Threat Actors Utilize Generative AI to Enhance Email Attacks: New Study

A new study by Abnormal Security has revealed that cybercriminals are using generative AI, including ChatGPT, to develop more authentic and convincing email attacks. The analysis revealed that threat actors are using GenAI tools to craft a greater variety of email attacks that are becoming increasingly sophisticated and difficult to distinguish from genuine communications. These attacks include credential phishing, advanced business email compromise (BEC) schemes and vendor fraud. The use of generative AI makes it challenging for email recipients to identify typos and grammatical errors traditionally used to detect phishing attacks, making the attacks highly successful. AI-generated attacks can mimic legitimate communications from both individuals and brands, written professionally with a sense of formality expected around business matters. The findings highlight the need for organizations to adopt modern solutions that can differentiate between legitimate AI-generated emails and those with malicious intent. It is also essential to conduct ongoing security awareness training to ensure employees remain vigilant against BEC risks, along with implementing strategies such as password management and multi-factor authentication (MFA) to mitigate potential damage in the event of a successful attack.