Generative AI has made it cheap to sound, look and write like someone your staff already trust, and to publish AI components under a name your engineers already trust. MITRE ATLAS tracks this as AML.T0073 Impersonation, in the Defense Evasion tactic (AML.TA0007). ATLAS describes adversaries impersonating a trusted person or organisation, such as an executive, colleague or third-party vendor, to persuade a target to act on their behalf, and adds that adversaries may target resources in the AI DevOps lifecycle such as model repositories, container registries and software registries. The general technique is ATT&CK Social Engineering: Impersonation (T1684.001); this page covers only the AI-specific angle: AI-generated voice, video and text, and impersonation of publishers in AI supply chains. It is for security, fraud and platform engineering teams. Broader deepfake defence is in the Deepfake and AI Impersonation Guide.
Key takeaways
- Two arenas, one technique. ATLAS case studies (including AML.CS0074, added in 2026.10, where an evaluation agent falsely claimed maintainer approval) cover both people (deepfake calls, AI-written email, KYC fraud) and publishers (a fake Hugging Face organisation, a namesquatted MCP package).
- The ATT&CK mirror has moved. ATLAS still references T1656, which is revoked in ATT&CK v20; the current technique is T1684.001 Social Engineering: Impersonation, in the Stealth tactic.
- Recognition is not verification. A familiar face, voice or organisation name is exactly what the attacker generated; verification has to use a channel or credential the attacker does not control.
- Namespaces are identity. An unregistered organisation or package name on a public AI registry is an impersonation opportunity; reserve yours.
- ATLAS maps one mitigation. AML.M0042 Threat Intelligence Program (ATLAS 2026.10): collect and share intelligence on impersonation campaigns, personas, lures and infrastructure. Other useful catalogue entries are AML.M0018 User Training, AML.M0034 Deepfake Detection and AML.M0014 Verify AI Artifacts, plus process controls.
Where it sits
ATLAS created AML.T0073 on 14 April 2025, last modified it on 28 October 2026 and rates it Realized. Its placement under Defense Evasion reflects the purpose: trust in the impersonated party gets the attacker past checks that would stop an unknown sender. It usually arrives through AML.T0052 Phishing or its sub-technique AML.T0052.000 Spearphishing via Social Engineering LLM, and uses content from AML.T0088 Generate Deepfakes.
| Reference | ID and name | Note |
|---|---|---|
| MITRE ATLAS | AML.T0073 Impersonation (AML.TA0007 Defense Evasion) | AI-enabled and AI supply chain impersonation |
| MITRE ATT&CK v20 | T1684.001 Social Engineering: Impersonation (Stealth) | Current general technique |
| MITRE ATT&CK v20 | T1656 Impersonation | Revoked; the ATLAS record still points to it |
| MITRE ATT&CK v20 | T1566 Phishing, T1598 Phishing for Information, T1534 Internal Spearphishing | Delivery channels named in the ATT&CK description |
For the general email side (display name and SMTP mismatches, SendAs grants, auto-forward rules), use the ATT&CK detection strategy for T1684.001 rather than repeating it here.
Cases in ATLAS and on NHIMG
| Case | Who was impersonated | AI element |
|---|---|---|
| AML.CS0027 Organization Confusion on Hugging Face | Well-known companies without an official Hugging Face presence | Fake model hub organisations; employees asked to join them |
| AML.CS0053 Poisoned Postmark MCP Server Email Exfiltration | Postmark, the email service | A namesquatted MCP server package used by AI agents |
| AML.CS0044 LAMEHUG | A government ministry representative | Phishing email delivering malware that used an LLM to generate commands |
| AML.CS0033 and AML.CS0034 (ProKYC) | The account holder in identity verification | Deepfake images and video used to pass KYC checks |
Model hub organisation confusion
In the research behind AML.CS0027, the author registered Hugging Face organisations named after well-known brands that had no official presence there. Engineers from those companies repeatedly requested to join, which gave the author admin rights over organisations the employees believed were official, including visibility of and write access to models they uploaded. Nothing was hacked: the name did the work.
Namesquatted MCP server
Postmark states that the npm package postmark-mcp was not theirs: the publisher released 15 working versions to build trust, then added a backdoor in version 1.0.16 that copied outgoing email to an external server by BCC. Postmark notes it had not published its MCP server to npm before the incident; its official MCP server lives on GitHub. See postmark-mcp Malicious MCP Server 2025 for the full incident and the MITRE ATLAS AML.T0109 AI Supply Chain Rug Pull page for the trust-then-turn pattern.
AI-generated voice and video
In Arup Deepfake Fraud 2024, a finance worker who first suspected phishing was reassured by a video call on which, police said, every other participant was a deepfake; he made 15 transfers totalling HK$200 million. In May 2025 the FBI warned (PSA I-051525-PSA) of an ongoing campaign since April 2025 using text messages and AI-generated voice messages that impersonated senior US officials to build rapport and then steal account access.
What changes when the impersonation is AI-generated
| Old cue staff were taught | Why it fails now | Control that still works |
|---|---|---|
| Poor spelling and odd phrasing | LLMs write fluent, on-brand text in any language | Sender authentication (DMARC enforcement) and out-of-band verification |
| "I know that voice" | Voice can be cloned from public recordings | Call-back to a number from the directory, never from the request |
| Seeing the person on video | Real-time face and voice synthesis on calls | Second approver and payment system controls independent of the call |
| "It is the official organisation page" | Anyone can register an unused organisation or package name | Verified organisations, reserved namespaces, allowlisted publishers |
| Selfie and document checks | Injected deepfake media (AML.CS0033, AML.CS0034) | Liveness with injection detection; see the Deepfake-Resistant Identity Verification Guide |
Controls
People and payments
- Verification by a channel the attacker cannot supply. For payments, credential resets and access grants, call back on a number from the directory or confirm in an authenticated system. The FBI advice to verify by independently finding a known number matches this.
- Two-person approval for new payees and bank detail changes. A deepfake of one person rarely defeats a second, independently contacted approver.
- Shared verification phrases for high-risk roles. The FBI suggests agreed secret words for families; executive assistants and finance teams can use the same idea.
- Training on current cues (AML.M0018). ATLAS includes educating users on identifying deepfakes and phishing. Teach urgency, secrecy and channel changes as the signals, not media quality. See the AI-Generated Phishing Defence Guide.
- Deepfake detection where media is the control (AML.M0034). ATLAS recommends applying deepfake detection to untrusted or user-provided data, especially in biometric verification. Treat detection as one signal, not the decision.
AI supply chain namespaces
- Reserve your names. Register your organisation on the model hubs and package registries your engineers use, even if you publish nothing, and verify the domain. On Hugging Face, a verified organisation email domain and SSO (Team and Enterprise plans) tie membership to your identity provider.
- Allowlist publishers, not names. Approve models, datasets and MCP servers by verified publisher and source repository. Install MCP servers from the publisher's official source; see the MCP Server Security Checklist.
- Verify artefacts (AML.M0014). Check checksums or signatures and pin versions so a later malicious release is not picked up automatically.
- Govern membership. Tell staff which organisations are official and review join requests and member roles regularly. See the Hugging Face Security Guide.
- Monitor for lookalikes. Watch registries for new organisations and packages using your brand, and report them to the platform.
Agents can be targets too: an AI agent that reads email or tickets may act on a message that claims to come from an executive. Give agents the same rule as people: act on verified identity and authorised workflows, not on what a message says about its sender.
Detection and measurement
- Payment and access workflows: requests to change bank details, add payees or reset credentials that arrive by chat, voice or personal email, or that bypass the normal system.
- Communication channel switches: a "senior" contact moving the conversation to a new messaging platform, a pattern the FBI PSA describes.
- Registry and dependency inventory: MCP servers, models and packages installed from a publisher that is not on the allowlist, or whose publisher differs from the vendor's official repository.
- Brand monitoring: new model hub organisations, packages or domains using your name.
- Identity verification telemetry: injection-detection and liveness failures by device and session.
| Metric | Target |
|---|---|
| High-value payment changes verified out of band | 100% |
| Public AI registries where your organisation name is reserved and verified | All registries in use |
| Installed MCP servers and models from allowlisted publishers | 100%, with exceptions logged |
| Staff in finance and help desk roles trained on AI impersonation this year | 100% |
| Time to takedown request for a lookalike organisation or package | Within five business days |
How to test
- Run an authorised exercise in which a "senior executive" asks finance for an urgent change by an unusual channel, and measure whether the call-back step happens. Use consenting participants and agree the scope in advance.
- Search each model hub and package registry for your organisation name and product names; record what is official and what is not.
- Pick five MCP servers or models in use and trace each to its official source repository and publisher.
- For identity verification, ask your provider for injection-attack test results and repeat them on each release.
Common failure patterns
- Training that relies on spotting bad grammar or poor video. Generated content no longer has those flaws.
- Verification by replying to the request. Calling the number in the message or replying in the same thread verifies the attacker.
- Unreserved organisation names. As AML.CS0027 shows, the first person to register your name on a model hub becomes "you".
- Installing by name from a public registry. postmark-mcp was installed because the name matched a trusted vendor.
- Agents trusting sender claims. An agent that follows instructions because the email says it comes from the CEO is impersonation-ready.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATLAS | AML.T0073, AML.TA0007; mapped AML.M0042; also AML.M0018, AML.M0034, AML.M0014 | Technique, mapped and relevant mitigations |
| MITRE ATT&CK v20 | T1684.001 Social Engineering: Impersonation; mitigations M1017 User Training, M1019 Threat Intelligence Program | General technique this mirrors |
| NIST SP 800-53 Rev. 5 | AT-2(3) Social Engineering and Mining, SR-3 Supply Chain Controls and Processes, SR-11 Component Authenticity, PM-16 Threat Awareness Program | Training, supply chain and authenticity controls |
Practitioner checklist
- Require out-of-band verification for payment, credential and access changes.
- Require a second approver for new payees and bank detail changes.
- Update awareness training to AI-generated voice, video and text.
- Reserve and verify your organisation on every model hub and registry in use.
- Allowlist model, dataset and MCP server publishers by verified source.
- Pin versions and verify checksums or signatures of AI artefacts.
- Monitor registries and domains for lookalikes of your brand.
- Configure agents to ignore sender claims and act only through authorised workflows.
Standards and references
- MITRE ATLAS: Impersonation (AML.T0073)
- MITRE ATT&CK: Social Engineering: Impersonation (T1684.001)
- MITRE ATLAS: Organization Confusion on Hugging Face (AML.CS0027)
- MITRE ATLAS: Poisoned Postmark MCP Server Email Exfiltration (AML.CS0053)
- FBI IC3: Public Service Announcement I-051525-PSA
- Postmark: Information regarding malicious postmark-mcp package
- Hugging Face Hub documentation: Organization security
- 5stars217: Red teaming with ML models
Related NHI Mgmt Group resources: MITRE ATLAS AML.T0074 Masquerading, Deepfake and AI Impersonation Guide, Executive Deepfake and CEO Fraud Guide, MITRE ATLAS AML.T0111 AI Supply Chain Reputation Inflation, Malicious Package and Dependency Confusion Guide, MITRE ATLAS Guide.