SANS360 Talks | AI-Driven Phishing Attacks

Key Takeaways

So uh hey uh thank you everyone for uh joining me here. So I'm I'll be talking about uh AIdriven uh fishing attacks. Um so generally um so imagine the situation where you receive a call from your CEO except that it is not your CEO it's an AI generated voice and they're asking for the typical thing that a scammer would do. They're asking for some private information like in this case a wire transfer. So the trend that we are seeing here is that AI can mimic trusted individuals and it can make fishing even more convincing. Uh so I'm going to start by defining the problem then I'm going to give you some ideas about some trends and we're going to end it with uh three quick case studies. Um so here the with the advancement of AI uh fishing is likely one of the things that is going to get affected the most. Um so in with AI you can have things like AI based personalization of voice you can have deep clones and all those other things and it also increases the sophistication of the attack making the attack look even more legitimate and the problem here is that traditional defenses are not ready for the new AI based uh uh fishing uh trend that's going on and it can cause even bigger like financial and reputational damage. So the the mechanism here is that it starts by some data harvesting. So the attacker will scrape for some social media or like public information that they have about the person. Then it will uh generate AI content like for example they'll generate human like emails or messages in the style of that person based on any content that they have. And then the third thing that is happening is we have voice and video cloning where you you must have seen these trends about deep fakes that are going on. Um so these are some trends that I have on the screen. Um so fishing attacks surged by uh 58.2% in 2023. So I don't we don't have the stats for 2024 yet but it was a big surge as you can see. And there have been new trends in fishing which is voice fishing and deep uh deep fake attacks uh which are significantly on the rise. And the two most published scams were or like fishing trends were tech support scams and QR capture scams. And this is from a report by Zcaler. Um now we're going to go into three case studies. The first one is generating a fishing page with AI. So as you can see on the screen we have uh we're using chat GPD to generate a fishing login page uh that looks exactly like the Microsoft signin page. So as you can see we started off with just a simple uh login SSO page which doesn't look too appealing or like a Microsoft page but then eventually through like multiple refinements we able to get to a stage where we have an distinctly looking uh Microsoft signin page here. Um and this was the like this is one of the capabilities that um attackers are using to generate really accurate content as and as you can see with the new image generator of chat GBT um how uh significantly important it is to stay aware aware of all these kinds of trends. So the second case study is about deep fakes and you must have seen this typical trend of Elon Musk promising you to double your crypto or maybe something like this where you have an Elon Musk deep fake um who is like deceiving individuals into investing money. So this was one of the case studies that I want to talk about and the third one is about wishing and this was something that actually happened to Zcaler's own CEO. So the attacker um called an employee on WhatsApp and they use an AI generated clone of the CEO and just to ensure that it's not too suspicious they made up something like hey the cell reception is not that good and then they immediately followed up with a text message and the conversation continued but the employee was suspicious of that and reported to the security team and then they investigated the the report and they realized as it was part of a widespread uh wishing campaign. So uh some of the call of action for from this is to stay proactive to make sure that your your company is uh continually updated on security policies and training and to make sure that you are uh on on the um on the significantly higher side or the or the more advanced on the defensive side to make sure that you're aware of all of these uh advancements that are going on with fishing and AI. um and use things like advanced thread detection, deep fake spotting tools and of course the third and the most important thing is to build a culture of vigilance. So ensure that you uh encourage on something like internal reporting and uh allow your employees to um flag suspicious content because usually these kinds of things uh humans are the weak links and usually it is some form of an employee from which these attackers are able to get in. But uh but yeah uh that was about it. Thank you so much. If you want to take uh grab these slides, you can grab it from the URL. Thank you. [Applause]