Artificial Intelligence Makes Phishing Harder to Spot

Cybersecurity professionals continue to warn that advanced chatbots like ChatGPT are making it easier for cybercriminals to craft phishing emails with pristine spelling and grammar, the Guardian reports.

Corey Thomas, CEO of Rapid7, stated, “Every hacker can now use AI that deals with misspellings and poor grammar. The idea that you can rely on looking for bad grammar or spelling to spot a phishing attack is no longer the case. We used to say that you could identify phishing attacks because the emails look a certain way. That no longer works.”

The Guardian points to a recent report by Europol outlining the potential malicious uses of AI technology.

“In Europol’s advisory report, the organization highlighted a similar set of potential problems caused by the rise of AI chatbots, including fraud and social engineering, disinformation and cybercrime,” the Guardian says. “The systems are also useful for walking would-be criminals through the steps required to harm others, it said. ‘The possibility to use the model to provide specific steps by asking contextual questions means it is significantly easier for malicious actors to better understand and subsequently carry out various types of crime.’”

Max Heinemeyer, Chief Product Officer at Darktrace, said AI technology would be particularly useful for spear phishing emails.

“Even if somebody said, ‘don’t worry about ChatGPT, it’s going to be commercialized,’ well, the genie is out of the bottle,” Heinemeyer said. “This type of technology is being used for better and more scalable social engineering. AI allows you to craft very believable ‘spear-phishing’ emails and other written communication with very little effort, especially compared to what you had to do before.”

Heinemeyer added, “I can just crawl your social media and put it to GPT, and it creates a super-believable tailored email. Even if I’m not knowledgeable of the English language, I can craft something indistinguishable from a human.”

Security awareness training can help your employees keep up with evolving social engineering tactics and detect advanced phishing attacks. Learn more about the value of security awareness training in our Phishing by Industry Benchmarking Report.

Information in this article was provided by our partners at KnowBe4.