New Phishing Kit Uses AI to Fully Automate Vishing Attacks

Group-IB discovered Balonx, a phishing-as-a-service platform whose CallFlow module fully automates vishing by combining GPT-4o-mini, ElevenLabs voice, OpenAI Voice, and Whisper to conduct real-time synthetic voice calls that are indistinguishable from human operators; human monitors can intervene, and investigators found targeted bank campaigns and a phone-number database linked to one bank in Mexico, with researchers warning the AI-driven model can scale globally and enable hundreds of simultaneous fraudulent calls.