DeepSec In-Depth Security Conference 2026
DeepSec is the annual European IT security conference held in Vienna, bringing together researchers, practitioners and decision-makers from around the world for two days of hands-on trainings followed by two days of in-depth talks.
-
Training
Advanced Mobile Offensive Tradecraft
Trainings · Nov 17–18, 2026
Artificial Intelligence is rapidly changing the way offensive security engagements are conducted, but most practitioners are still using it as a glorified chatbot. This hands-on training shows how to integrate modern reasoning models and autonomous agents into real mobile penetration tests and Red Team operations.
This condensed session focuses on the synthetic attack techniques from the full course at Folposec, exploring how modern AI can be leveraged to execute realistic offensive operations. Through live demonstrations and practical examples, attendees will see how autonomous social engineering, AI-assisted smishing, real-time deepfake and vishing attacks, persistent conversational agents, and AI-generated hardware payloads can be used to enhance Red Team engagements. The emphasis is on practical tradecraft, real-world tooling, and the operational challenges of deploying these techniques responsibly in modern offensive security assessments.
Topics covered
- One-Shot high fidelity Deepfakes: techniques for creating convincing synthetic identities for offensive security engagements including one-shot facial synthesis, high fidelity generation and real-time synthetic video.
- Voice cloning, Vishing & Social Engineering: practical exploration of AI-generated and cloned voices for targeted social engineering, including voice impersonation, real time voice synthesis, vishing scenarios and convincing pretext development.
- Agentic Smishing: implementation of autonomous AI agents for targeted smishing campaigns including automated target profiling, intel gathering, personalized message generation and campaign orchestration.
- Autonomous Agentic conversational chatbots: practical implementation of autonomous conversational agents capable of conducting persistent social-engineering interactions, including contextual conversations, automated responses, conversational memory and long running engagement with targets.
- AI-Generated Hardware Payloads & Mobile persistence: practical intro to AI-assisted hardware payload generation against Android devices including automated HID scripts, device interaction, data manipulation and techniques for establishing persistence.
- Agentic Mobile SAST: introduction to autonomous AI agents for mobile application security analysis, including AI assisted static analysis, vulnerability identification, automated triage and integration with mobile reverse engineering workflows.
- Legality & Scope of Mobile Red Teaming: introduction to the operational, legal and ethical considerations surrounding mobile-centric Red Team activities, including engagement scope, authorization and responsible use of offensive AI techniques.
What students will receive
Students will receive all code and scripts used during the training, together with access to private repositories containing the material required to reproduce the techniques covered during the course. Participants will also receive access to a private Telegram channel for continuous updates on mobile offensive tradecraft, tooling and techniques.
In addition, students will receive exclusive free access to the upcoming complete course on Agentic SAST and Reverse Engineering for Mobile (online).
Entry requirements
Participants should have some experience with penetration testing and/or Red Teaming, basic Linux and CLI skills and some scripting or programming experience. The course is particularly suited to Red Teamers and pentesters interested in mobile specific targets and AI-generated synthetic attack vectors such as deepfakes, vishing and autonomous social engineering agents. It is also relevant to Blue Teamers and defenders who want to understand modern TTPs used by advanced threat actors. Previous experience with AI and LLMs is useful but not required.
What students should bring
Students should bring a laptop capable of running standard security tooling, together with a suitable Linux environment or virtual machine where appropriate. For the hardware payload section, students may optionally bring their own compatible hardware plug or cable (HAK5), although this is not strictly required. Students should also bring an Anthropic API key, which will be used for the AI driven practical exercises. Students are responsible for their own API usage costs. The trainers will provide a complete cloud-based environment and most of the APIs required for the demonstrations and exercises.
-
Talk
The Evolving Adversary: Deploying Deepfakes, Voice Cloning and Agentic Bots in Modern Red Team Ops
Conference · Nov 19–20, 2026
Classical phishing campaigns are rapidly losing their edge as sophisticated threat actors abandon static lures in favor of AI-driven synthetic social engineering. Today’s adversaries no longer rely on basic text lures, they deploy real-time deepfakes, cloned voices and autonomous agents capable of dynamic, context aware interactions. To realistically mirror these evolving threat actors, Red Teams must move past traditional phishing and adopt synthetic media and agentic orchestration in their adversarial simulations.
This practical presentation showcases how to bridge that operational gap in modern mobile Red Team engagements. Through technical demonstrations, the session focuses on full spectrum synthetic attack vectors, including real time single-shot deepfakes, automated voice cloned vishing and hyper personalized agentic smishing campaigns. The speakers will also demonstrate how these offensive capabilities integrate with persistent conversational chatbots, leveraging long term memory, target profiling and automated tool execution to sustain multi day pretexts without human intervention. Attendees will leave with actionable tradecraft, tooling workflows and a clear model for evaluating and executing next-generation synthetic attacks.