Fake recruiters, cloned executives, forged documents and flawless phishing lures are now produced to order, often with AI, before an adversary ever touches your network. MITRE ATT&CK T1683 Generate Content, added in ATT&CK v20 under Resource Development (TA0042) on the PRE platform, describes adversaries creating written, audio, image and video content to establish personas, impersonate known people or organisations, and support social engineering, fraud or influence activity. The content is made outside your visibility, so the defensive questions are where it reaches you, which pre-attack signals you can watch for, how to get it taken down, and which processes must hold even when the content is convincing. This guide is for threat intelligence, SOC, HR and recruiting, finance and brand protection teams. For defending against the phishing that this content supports, see the AI-Generated Phishing Defence Guide.
Key takeaways
- Content is a resource, like a domain or an account. ATT&CK places it in Resource Development and lists it as feeding phishing (T1566), phishing for information (T1598), social engineering (T1684), financial theft (T1657) and account creation (T1585).
- Personas target hiring and careers. ATT&CK records Contagious Interview building fake LinkedIn and Telegram accounts, and FBI reporting describes North Korean IT workers using AI and face-swapping in video interviews.
- You will not detect the generation. ATT&CK's analytic for T1683 says it happens outside the target's visibility and points detection at later stages such as initial access.
- Verification beats spotting fakes. Arup lost HK$200 million to a video call populated by deepfaked colleagues: process controls such as out-of-band call-backs would have held where visual judgement failed.
- Takedown is a real control. Fake profiles, job sites and cloned brands can be reported and removed, which raises adversary cost and limits reach.
What the technique covers
ATT&CK says the content may be developed in-house, sourced through third parties or produced with AI-assisted tools, before or during an operation. It often follows research done with AI services (T1682 Query Public AI Services). Malicious code and scripts are excluded and belong to T1587 Develop Capabilities. T1683 has two sub-techniques, each with its own entry in ATT&CK:
| Sub-technique | Examples ATT&CK lists | Where it reaches you |
|---|---|---|
| T1683.001 Written Content | Phishing lures, fraudulent financial communications, fabricated job postings and employment documents, decoy documents, persona content and translated or style-matched messages | Mail and collaboration tools, job platforms, supplier and finance workflows |
| T1683.002 Audio-Visual Content | Synthetic voice, real-time altered audio or video, fabricated profile photos and identity documents, video of fabricated or impersonated people | Video interviews and calls, help desk and payment calls, identity verification and onboarding |
Cases: how adversaries have used it
- Fake recruiters (Contagious Interview, G1052): ESET reported operators copying existing people's profiles or building new recruiter personas on LinkedIn, Upwork, Freelancer.com and other job platforms, then sending developers coding tasks in private repositories that infected them when run. Unit 42 and ESET both describe a cloned MiroTalk video-conferencing site serving trojanised installers. ATT&CK v20 records that the group has used AI to clone video-conferencing applications and to create deepfake videos. See the Contagious Interview Threat Actor Profile Guide.
- Fake applicants (North Korean IT workers): the FBI warned in January 2025 (I-012325-PSA) that North Korean IT workers use artificial intelligence and face-swapping technology during video job interviews, and reuse phone numbers and email addresses across resumes claiming to be different applicants. See the Insider Threat from Fake IT Workers Guide (North Korean IT Worker Schemes).
- Personas and photos (APT38, G0082): ATT&CK records the group creating fictitious social media profiles with fake photos and personas, and decoy content resembling legitimate support guidance.
- Career-themed lures (NIMBUS MANTICORE, G1059): ATT&CK records career-themed phishing lures and fictitious job-themed websites.
- Deepfaked industry figures: Google Threat Intelligence Group reported in November 2025 that the North Korean cluster UNC1069 used deepfake images and video lures impersonating people in the cryptocurrency industry to push a fake "Zoom SDK" download. Its February 2026 report described APT42 feeding a target's biography into Gemini to craft a persona and scenario, and a wider trend of rapport-building phishing.
- Deepfaked executives: at Arup in 2024, a finance employee made 15 transfers totalling HK$200 million after a video call in which, police later said, every other participant was fake. See the Arup deepfake fraud analysis.
- Operational documents: ATT&CK lists the Anthropic AI-orchestrated Campaign (C0062), in which Claude Code generated documentation of services, credentials and attack progress, and the AI-Assisted Breach of Mexico's Government Infrastructure (C0064), in which the adversary had Claude Code generate forged tax compliance certificates.
The FBI's December 2024 alert (I-120324-PSA) lists the same patterns in criminal fraud: mass fake social media profiles, realistic profile photos, fake identification documents, cloned voices and real-time video impersonating executives or authorities.
Pre-attack signals and where to watch
ATT&CK's detection strategies (DET0916 for the technique, DET0917 and DET0918 for the sub-techniques) accept that generation is invisible to you. What is visible is the content once it is published or delivered:
| Signal | Source | Owner |
|---|---|---|
| Profiles claiming to work for you, or recruiting in your name, that HR cannot match to a real employee | Professional networks and job boards, staff and candidate reports | Brand protection, HR |
| Job adverts or careers sites using your brand that you did not publish | Brand monitoring, candidate enquiries | Brand protection, recruiting |
| Applicants sharing phone numbers, email addresses or resume text across identities | Applicant tracking system | HR, insider threat |
| Interview anomalies: lip-sync mismatch, refusal to turn on camera, location claims that do not fit | Interview notes, structured interview checklist | Hiring managers |
| Lures that cite real projects, colleagues or partners accurately | Mail gateway, user reports | SOC |
| Payment or bank detail change requests backed by calls, video or documents | Finance workflow, help desk tickets | Finance, help desk |
| Lookalike conferencing, careers or support sites | Certificate transparency and domain monitoring, proxy logs | Threat intelligence, SOC |
Do not build controls on detecting AI-written text or synthetic media by eye. The FBI suggests looking for imperfections in images and video, but synthetic content keeps improving; use those cues as reasons to verify, never as proof of authenticity. See the Deepfake and AI Impersonation Guide.
Controls that hold when content is convincing
ATT&CK's only mitigation is M1056 Pre-compromise, which covers auditing public information, monitoring for lookalike domains, email authentication (SPF, DKIM, DMARC) and training. The controls below are NHI Mgmt Group recommendations built on M1056 and the FBI guidance.
- Out-of-band verification: payment changes, urgent transfers and account recovery requests are confirmed by calling a number already on record, never one supplied in the request, and need a second approver above a threshold.
- Hiring identity proofing: the FBI recommends verifying identity at interview, onboarding and throughout employment, cross-checking contact details against HR records for duplicates, completing as much of hiring and onboarding in person as possible, and auditing staffing firms.
- Safe candidate exercises: developers do not run code from recruiters on corporate devices; coding tests use disposable, isolated environments.
- Published recruiting channels: state on your careers page which domains and platforms you recruit from, and that you never ask candidates to install software or pay fees.
- Email authentication: enforce DMARC at quarantine or reject on your domains so generated lures cannot spoof you directly.
- Takedown readiness: pre-agree evidence standards and reporting routes for fake profiles, job adverts and lookalike sites. See the Brand Impersonation and Lookalike Domain Takedown Playbook.
Where identity fits
Generated personas are an attack on identity proofing. A fake applicant who passes hiring receives a real workforce identity, device and access; a deepfaked executive persuades a real person to approve a payment or a reset. Tie hiring verification to identity provisioning so access is only granted to an identity proven at onboarding, and treat help desk resets as high-risk events that need verification independent of voice or video. The same principle applies to machine requests: an AI agent or integration should act on authenticated, scoped requests, not on content that merely appears to come from an executive. See the Deepfake-Resistant Identity Verification Guide.
How to put it in place
- Map exposure points: list the processes where content alone can trigger action: payments, supplier changes, account recovery, hiring and onboarding, executive requests.
- Add a verification step to each: call-back to a number on record, second approver, or in-person or proofed identity check. Pilot in one region or business unit first.
- Set up monitoring: brand and executive impersonation monitoring on professional networks and job boards, lookalike domain monitoring and an applicant duplicate check.
- Prepare takedown: document evidence to capture (URLs, screenshots, profile identifiers, timestamps) and the reporting route for each platform and registrar.
- Test it: run an authorised exercise with a simulated executive voice or video request and a simulated fake candidate, with leadership approval and consent rules, and measure whether verification steps held.
- Tune and roll back: if a verification step causes unacceptable delay, adjust thresholds rather than removing it, and record exceptions.
Decision guidance
- Detection tools or process controls: synthetic media detection tools can add signal in high-volume onboarding, but process controls are cheaper and keep working as generation improves. Start with process, add tooling where volume justifies it.
- Remote or in-person hiring: fully remote hiring needs stronger identity proofing and device checks; where a role grants privileged or source code access, an in-person step is worth the cost.
- Small organisations: focus on call-back verification for payments and resets, a published recruiting statement and DMARC.
- Large organisations: add continuous brand and executive monitoring, a takedown function, duplicate detection in the applicant tracking system and regular exercises.
Measurement
- Takedown time: median hours from discovering a fake profile, job advert or lookalike site to removal.
- Verification adherence: share of payment changes and resets completed with out-of-band verification.
- Exercise pass rate: share of simulated voice, video or persona approaches stopped by process.
- Applicant duplicates: number of applicants flagged for shared contact details or resume content, and outcomes.
- Impersonation reports: staff and candidate reports of fake recruiters or executives, tracked over time.
Common failure patterns
- Trusting the face on screen: treating a video call as identity verification, as at Arup, where every other participant was fake.
- Hiring without proofing: remote hiring and onboarding with no identity check after the first interview, the gap the FBI highlights for IT worker schemes.
- Developers running recruiter code: coding tests executed on corporate laptops with access to source code, tokens and wallets.
- No takedown owner: fake profiles and job sites reported by staff but never escalated, so they keep recruiting victims in your name.
- Awareness slides instead of controls: training staff to spot AI content while payment and reset processes still act on a convincing request.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1683, T1683.001, T1683.002, TA0042; related T1682, T1585, T1566, T1598, T1684, T1657; mitigation M1056; detection strategies DET0916, DET0917, DET0918 | Technique definition, cases and ATT&CK's guidance |
| MITRE ATLAS | AML.T0073 Impersonation | AI-specific view of impersonation |
| NIST CSF 2.0 | ID.RA-02, ID.RA-03 | Using threat reporting and recording the threat |
| NIST SP 800-53 Rev 5 | IA-12 Identity Proofing, PS-3 Personnel Screening, AT-2(3) Social Engineering and Mining, PM-12 Insider Threat Program | Proofing new hires, screening, training and insider risk |
For the AI-specific technique, see AML.T0073 Impersonation.
Practitioner checklist
- List every process where a message, call or video alone can trigger a payment, reset, access grant or hire.
- Require out-of-band call-back to a number on record and a second approver for high-value or unusual requests.
- Verify candidate identity at interview, onboarding and during employment, and check applicants for shared contact details.
- Run candidate coding tests only in isolated, disposable environments.
- Publish your legitimate recruiting channels and what you will never ask candidates to do.
- Monitor professional networks, job boards and new domains for impersonation of your brand and executives.
- Document takedown evidence and reporting routes, and assign an owner.
- Exercise verification with authorised simulated voice, video and persona approaches at least yearly.
Standards and references
- MITRE ATT&CK: T1683 Generate Content
- MITRE ATT&CK: M1056 Pre-compromise
- FBI IC3: North Korean IT Workers Conducting Data Extortion (I-012325-PSA)
- FBI IC3: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (I-120324-PSA)
- ESET Research: DeceptiveDevelopment targets freelance developers
- Palo Alto Networks Unit 42: North Korean threat actors lure tech job seekers as fake recruiters
- Google Threat Intelligence Group: AI Threat Tracker, advances in threat actor usage of AI tools
- Google Threat Intelligence Group: AI Threat Tracker, distillation, experimentation and integration of AI for adversarial use
Related NHI Mgmt Group resources: AI-Generated Phishing Defence Guide, MITRE ATT&CK T1585 Establish Accounts, MITRE ATT&CK T1682 Query Public AI Services, MITRE ATT&CK T1684 Social Engineering, MITRE ATT&CK T1598 Phishing for Information, Executive Deepfake and CEO Fraud Guide, Disinformation and Brand Impersonation Guide.