MINNEAPOLIS–In yet another worry for credit union IT and risk management professionals, a new report shows artificial intelligence can now beat human red teams in crafting phishing attacks at scale.
Even more worrying, according to cybersecurity training firm Hoxhunt, which conducted the tests, AI can beat humans with “alarming success.”
The company is reporting that its proprietary AI spear-phishing agent, code-named JKR for Joker, during a March test outperformed human counterparts by 24%, a turnaround from a 31% deficit in 2023 when Hoxhunt ran a similar test.
“It’s a Skynet moment for social engineering,” the company said in a blog post, referencing the AI villain from the Terminator franchise. “We’ve proven that AI agents can create superior spear-phishing attacks at scale.”
According to Hoxhunt, JKR’s edge comes from its ability to fine-tune its prompts and outputs in real time.
Specific Contexts
“This iterative mechanism allowed the AI to adapt to user-specific contexts like role and location, generating hyper-personalized emails for millions of enterprise users,” the company stated.
Hoxhunt is now forecasting that phishing-as-a-service market will soon shift to mass adoption of AI spear-phishing agents, and once that happens, the baseline quality and effectiveness of mass phishing campaigns will rise to a level currently equated with targeted spear-phishing attacks.
Earlier in March, the non-profit Anti-Phishing Working Group reported an increase of global phishing emails during the second half of last year after a lull during the previous six months, according to Data Breach Today.
A Million Dedicated Sites
“During the last three months of 2024 alone, the APWG said it detected nearly a million dedicated phishing sites,” the analysis noted. “U.S. authorities have repeatedly warned residents against a surge over the past year of smishing texts purporting to come from a road toll collection service – although the non-profit said the Chinese scammers behind the campaigns haven’t invested much energy in selecting their targets.”
