A water-utility awareness module highlights callers who sound like internal IT and ask employees to read back VPN one-time codes. Which deepfake application does this primarily represent?
Select an answer to reveal the explanation.
Short Explanation
If the voice on the line is 'IT' and wants your VPN code out loud, treat it like handing your house key through the mail slot. Cloned speech is the deepfake piece; the goal is credential theft. Codes stay off the phone.
Full Explanation
A water-utility awareness module highlighting callers who sound like internal IT and ask employees to read back VPN one-time codes primarily represents audio deepfake social engineering aimed at harvesting credentials or second factors. The deepfake application is cloned or synthetic speech used to create trust on a voice channel; the operational goal is stealing secrets that defeat MFA or remote access controls. Civic OT-adjacent and enterprise users must treat voice requests for codes as hostile until proven otherwise through known-good IT channels.
Video deepfake livestreams used to spoof badge readers at plant gates are a different physical-access and video modality scenario not described by phone callers asking for VPN codes. Image morphing of SCADA HMI screenshots for phishing PDFs is an image/document lure path, not live voice credential harvesting. Packing of on-disk malware samples to evade signature scans is a malware evasion technique unrelated to IT-impersonation calls.
Exam caveat: map the deepfake application to the attacker objective in the stem—here, audio SE for OTP/credential theft—not to unrelated video, image, or packing distractors.
Operational check for water utilities: never read VPN or MFA codes aloud to callers; verify IT requests on published numbers; report suspected voice clones; keep awareness modules focused on refuse-and-verify behavior; and ensure helpdesk procedures never request codes from users over unauthenticated phone channels.