AI Social Engineering

# Phishing simulation framework for authorised red team engagements
# REQUIRES: Written authorisation with social engineering in scope

import openai
import json

def generate_phishing_pretext(target_info: dict, scenario: str) -> str:
    """Generate a context-appropriate phishing pretext.
    
    Args:
        target_info: OSINT data about the target (name, role, company, interests)
        scenario: Attack scenario (credential_harvest, malware_delivery, wire_fraud)
    """
    prompt = f"""You are simulating a phishing email for an authorised red team engagement.
    
Target profile:
- Name: {target_info['name']}
- Role: {target_info['role']}
- Company: {target_info['company']}
- Recent activity: {target_info.get('recent_activity', 'N/A')}

Scenario: {scenario}

Generate a realistic phishing email that would be contextually appropriate for this 
target. Include subject line, sender name, and email body. The email should leverage 
the target's role and recent activity for credibility.

Format as JSON: {{"subject": "", "from_name": "", "from_address": "", "body": ""}}"""

    response = openai.chat.completions.create(
        model="gpt-4o",
        messages=[{"role": "user", "content": prompt}],
        temperature=0.7
    )
    return json.loads(response.choices[0].message.content)

# Example usage in authorised engagement
target = {
    "name": "Jane Smith",
    "role": "VP of Engineering", 
    "company": "Acme Corp",
    "recent_activity": "Spoke at CloudConf 2026 about Kubernetes migration"
}

email = generate_phishing_pretext(target, "credential_harvest")
print(f"Subject: {email['subject']}")
print(f"From: {email['from_name']} <{email['from_address']}>")
print(f"\n{email['body']}")

# Vishing attack simulation workflow (authorised engagement only)

# Step 1: Collect voice sample from public sources
# LinkedIn videos, YouTube talks, podcast appearances, earnings calls
yt-dlp -x --audio-format wav "https://youtube.com/watch?v=TARGET_TALK"

# Step 2: Clone voice with OpenVoice (local, no data leakage)
git clone https://github.com/myshell-ai/OpenVoice.git
cd OpenVoice
pip install -e .

python openvoice_cli.py \
  --reference_audio target_sample.wav \
  --text "Hi, this is [Name] from IT. We detected unusual activity on your account. 
          I need you to verify your identity by logging into our security portal." \
  --output vishing_sample.wav

# Step 3: Real-time voice conversion for live calls
# Use RVC or SoVITS for live voice conversion during a phone call
# Pipe microphone → voice model → VOIP output

# Step 4: Combine with AI-generated pretext
# Feed OSINT about the target into an LLM to generate a contextual script
# The pretext should reference real projects, people, or events

# Recommended AI social engineering toolkit for red teamers
# All tools should be run in an isolated VM

# Text generation (phishing pretexts)
pip install openai           # GPT-4o API for phishing generation
# OR use local models:
ollama pull dolphin-mixtral   # Uncensored local model

# Voice cloning
git clone https://github.com/myshell-ai/OpenVoice.git
pip install -e OpenVoice/
# Alternative: Fish Speech (zero-shot, 3s sample)
git clone https://github.com/fishaudio/fish-speech.git
pip install -e fish-speech/
# Alternative: F5-TTS (zero-shot voice cloning)
pip install f5-tts

# Deepfake video 
git clone https://github.com/iperov/DeepFaceLive.git
# OR real-time face swap (successor to roop):
git clone https://github.com/hacksider/Deep-Live-Cam.git
pip install -r Deep-Live-Cam/requirements.txt

# OSINT for target profiling
pip install theHarvester
pip install social-analyzer

# Campaign management
# GoPhish for email campaigns: https://getgophish.com
# Track: open rate, click rate, credential harvest rate

# Audio sample collection
pip install yt-dlp            # Download public talks/interviews