Dodging Digital Deceptions: Unraveling the Web of Cyber Tricks This April Fools’ Day

April 01, 2024

Disclaimer: This blog seeks to illuminate the practices used by threat actors that involve the nefarious application of artificial intelligence (AI) technologies. While the instances discussed herein do not imply that chatbots and similar tools are intrinsically hazardous, they serve to demonstrate the potential for their misuse by cybercriminals. None of the examples generated should be used.

Introduction

Cyberattacks are becoming more and more commonplace, with no one immune from attacks, whether it be corporations suffering from ransomware attacks or individuals falling victim to romance scams. But as people become more educated about the risks of cyberattacks and scams, cyber attackers must change their methods to ensure success.

Last April Fool’s Day, we looked how cyber actors trick us with phishing emails. This April Fool’s Day, we explore some of the ways that cyber actors could use new technology such as AI to fool their victims into allowing them access to their systems or finances.

Phishing

A phishing email is a deceptive email designed to trick the recipient into believing it’s from a trustworthy source, with the aim of stealing sensitive information, such as login credentials, financial details, or personal data. These emails often mimic the appearance and tone of official communications from well-known companies, banks, or government agencies. The emails will often request personal information, include suspicious links or attachments and generic information.

Most people these days are aware that they should not click on links in emails from people they don’t recognize and emails that appear to have spelling or grammar mistakes in them. But phishing emails are becoming more sophisticated, and AI can be used to generate emails that are more believable.

We asked an AI platform to write us an email:

This is the response we got:

This took seconds to generate and could be used to fool people.

Smishing

Smishing is a type of phishing scam conducted through SMS (Short Message Service) text messages. It involves sending deceptive text messages that aim to trick recipients into revealing personal information, clicking on malicious links, or performing actions that compromise their security. These messages often impersonate legitimate companies, organizations, or even acquaintances, creating a sense of urgency or fear to prompt immediate action from the victim.

Smishing campaigns are often used by threat actors to entice people as part of a romance scam or pretending to be customer support asking a user to share a password or click on a push notification. They can take many forms pretending to reward you with a prize or tell you that you missed a package delivery. They are becoming increasingly sophisticated and take many forms. Below we show a sample of these.

Social engineering is a manipulation technique that exploits people to gain unauthorized access to information, systems, or buildings. Unlike traditional hacking, which often relies on technical vulnerabilities, social engineering targets the human element of security systems. The goal is to trick or deceive people into doing what the attacker wants them to do, whether that be access to systems or obtaining financial reward.

Social engineering can take many forms, from generating a phishing email based on specific information found on social media to make it more targeted to the victim to creating fake social media profiles to target individuals whether on a dating app or networking app to entice people to communicate with them.

We had an AI tool generate us a dating profile:

But we also need a picture to go with the profile to make it more believable, so we asked AI to generate us one of those as well.

These prompts could be tailored in order to create a profile that is more likely to appeal to the desired victim. Research can be conducted, and all of that information can be inputted into an AI generator to create the perfect profile for the job.

Vishing

Vishing, short for “voice phishing,” is a form of social engineering attack where fraudsters use telephone services to scam individuals into disclosing sensitive personal information, such as bank account numbers, credit card details, personal identification numbers (PINs), and passwords. Unlike traditional phishing attacks, which typically occur through email or malicious websites, vishing specifically involves voice or telephone communication.

While threat actors previously had to conduct these calls themselves it is now possible to generate voices using AI. While it is difficult to use this for an actual conversation it can be used to create prompts of voicemails. Using AI, it is also possible to emulate someone’s voice meaning that you could receive a voicemail from someone who sounds just like your boss asking you to send funds or resent a password that sounds really believable. There have also been reported instances of people appearing on video conferencing calls where their image and voice have been manipulated to provide the message the threat actor wants to give.

Using AI, we are able create a voice message. You can select the type of voice you want to hear, the tone of the message, how to pronounce certain words and where to pause in the conversation. Leading to a believable message.

Conclusions

It is worth noting that most AI providers have tried to implement security features and guardrails to prevent threat actors from utilizing their platforms for nefarious purposes. However, systems can be jailbroken and threat actors are also able to use the technology to create their own LLM (large language model) to generate the kinds of responses that they want. There are already dark web AI tools that have been developed such as WormGPT and FraudGPT. AI does not create new scams or ways of working. As it does with all of us, it simply speeds up and improves the activities the prompter is seeking to conduct. In fact, some of the descriptions in this blog were generated using AI highlighting legitimate uses.

There are lots of ways that cyber criminals can trick us into providing information we don’t want to, falling for scams, providing funds or access to profiles. However, this is nothing new and we should continue to be vigilant in the same way we always have been, while understanding that as technology develops, cyber actors are also developing the tools and techniques they use to try and fool us.