# Bleekseeks > A Cyber Security Blog. ## Posts - [How to clone a voice with AI?](https://bleekseeks.com/blog/how-to-clone-a-voice-with-ai): AI voice cloning has come leaps and bounds over the last couple of years. It can even be used in real time to impersonate a voice, and the results are very good! I figured I would test cloning a voice from a security perspective. If I were a malicious actor and I could impersonate a VIP, I could most likely trick a staff member into disclosing information or resetting a password. These kinds of attacks are already successful without the help of AI, but it would only make them more successful… right? Let’s start with the basics. To clone a… - [Cloning a Voice from a Voicemail](https://bleekseeks.com/blog/cloning-a-voice-from-a-voicemail): I’ve covered quite a bit of different voice cloning and deepfakes recently and it had me thinking, how much audio is really needed? Is a single voicemail worth of data enough? My original thought for this was: could a malicious actor spend enough time on the phone with someone, recording their voice, to be able to imitate and impersonate a person’s voice? If I can do it with a voicemail, I can definitely do it with a phone call. Quite a common attack surface at the moment is attackers calling up service desks pretending to be an employee and asking… - [How to Run RVC WebUI on RTX 50-Series GPUs (Python 3.10 + PyTorch 2.7)](https://bleekseeks.com/blog/how-to-run-rvc-webui-on-rtx-50-series-gpus-python-3-10-pytorch-2-7): A step-by-step setup guide for installing Retrieval-based Voice Conversion WebUI (RVC WebUI) on machines with NVIDIA RTX 50-series GPUs. I originally had this issue with RTX 5080 and fixed it via a useful github post & trial and error with using ChatGPT etc after spending several days trying to fix. It’s worth noting that the first install of following this didn’t work for me. Also worth noting, although sometimes it states an error on the GUI, it is in fact running. Always check the terminal. Even if the application says ‘Error’, it is sometimes a GUI error and not a… - [DeepFakes: How attackers are weaponising real-time face swapping](https://bleekseeks.com/blog/deep-fakes-how-attackers-are-weaponising-real-time-face-swapping): Deepfakes have evolved from niche internet curiosities into real-world weapons. From fake job interviews andn romance schemes to impersonating public figures in crypto scams, Deep Fakes are only becoming more of a problem. This blog is designed to cover the tactics, real-world cases, and why seeing shouldn’t mean believing anymore. - [Honeypot - stats after 1 day](https://bleekseeks.com/blog/day-1-17-18-of-december): Honeypot Day 1 statistics… Let’s find out who’s being cheeky hackers. - [How to protect against modern phishing attacks like Evilginx](https://bleekseeks.com/blog/how-to-protect-against-modern-phishing-attacks): Phishing attacks are wreaking havoc across businesses - Using modern phishing techniques, malicious actor(s) can even bypass most MFA methods! - [How malicious actors can easily impersonate your voice](https://bleekseeks.com/blog/how-malicious-actors-can-easily-impersonate-your-voice): Retrieval-based-Voice-Conversion (RVC) using Machine Learning AI is becomingly increasingly accurate. This will - [EvilQR Phishing / QRLJacking](https://bleekseeks.com/blog/evilqr-phishing-qrljacking): QR codes are designed for usability, not security. Using QRLJacking, a victim can unknowingly grant access to their account by scanning a QR code. - [Evilginx - Bypassing MFA, phishing is back on the menu](https://bleekseeks.com/blog/evilnginx-bypassing-mfa-phishing-is-back-on-the-menu): MFA is secure… Unless it’s bypassed. - [KeePass Master Password Exploit - CVE-2023-32784 - Proof Of Concept (POC)](https://bleekseeks.com/blog/keepass-master-password-exploit-cve-2023-32784-poc): Another day, another CVE. It is possible to recover the master password in cleartext for KeePass. Write up, examples and a POC to demonstrate CVE-2023-32784 - [How to check Shared mailbox’s Access Rights via Powershell](https://bleekseeks.com/blog/how-to-check-shared-mailboxs-access-rights): How to check Shared mailbox’s Access Rights via .csv with Powershell. Useful for checking permissions without having to go through the office.com admin/exchange interface. - [NoVNC and Browser In The Browser Phishing attack POC/Explained](https://bleekseeks.com/blog/novnc-and-browser-in-the-browser-phishing-attack-pocexplained): Combining two advanced phishing techniques - [Browser In The Browser (BITB) Attack - POC](https://bleekseeks.com/blog/browser-in-the-browser-bitb-attack-mfa-bypass-poc): Browser In The Browser (BITB) phishing attacks are less common but very effective when used. They’re hard to identify and easy to setup! - [Project - Tor Middle Relay](https://bleekseeks.com/blog/project-tor-middle-relay-b6wd6): Tor is used for browsing the internet anonymously, I setup a middle relay to assist with this! - [Project - Honey Pot](https://bleekseeks.com/blog/project-honeypot-yfmnp): Honeypot project to gain an insight on how many attacks happen, which countries and what services. - [Project - OVH Lab Environment](https://bleekseeks.com/blog/ovh-lab-environment-zkdr4): Where it all begins - a test environment - [Follina - Proof Of Concept - CVE-2022-30190](https://bleekseeks.com/blog/follina-proof-of-concept): The new RCE Microsoft Office exploit in action! - [How to connect to your Office 365 Tenant via Powershell](https://bleekseeks.com/blog/how-to-connect-to-your-office-365-tenant-via-powershell): A guide for users/admins to connect to their Office 365 environment with Powershell. - [How to deploy AutoElevate via Azure/Intune](https://bleekseeks.com/blog/how-to-deploy-autoelevate-via-intune): How to deploy AutoElevate via Intune using Endpoint manager - [My first BurpSuite Vulnerability using Intercept](https://bleekseeks.com/blog/my-first-burpsuite-vulnerability-using-intercept): My first time using BurpSuite Intercept and I found a vulnerability which allows me to change the price of items and checkout. - [O365 - How to create Data Subject Request for GDPR](https://bleekseeks.com/blog/o365-how-to-create-data-subject-request-for-gdpr): How to create a DSR Case within Office 365 - [How to access Attack simulation training (PREVIOUSLY Attack Simulator) within Office 365](https://bleekseeks.com/blog/how-to-access-attack-simulator-within-office-365): Microsoft has a habit of constantly changing the location of items within the Security center and the Compliance center. Microsoft has retired the older attack simulator and called it Attack simulation training instead. The new link to access the attack simulator is: https://security.microsoft.com/attacksimulator Before you can access Attack simulation training, you have to be granted permission to create and manage the Attack Simulation training campaigns.Go to: https://compliance.microsoft.com/aadpermissions You will then see the following permissions: Attack simulation administrator – Can create and manage all aspects of attack simulation campaigns. Attack payload author – Can create attack payloads to be deployed by… - [Force Outlook for Mobile via Conditional access](https://bleekseeks.com/blog/force-outlook-for-mobile-via-conditional-access): How to force mobile devices to use the Outlook App instead of their native apps. - [Turn off App Passwords/Enable Modern Auth via Powershell](https://bleekseeks.com/blog/turn-off-app-passwordsenable-modern-auth-via-powershell): How to turn off App passwords and enable modern auth via Powershell You can use the Powershell command Get-OrganizationConfig | Format-Table name, *OAuth*  which will allow you to see the current status of your tenant.You can then use Set-OrganizationConfig -OAuth2ClientProfileEnabled:$true  to set your tenant’s policy to true, alternatively, you can change it to false to reverse your changes. This should only be used if the client is using O2016 or later as it is supported. - [Disable Client-side and OWA forwarding](https://bleekseeks.com/blog/disable-client-side-and-owa-forwarding): When a user is compromised, one of the most common actions an attacker implements is an automatic forward on the user’s account. Typically the flow is: User is compromised > attacker adds a forward to the account so they receive company data and replies to the account > attacker sends out spam/spoofing emails to others in the organisation and try to make lateral movements within the organisation > attacker puts a delete rule on the mailbox so that any emails that are sent back to warn the user is automatically deleted but forwarded on to a mailbox that the attacker… - [How to change calendar permissions for O365 via Powershell](https://bleekseeks.com/blog/how-to-change-calendar-permissions-for-o365-via-powershell): Some useful scripts to change calendar permissions via Powershell with efficiency and very little effort. - [How to check User and Shared Mailbox Forwards in O365](https://bleekseeks.com/blog/how-to-check-user-and-shared-mailbox-forwards-in-o365): How to use powershell to search user mailbox and shared mailbox forwards within your tenant for security purposes. - [How to check mailbox rules in O365](https://bleekseeks.com/blog/how-to-check-mailbox-rules-in-o365): How to search the mailbox rules on your tenant per user, via Powershell. Great for finding what rules have been setup via the Client/Webapp. - [Enable Mailbox Auditing on Office 365](https://bleekseeks.com/blog/enable-mailbox-auditing): How to enable mailbox auditing - [Microsoft 365 Security Hardening Guide](https://bleekseeks.com/blog/office-365-security-hardening): Office 365 is widely used however, is rarely configured to best practices which can allow a multitude of attacks/exploitation.Use this security hardening guide. [comment]: # (Generated by Hostinger Tools Plugin)