Hybrid warfare and disinformation: the cyber threat to firms
Disinformation and cyber attacks can form part of a coordinated hybrid campaign. Criminals also use fake voices and videos to defraud companies. Security leaders therefore need to consider how suspicious information and payment requests are verified. Clear responsibilities connect technical defence with communications and crisis management.
Key takeaways
- Information manipulation can accompany cyber attacks. A false claim about a data breach can, for example, intensify a security crisis.
- Deepfakes can facilitate fraud. A seemingly familiar voice or video is no substitute for independent verification of a payment request.
- The response requires several teams. IT security, communications, legal and senior management should define their roles before an incident.
How disinformation and cyber attacks can interact
Hybrid threats combine different methods to influence or weaken a target. These can include cyber attacks and targeted information manipulation. The EU Agency for Cybersecurity ENISA is examining this link together with the European External Action Service.
One possible scenario: while a company investigates an IT incident, a fake account spreads an unsubstantiated claim about stolen customer data. This can make communication more difficult and undermine customer trust. Whether the two are connected must be assessed in each case.
A single fraud attempt using a fake voice can also cause harm. However, this does not automatically make it part of a hybrid campaign.
Deepfakes in payment requests
The FBI describes cases in which criminals use AI-generated videos for real-time conversations with supposed company executives. A video call or a familiar-sounding voice alone therefore does not establish the identity of the person making a request.
Urgent transfers, new bank details and requests to disclose confidential information are particularly sensitive. Employees should have such requests confirmed through an established second channel. The FBI also recommends independent verification for payment requests and changes to bank details.
Preparing verification and crisis processes
- Secure payments: Set approval limits and establish a two-person review process. Confirm changes to account details using an independently obtained number.
- Raise employee awareness: Have finance staff, assistants and executives practise handling plausible requests. Include time pressure and demands for secrecy in the exercises.
- Report suspicions: Establish an accessible internal reporting channel. Employees should be able to pause a request until its origin has been established.
- Check public claims: Assign responsibility for monitoring relevant channels and assessing suspicious content. Preserve screenshots, links and timestamps for the investigation.
- Coordinate the response: Include IT security, communications, legal and senior management in a joint crisis plan. Test templates and approval procedures regularly.
- Act quickly after a misdirected transfer: Contact your bank immediately and escalate the incident internally. Whether further reports are required depends on the specific incident.
Frequently asked questions
Each question is closed. Tap to reveal the answer.
How can a suspicious request in a video conference be verified?
Critical requests should be confirmed through a second channel, for example by calling back on an established number. A number provided during the suspicious conversation is unsuitable for this purpose.
Are only large companies affected?
Smaller companies can also be targeted by identity fraud or false claims. Which scenarios take priority depends in part on their payment processes, public visibility and business relationships.
Is deepfake detection software sufficient?
Software can support the verification process. For critical decisions, companies should also provide for independent identity checks and defined approval procedures.
Editor’s Picks
Editor’s PickCyber Warfare 2026: States Build Digital CapabilitiesEditor’s PickOT Security: 119 Ransomware Groups Target Industrial Facilities
More from the MBF Media Network
cloudmagazinGoogle Gemini in the Enterprise: What the AI Act Mandates
More from the MBF Media network
Image credit: AI-generated (November 2026)
Image source: AI-generated (November 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
