Deepfake Phishing Simulation Software: How to Train Teams

‍

How attackers use deepfakes in phishing today

Attackers combine voice cloning and avatar video with multi-channel pretexting to impersonate trusted people. They scrape org intel (LinkedIn, email signatures), spoof caller ID or domains, lure targets into a fake Teams/Meet/Zoom page, then push urgent actions - credential capture or wire/vendor fraud.

Encoder-decoder architecture

The process starts with the encoder, which is a neural network that compresses the input data (e.g., a face image) into a smaller, more manageable representation known as a latent space.

This compressed representation contains the most critical features of the face, such as its shape, structure, and texture, without the original high-dimensional details.

The latent space is a lower-dimensional representation of the input data, capturing essential features like facial expressions, angles, and lighting in a compressed form.

This space is crucial because it allows the model to efficiently manipulate and transform these features to generate new outputs.

After encoding, the decoder takes the latent space representation and reconstructs it into a full image.

For deepfakes, the decoder is trained to take the latent representation of one face and generate the face of another person, often swapping features between the two.

Generative adversarial networks (GANs)

Deepfake technology primarily relies on artificial intelligence.

More specifically, a type of deep learning called Generative Adversarial Networks (GANs).

GANs consist of two neural networks:

• Generator: This network generates fake data (such as images or video frames) that resembles real data. Its goal is to create content so realistic that the Discriminator cannot tell it apart from actual data.
• Discriminator: This network evaluates the data and tries to distinguish between real and fake content. It essentially acts as a critic, judging whether the content produced by the Generator is authentic or fake.

During training, the Generator and Discriminator are essentially pitted against each other.

The Generator attempts to create more convincing fakes...

And the Discriminator gets better at detecting them.

Over time, this adversarial process improves the quality of the generated content, resulting in highly realistic deepfakes.

The generator becomes increasingly adept at producing highly realistic images or videos that the discriminator struggles to distinguish from real content.

The AI is trained using datasets

The GAN is trained on vast datasets of real images, audio, or video, depending on the type of deepfake being created.

If you wanted to create a deepfake video of a person, for example, the GAN would be trained on thousands of images or videos of that person's face, capturing various angles, expressions, and lighting conditions.

The quality of a deepfake will generally depend on the amount and quality of the training data.

The more diverse and comprehensive that datasets are, the more convincing the deepfake will be.

As the GAN trains, it iterates on the deepfakes being produced over and over.

This process will go on until the Generator produces content that is virtually indistinguishable from real content.

And these datasets are then used to generate deepfakes

Once the GAN is trained, it can generate deepfake content.

In a deepfake video, the trained Generator can manipulate a video by altering the subject’s facial expressions, syncing their lips to different audio, or even replacing their face entirely with someone else's.

The result is a video that looks authentic but has been artificially created or manipulated.

GANs is typically used in a couple of different ways:

• Face swapping: The Generator replaces the face of a person in a video with the face of another person, maintaining natural expressions and movements.
• Voice cloning: GANs can also be used to create deepfake audio by cloning a person’s voice. The model is trained on recordings of the person speaking, learning to mimic their tone, pitch, and speech patterns.

What signals they exploit (why people fall for it)

• Authority + urgency from a familiar voice (“I’m boarding - do this now”).
• Familiar communication channels (Microsoft Teams, Google Meet, Zoom) that lower suspicion.
• Caller ID & domain trust - still widely believed in 2025.
• Remote/hybrid workflows where quick approvals happen off-email trails.

Deepfake statistics

• 70% of people say they aren’t confident that they can tell the difference between a real and cloned voice
• 53% of people share their voices online or via recorded notes at least once a week
• Searches for “free voice cloning software” rose 120% over the past year
• Three seconds of audio is sometimes all that’s needed to produce an 85% voice match.
• CEO fraud targets at least 400 companies per day.

What this means for defenses & training

• Train reflexes and 'the pause' over pixel-peeping (assume visuals can look perfect).
• Rehearse multi-channel scenarios inside your security awareness program (email → meeting → request).
• Measure what matters in deepfake phishing simulations: reporting rate (from inbox), drop-off before action, and final fail rate - and use behavior-based nudges for users who exhibit risky behavior.

‍

What to teach employees about deepfake phishing

Coach employees to verify the premise, not the pixels. Teach them to pause on urgent, out-of-process requests over familiar communication channels, distrust caller ID, exit dubious calls, and report suspicious interactions.

1) Teach the reflexes (deepfakes can get around typical red flags)

• Warning signs: authority + urgency, out-of-process asks (payments, credential verification), unusual channel for the task.
• Coach the reflex: ask “Why me, why now, why this channel?” then verify out-of-band.
• Rationale: quality is rising; glitch-spotting is unreliable - prioritize the request context.

2) Teach voice/call protocols (AI-generated voice phishing)

• Treat caller ID as untrusted; spoofing internal names/extensions still works in 2025.
• Verification playbook: hang up, call back via the directory, or message on Slack/Teams; agree passphrases for frequent contacts.

3) Teach meeting/link hygiene (fake meeting rooms)

• Pattern to expect: email lure → browser-based Teams/Meet/Zoom clone with mic/camera prompts to feel “live.”
• Golden rule: chat link = payload (SharePoint/SSO look-alikes can redirect). Exiting before clicking is success.

4) Teach the reporting flow (maps to KPIs)

• Report from inbox: in Hoxhunt, users can report via the Hoxhunt button on the original email - it still counts as success even if they already joined the call (↑ reporting rate).
• Safe exits: leaving the fake call without clicking is a good outcome (↑ drop-off before action).
• Avoid the click: do not open the chat link (↓ final fail rate).

5) Teach process boundaries for high-risk workflows

• Finance & vendor fraud: never approve urgent wire/bank-change on a live call - re-route to documented process.
• IT support scams: no credentials over voice; use official reset flows.
• Executive impersonation: unexpected “deepfake CEO messages” get verified out-of-band.

‍

Why deepfake phishing needs specialized simulation tools

Most phishing simulation tools teach link-spotting in email. Deepfake attacks weaponize artificial intelligence across channels - email lure → fake Teams/Meet/Zoom → urgent request from a cloned voice/avatar. To build strong cybersecurity habits, programs must rehearse these realistic scenarios, measure behavior (report, drop-off, fail), and refresh training content beyond generic templates.

What basic programs miss

• Email-only focus. Real attackers chain channels; simulations must mirror multi-vector realism (inbox → meeting clone → chat link).
• Pixel-peeping bias. As quality rises, “spot the glitch” fails - teach premise checks under pressure instead.
• Training plateaus. Stale, generic templates and long-form training modules stall engagement and learning. Rotate a library of phishing templates and keep lessons micro.

‍

Deepfake phishing simulation software FAQ

Does this integrate with Outlook/Office 365?

Yes - Hoxhunt’s single phish alert button works across Outlook (Office 365) and Gmail, reducing confusion from “too many buttons” and supporting a simple admin experience. Use it to capture reports from simulated phishing emails and real threats.

How “deep” is the simulation (email-only vs multi-channel)?

For real phishing simulation depth, Hoxhunt pairs a realistic email lure with an attacker-controlled fake meeting (Teams/Meet/Zoom): camera/mic prompts + believable phishing domains/phishing websites, ending in a “chat-link” payload. That’s multi-vector realism - not just basic phishing scenarios.

What KPIs and dashboards should we expect?

Go beyond phishing click rates. Track behavior signals - reporting rate, drop-off before action, final fail rate - and present ready risk visuals in executive dashboards for complex stakeholder reporting (security leadership, compliance teams, board). Tie outcomes to Human Risk Management and business risk metrics.

Can we run templates and deepfakes side-by-side?

Yes. Rotate a library of phishing templates (email-based threats) alongside deepfake phishing attacks to represent the broader threat posture. Keep lessons micro (avoid default training bloat) to prevent training plateaus and speed ramp time to measurable improvement.

How is this “realistic but safe” for employees?

Scenarios are pre-scripted, short, and end in micro-training - no shaming. Users can report from the original email (counts as success) or leave the call without clicking (good outcome). That builds strong cybersecurity habits in security awareness training.

What about forensic reporting on the payload?

The safe fail is the chat-link (often a SharePoint/SSO look-alike). You get clean, comparable endpoints for forensic reporting and trendlines across phishing campaigns (who clicked, who exited, who reported).

We’re considering Proofpoint Phishing Simulations / OSS (Phishing Frenzy). Pros/cons?

Email-first suites (Proofpoint Phishing Simulations) and OSS (Phishing Frenzy + voice phishing simulator) can cover training content and a library of phishing templates. For realism & attack depth (email ➝ fake meeting) and org-specific deepfakes, validate multi-channel support and consent workflows, or consider Hoxhunt’s integrated approach.

How do we map analytics to user training?

Use reporting and analytics to trigger micro-training for risky user behavior (fails, hesitant drop-offs). This drives risk scoring, targeted user training, and improvement over time.

Any tips for social-engineering verification (voice phishing)?

Security Teams should teach employees to distrust caller ID, drop the call, and direct message the person on Slack/Teams - or call back via the directory. Passphrases for frequent contacts help reduce voice phishing impact.

_Sources

^{Contextualizing Deepfake Threats to Organizations - NSA, FBI & CISA
Threat actors misusing Quick Assist in social engineering attacks leading to ransomware - Microsoft Threat Intelligence
Business Email Compromise: The $55 Billion Scam - FBI IC3
Arup lost $25mn in Hong Kong deepfake video conference scam - Financial Times
Number spoofing scams - Ofcom
Guide for Preparing and Responding to Deepfake Events - OWASP GenAI Security Project}