| | AUGUST 2024ENTERPRISE SECURITY8IN MY OPINIONIN MY OPINIONIt's commonplace to think that careless people are the ones who get scammed online. Not true. In fact, organizations and even governments fall prey to scammers who are increasingly getting more sophisticated in their ways. It was in the month of August 2022 that the City of Lexington realized that it had lost about $4 Million to an email fraud scheme. The theft involved three wire transfers to a private bank account, money that was originally intended to go to the non-profit community Action Council in Lexington. The attacker, in this case, impersonated an email account belonging to the local housing group associated with the city. Note that Lexington is not the only city to have suffered at the hands of scamsters. The city of Portland lost $1.4 Million and Peterborough, New Hampshire $ 2.3 Million. All these losses related to email fraud schemes. The list of such victims grows by the day. Email phishing schemes universally affect all types of companies, non-profit organizations, governments and private citizens.Scamming enters the new age.New-age scammers are now relying on a super-intelligent ally. Enter AI, the latest tool that is now being used to generate and carry out extremely sophisticated email phishing attacks. This was amply demonstrated at one of the Black Hat and Defcon conferences, where a team of researchers used two sets of phishing emails. One was developed by the team, whereas the other was generated using AI. Both emails contained links that collected data to report the number of clicks. These emails were then sent to a sample of 200 recipients. When the click rates were analyzed, it was found that the recipients of the emails clicked the links in the AI-generated phishing emails by a wide margin in comparison to one that the researchers generated. Even though the tested sample in this experiment was relatively smaller and homogeneous, the study clearly showed that AI-generated content was far more potent in launching phishing and spear phishing campaigns.Phishing emails crafted using AI and those generated by human agents have marked differences in sophistication. AI-generated phishing emails use machine learning algorithms to closely imitate the recipient's behaviors and habits. This includes learning the subject's usage of grammar and sentence construction, profession, situational context and interest to craft a message. Such sophisticated content proves extremely difficult to detect with traditional phishing defense mechanisms.Hacked websites are a goldmine of data about an organization that can be harvested and organized by AI to launch a spear phishing attack targeted at a very specific By Thomas Titus, Director Information Security, EverestTURNING THE TABLES ON SCAMMERS: WHY AI IS THE KEY ALLYThomas Titus
< Page 7 | Page 9 >