run the way vendors and clients actually send them. Covers the rescheduled call, the forwarded link, and the urgent bridge that appears an hour before.
Calendar-first lures built for Workspace organizations, where the invite lands on the schedule before anyone reads a word of it. Includes the auto-accept behaviour that puts an attacker on the calendar without a single reply.
A synthetic executive or colleague on camera, generated from authorized likeness and driven live. It answers questions, reacts to interruptions, and stays in the conversation. A recording cannot be asked to repeat itself. This can.
Camera off, voice only, which is how most calls actually run. A cloned voiceprint built from publicly available audio joins the bridge or calls directly, and tests whether anyone asks for a second factor before acting on what they heard.
The link dropped in chat mid-call, the file shared on screen, the credential prompt that appears while everyone is watching, and the message that arrives afterwards referencing the meeting by name. The call builds the trust. The follow-up spends it.
How the simulation runs
Conference call phishing is run as an OSES™ engagement, our orchestrated social engineering simulation framework. Same spine as everything else we run: measure risk, train for what you find, prove it changed, on one dataset.
Every engagement runs under signed authorization, with likeness consent documented before any media is generated and all generated media destroyed at the end. No payment is ever moved and no real credential is ever used. For testing the verification systems themselves rather than the people using them, see deepfake penetration testing.
The seats an attacker books a meeting with
Anyone who can move money, grant access, or change a record, and who does it over a call because that is faster.
What makes this different
It runs from outside, like the attack
No allowlist, no admin consent, no privileged position in your tenant. The simulation has to get through the same controls a real attacker faces, which is the only way the result means anything.
Live and interactive, not a recording
The synthetic participant responds in real time and holds a conversation under pressure. Playback tests attention. Interaction tests judgement, and judgement is what fails on these calls.
Reported as an organization
Findings cover where verification was attempted, where it was skipped, and which process allowed the request through. No named individuals and no department leaderboards, so people report what happened instead of hiding it.
Real threats, real testing, real findings
A cloned voiceprint submitted against verbal verification controls, and what it revealed about the step-up path behind them.
Read the case study Agentic AIAutonomous agents driving synthetic media generation and delivery end to end, with no human operator in the loop.
Read the case studyCommon questions
What is conference call phishing?
A social engineering attack that moves the pretext out of the inbox and onto a video or voice call. The target receives a meeting invite that looks routine, joins, and finds someone they recognize on camera making a request. Because the face and voice appear to confirm identity, the usual verification step never happens.
Which platforms do you simulate?
Microsoft Teams, Zoom, and Google Meet, including guest and external join paths, dial-in bridges, and the follow-up messages that arrive after a call ends. If your organization standardizes on one platform, we run the simulation entirely on that one.
Do you need access to our Teams, Zoom, or Google Workspace tenant?
No. There is no app registration, no admin consent, no connector, and no agent on any endpoint. The simulation runs externally on the same paths an attacker would use, which is what makes the result a measurement rather than a rehearsal.
Is there really a deepfake on the call?
Yes. A synthetic participant joins the meeting with generated video and a cloned voice, responds in real time, and holds the conversation. It is not a recording played back, because a recording cannot be asked a question.
Whose likeness gets used?
Only likenesses your organization authorizes in writing during scoping, typically an executive or internal role that a real attacker would impersonate. Consent is documented before any media is generated, and all generated media is destroyed at the end of the engagement.
What happens to someone who joins and gets caught?
They get a short debrief and training on what the call was and what to look for next time. Reporting is organizational: no named individuals and no department leaderboards. The point is to fix the process that let the request through, not to single anyone out.
Is this authorized, and how is scope controlled?
Every engagement runs under signed authorization within an agreed scope, window, and set of roles, with named approvers and documented abort conditions. No real payment is ever moved and no real credential is ever used. The simulation stops at the point where the action would be taken.
What do we receive at the end?
A report covering which lures got people into the meeting, what happened once they joined, where verification was attempted and where it was skipped, how the request was escalated or approved, and the process changes worth making. Training is assigned from the findings.
How long does an engagement take?
Two to three weeks from scoping call to final report, with the live call window itself usually a few days inside that.
Find out who stays on the call
Thirty minutes. We will walk through how your teams meet, approve, and verify, and pick the first pretext worth running.
Or see the full deepfake simulation range.
support@breacher.ai
