{"id":6144,"date":"2023-09-26T13:41:53","date_gmt":"2023-09-26T18:41:53","guid":{"rendered":"https:\/\/www.stratospherenetworks.com\/blog\/?p=6144"},"modified":"2023-09-26T13:41:53","modified_gmt":"2023-09-26T18:41:53","slug":"bots-creating-bait-what-ai-generated-phishing-emails-mean-for-cybersecurity","status":"publish","type":"post","link":"https:\/\/www.stratospherenetworks.com\/blog\/bots-creating-bait-what-ai-generated-phishing-emails-mean-for-cybersecurity\/","title":{"rendered":"Bots creating bait: What AI-generated phishing emails mean for cybersecurity"},"content":{"rendered":"

\"AImagine receiving an email from your boss that seems a little off. Maybe he\u2019s requesting a password or financial information he should be able to access without your help. You remember your security awareness training on how to spot phishing and scrutinize the message for typos and bad grammar.<\/p>\n

There should be obvious signs if the email is a phishing attempt, right? Unfortunately, that\u2019s not necessarily true anymore, thanks to generative AI<\/a>. Just as businesses have seized the opportunity to bolster content creation efforts with the capabilities of large language models (LLMs), cybercriminals have also jumped at the chance to enhance their phishing campaigns with tools like ChatGPT.<\/p>\n

\u201cHackers are always testing new technologies for ways to subvert it for their own ends, and generative AI is no different,\u201d Gartner Risk & Audit Practice Research Director Ran Xu said in a press release<\/a>.<\/p>\n

That means you must adjust your cybersecurity strategy to account for AI-generated phishing emails. Here\u2019s what you should know about how AI has changed phishing and steps you can take to keep your breach risk low despite supercharged social engineering tactics.<\/p>\n

Generative AI phishing: Why it\u2019s harder to spot scams in the ChatGPT era<\/h2>\n

Even before generative AI entered the picture, phishing attempts were rampant. In 2020, at least one end user attempted to connect to a phishing site at 86 percent of organizations, according to Cisco\u2019s 2021 Cyber Security Threat Trends report<\/a>.<\/p>\n

Before widespread access to AI, however, scammers had to manually write the copy for fraudulent messages and could be limited by time and language skills. Today, they can rely on large language models to instantly generate tons of grammatically flawless text, making it much harder to spot suspicious messages, according to The Wall Street Journal<\/a>.<\/p>\n

Additionally, generative AI can easily take on different tones and personalities. Hackers can task LLMs with crafting an email written as if it\u2019s from your boss or colleague.<\/p>\n

Generative AI has subsequently fueled what Xu of Gartner calls \u201cthe industrialization of advanced phishing attacks.\u201d Bad actors immediately seized the opportunity to utilize this cutting-edge technology for nefarious purposes after the release of ChatGPT in Q4 2022, with mentions of generative AI on the dark web skyrocketing into the thousands by Q1 2023, according to Bain & Company<\/a>. The AI revolution is here for criminal enterprises as well as legitimate ones.<\/p>\n

How to combat AI-powered phishing attempts<\/h2>\n

The good news is that cybercriminals aren\u2019t the only ones with generative AI on their side. At Black Hat USA 2023, security researchers presented evidence that LLMs that hadn\u2019t been trained with security data could still identify suspicious emails, according to KnowBe4<\/a>. Cybersecurity professionals can, therefore, fight fire with fire by flagging phishing attempts with AI.<\/p>\n

You can also implement other safeguards against phishing messages and data breaches. Here are just a few steps you can take, according to the Cybersecurity and Infrastructure Security Agency (CISA)<\/a> and our IT experts.<\/p>\n