Imagine receiving an email informing you that your bank account has been temporarily suspended, another alerting you about an undelivered package, and a third telling you that you’ve won a gift card. Each message includes a link asking you to provide your personal information. At first glance, these emails may seem legitimate, but they’re not. They’re perfect examples of social engineering—a sophisticated toolkit of manipulation tactics designed to deceive individuals and extract sensitive information for illicit purposes. With the advent of generative artificial intelligenceThese deceptive strategies have not only proliferated but also evolved in complexity, making them increasingly difficult to detect.
Target phishing attacks, a widespread form of social engineering, Phishing attacks traditionally require extensive research on the intended victim. This costly and laborious process was largely manual, which naturally limited the frequency of such attacks. However, the emergence of generative artificial intelligence now makes it possible to automate these preparatory steps, enabling the execution of targeted phishing campaigns on a large scale. According to a report by the American cybersecurity firm ZscalerPhishing attacks leveraging generative AI increased by 60% globally between January and December 2023.
Furthermore, there is another key question: Generative AI enables immediate creation of messages that appear legitimate and are more likely to deceive victims: emails, calls and text messages that appear to come from legitimate entities, such as a social network, bank or government institution.
How does AI affect phishing?
The Internet allows fraudsters to strike without revealing their physical presence, which reinforces their sense of security. In addition, the digital landscape offers many opportunities for task automation, which allows cybercriminals to effortlessly target a large number of potential victims with minimal effort.
As businesses and individuals increasingly embrace digitalization, Social engineering tactics on the Internet have evolved in parallelWhat began as email scams known as “phishing” has expanded to a variety of new channels. Scammers have adapted their techniques to exploit instant messaging social media and systems (“SMiShing”), “Lost” USB sticks left as bait (‘baiting’), phone calls (“vishing”) and, more recently, QR Codeswhich are now widespread in physical and digital spaces (“QRishing”).
Over time, social engineering attacks have become significantly more sophisticated. Mass emails with generic content have evolved into highly targeted campaigns. These attacks now target specific groups, using carefully crafted messages that resonate with the intended audience, making the deception much harder to detect.
Phishing Attacks are sometimes disguised as messages from legitimate contacts or mimicked to look like authentic processes within a victim’s organization, a tactic known as targeted phishingAlthough it only accounts for 0.1% of all emails sent, spear phishing is alarmingly effective. responsible for 66% of all security breaches, According to a report by the American security company Barracuda.
As a result, cyberattacks in Spain have increased dramatically. By 2023, the country recorded a staggering 107,777 incidents, marking a 94% increase from 2022, according to a report from Spanish National Cryptology Center (CCN). Therefore, cybersecurity has become the primary concern of 48% of Spanish companiesleading them to increase their budgets for IT professionals by an average of €4.7 million, as reported by the Hiscox Cyberpreparedness Report.
The targets of social engineering have also evolved significantly over time. Initially, attackers sought to obtain easily monetizable information, such as banking passwords, or to directly trick victims into making payments. However, as systems for verifying user identity, such as biometrics, have improved, the goal has changed. Today, attackers are increasingly aiming to install malware on a victim’s devicegranting them control and access to perform a wide range of malicious activities.
