•
4 min read
GenAI helps with automation
For example, in the phishing part of my talk, I examined the complete chain of phishing emails—from target selection, creation, and sending to responding to the emails. It should not come as a surprise that we’ve seen attackers use GenAI to create all kinds of scripts for automation. These scripts help them become more efficient and increase the frequency and volume of their attacks. You can find quite a few advertisements for such services on dark web forums.
Commonly, phishing campaigns begin by sourcing potential targets from leaked email lists or by enumerating a target company’s employee directory. For each target, the new scripts can personalize the lure message, for example, by referencing interests and hobbies from social media. Of course, this is not a new technique; tools like Maltego have been able to perform such tasks for many years. However, GenAI is making these capabilities more widely accessible.
A fool with a tool…
Keep in mind that GenAI is a tool, and like any other tool, the results highly depend on the person using it and the data fed into it. For example, we have observed multiple phishing emails written in the Swiss German dialect. This is amusing, as official companies such as banks or logistics firms would never communicate in Swiss German. It’s likely that someone instructed the AI tool to apply whichever language fits the target country without realizing the mistake.
One significant advantage of GenAI for attackers is its ability to handle multi-stage interactions. Whether it’s romance scams, CEO fraud, or 419 advance-fee scams, an AI agent can automatically respond to any question from the victim in the appropriate context. We’ve also seen cybercriminals use reinforcement learning to update their lure messages or swap phishing links automatically when detection occurs.
Context matters
So yes, some phishing emails are becoming more personalized, and the text is better written. But then again, sophisticated attackers have been crafting carefully targeted spear-phishing messages for decades. If poor grammar was the only thing protecting you so far, then you already had a bigger problem than GenAI.
Of course, the content of a phishing email is just one attribute. You can, and should, use all available indicators to analyze emails. This includes headers such as SPF, DKIM, and DMARC, which are much harder for GenAI to spoof.
This short example demonstrates why having an advanced email security solution is crucial—one that uses multiple indicators to dynamically assess messages, as context matters. If you like to learn more about how xorlab can help you to dynamically assess messages, contact us for a personalized demo.
