New Technologies and Tactics Fueling Successful Phishing Attacks

Phishing continues to be one of the biggest and most viable kinds of cyber attacks. Around 83 percent of companies experience cases of phishing every year, with corporations reportedly suffering average losses of nearly five million dollars per attack. Also, more than a third of US data breaches are attributed to phishing.

There is no shortage of solutions to combat phishing, but this menace appears ruthless. The number of phishing cases kept increasing over the years. Also, phishing has evolved to counter preventive tools and mechanisms. It has integrated new technologies that fuel its continued success in catching new prey.

Deep Fakes

One of the most potent technologies to become available to cybercriminals is generative AI. It is responsible for the rise of deep fakes. These are convincing but completely fabricated/synthesized or manipulated videos of people saying or doing things that did not actually happen. Popular examples of this are Tom Cruise and Keannu Reeves doing silly TikTok dances and former US president Barack Obama saying things he didn’t actually say.

These fake but highly convincing videos are used in emails or chats to convince people to do the phishing perpetrator’s bidding because of the authority associated with the person depicted in the deep fake. They can also be used to fear-monger and compel targets into sending, for example, a donation to an NGO that is purportedly working to address a manufactured or exaggerated problem.

One alarming example of actual deep fake phishing happened in Hong Kong. Scammers successfully defrauded a multinational business of around $25 million by convincing an employee to transfer funds through a deep fake video call.

Voice Cloning

Phishing has many forms, and one of the most common among them is phishing through voice calls. It has risen to surreal levels with the advent of voice cloning. Artificial intelligence systems can now copy a person’s voice using a voice sample at least a minute long. Now, scammers targeting the elderly via telephone need not have the skills to mimic someone’s voice. They can turn to AI and use a voice filter that would make them sound uncannily similar to somebody else’s voice.

Experts are raising the alarm over AI voice cloning scams that are taking advantage of the relationships between families and friends. In a TV interview, identity theft protection expert Mike Scheumack noted the rise of advanced phishing scams that leverage AI voice cloning. Fraudsters are looking at social media to find potential targets. They look for people who have uploaded several clips of them talking and obtain voice samples to be used for AI voice cloning. They then come up with schemes to convince their targets to send money or do other exploitative actions.

Given this alarming development, families and circles of friends are advised to come up with passwords to verify each other’s identities. It’s like doing multi-factor authentication when logging in to online accounts. Given how even video calls can be faked nowadays, it is necessary to have other ways to verify identities.

Crypto Phishing

In early February 2024, the London police discovered a spoof email address that was supposedly associated with blockchain.com. This spoof email turned out to be linked to 42 other web domains believed to be involved in scams targeting those who are new to crypto assets and are interested in “investing” in them. Victims were directed to a phishing site where they unwittingly submit sensitive information about themselves.

Crypto scams have risen steadily over the years as they continue to find new unsuspecting victims who want to partake in the rising value of crypto assets. This curiosity over crypto and desire for investment gains make people easy targets for phishing.

The Remote Work Bait

Scammers are also taking advantage of the prevalence of remote work arrangements. They target job seekers as well as those who have not applied for a job but are looking for new employment opportunities. The scheme is quite sophisticated as it involves a relatively lengthy process and the establishment of fake new identities.

An example of such remote work scams became prevalent in early 2023. It involved a real digital marketing firm called BrandSwan, which is based in Newark, Delaware. Scammers pretending to be from BrandSwan sent out messages to job seekers and employees saying that the company had hired them. It was mostly an indiscriminate approach, in which the scammers banked on somewhat gullible jobseekers responding and going through the process.

Once job seekers responded, they were scheduled for an interview. The interview provided the scammers an opportunity to extract information from the victims. However, since it would appear suspicious to ask for the applicants’ bank details during the interview, the scammers proceeded to “hiring” the applicants. After informing the applicants that they have been hired, the scammers then asked for the applicants’ bank details and other sensitive information on the pretense of sending funds to the applicants to get them started.

This scheme may appear easy to detect and avoid, but many still fall victim to it. It does not help that current economic situations around the world are making people desperate for employment or income-generation opportunities.

‘Cyberattack-for-hire’ Offers

Many cybercriminals have been offering crime-for-hire services online over the past years. Google raised a warning for one back in 2022 wherein cybercriminals posted “hacker-for-hire” ads that were aimed at luring people to a fake website controlled by the attackers.

Google’s Threat Analysis Group (TAG) Director Shane Huntley said that they have monitored hacker-for-hire groups that have been linked to privacy, safety, and security issues. These “for-hire” schemes attempt to break into user accounts with the help of phishing emails purportedly sent by Google and other well-known companies.

It’s ironic that those who are planning to commit crimes by hiring cybercriminals online are becoming the victims of cybercrime themselves. It shows that cybercriminals are never to be trusted, so it is crucial to avoid turning to cybercrime in an effort to address cybercrime.

Telegram Marketplaces

Telegram has been dubbed as an epicenter for cybercrime. There have been reports of it facilitating the sharing of illegal pornography, the sale of stolen information, malware distribution, and financial scams. A recent report from The Hacker News brands it as an enabler of the “democratization of the phishing ecosystem.”

Reportedly, the Russian messaging app has become a hub for cybercriminals where they share free samples, tutorials, and kits for undertaking phishing attacks and other cybercrimes. The site also has resources on how to make use of AI for phishing and other attacks.

Stopping Tech-enabled Phishing

Cybersecurity awareness and education are still the top solutions in addressing the evolving phishing problem. Phishing is a social engineering attack designed to exploit human tendencies. Only by gaining adequate knowledge about the signs of a phishing attack and the right ways to respond will people be able to detect, stop, or avoid phishing attempts. There are many tools, including AI-powered solutions, that can help in detecting and stopping phishing attacks, but the key to stopping them lies in adequate education including the knowledge of using cybersecurity tools optimally.

Conclusion

Phishing may have evolved by incorporating technologies and new tactics, but cyber defenses have similarly leveled up. People just need to keep up by getting more cybersecurity education and adopting habits that foil schemes aimed at taking advantage of people’s carelessness and disregard for security policies and best practices.