The Meridian Ridge Wire Request
A finance-department employee at Meridian Ridge Logistics received an email that appeared to come from the company's CFO, requesting an urgent update to wire-transfer instructions for an active vendor contract. The email was grammatically flawless, referenced real contract details, and even mimicked the CFO's usual sign-off. Investigators later determined the attacker never had direct access to the CFO's account at all.
| Field | Value | Reviewer Status |
|---|---|---|
| Display Name | "Marcus Whitfield, CFO" | |
| From Address | m.whitfield@meridian-ridgelogistics.net (real domain is meridianridgelogistics.com) | |
| Reply-To | mwhitfield.cfo@proton-secure-mail.com | |
| Subject Line | "RE: Vendor Contract #4471 — Urgent Wire Update" | |
| Body Reference | Cites the real vendor name and an approximate dollar figure matching an active contract | |
| Sign-off Style | "Best, MW" — matches the CFO's known email habits | |
| Attachment | Wire_Instructions_Updated.pdf.exe |
Building the Profile
Before the phishing email was ever sent, investigators found that the attacker had spent roughly three weeks gathering publicly available information about Meridian Ridge Logistics — reportedly using a generative AI research assistant to collect and summarize scattered details into a single usable profile.
| Source | Information Gathered | Risk Level |
|---|---|---|
| Company LinkedIn page | Org chart, employee titles, CFO's name and headshot | |
| Q3 earnings press release | Vendor Contract #4471 named publicly with an approximate dollar figure | |
| Employee personal social account | CFO's vacation dates, revealing an out-of-office window | |
| Company careers page | Internal email naming convention pattern (first initial + last name) | |
| Misconfigured public GitHub repo | Internal server naming conventions committed by accident |
The Viral Confession Clip
A local news outlet received a 90-second video clip appearing to show a well-known regional business leader admitting to fraud. The clip was spreading rapidly on social media before anyone could verify whether it was real.
| Indicator | Description | Assessment |
|---|---|---|
| Blinking pattern | Subject blinks unnaturally infrequently across the full clip | |
| Audio-lip sync | Slight mismatch appears during rapid speech segments | |
| Lighting consistency | Shadow direction shifts inconsistently with the single stated light source | |
| Background audio | No ambient room tone; audio is unusually "clean" throughout | |
| File metadata | Embedded metadata field shows export from an AI video-generation tool | |
| Source account | Posted by an anonymous account created the same day as the video |
Class Activity: The CEO's Voice
Following the phishing and deepfake incidents, Meridian Ridge Logistics' HR director received a phone call that sounded exactly like the company's CEO. The voice was later confirmed to be an AI-generated clone built from audio pulled from the CEO's publicly posted keynote speeches on the company's YouTube channel.
| Time | Speaker | Statement | Flag |
|---|---|---|---|
| 2:14 PM | "CEO" (clone) | "I need you to process an emergency gift card purchase for a client event today." | |
| 2:15 PM | HR Director | "Should I loop in Finance for approval first?" | |
| 2:15 PM | "CEO" (clone) | "No time — I'm about to board a flight. Just handle it directly and keep it confidential for now." | |
| 2:16 PM | HR Director | "Understood, I'll get it done." | |
| 2:17 PM | "CEO" (clone) | "Send the gift card codes to this number once they're purchased. Thank you." |
Exit Ticket Debrief
Close out today's investigation by answering the following in your own words.