AI-powered phishing emails target corporate executives with scraped personal data
Cybersecurity experts are warning of a rising trend of AI-powered phishing scams that use scraped personal data from public profiles to craft highly personalized emails targeting corporate employees. These advanced attacks reportedly bypass traditional email filters and are harder to detect than conventional phishing attempts, with major companies like Beazley and eBay alerting the public to the threat.
What happened
Scammers are using AI to scrape information from public profiles and social media to generate hyper-personalized phishing emails targeting corporate employees. The AI bots analyze online profiles to determine interests and employer information, then compose emails that mimic the writing style of legitimate companies.
The personalized emails appear to come from trusted sources like banks, email providers, or family and friends, making them far more convincing than traditional mass phishing attacks. Leading companies including British insurer Beazley and ecommerce group eBay have warned of the rise of these fraudulent emails containing personal details obtained through AI analysis of online profiles.
Reported impact
The highly personalized phishing emails are more likely to evade email filters created by corporations and providers like Apple and Google. According to US Cybersecurity and Infrastructure Security Agency data cited by the Financial Times, over 90% of successful breaches start with phishing messages.
Corporate employees are the main targets of these attacks, though experts warn the same techniques will likely be used against consumers. Kirsty Kelly, chief information security officer at Beazley, stated: 'This is getting worse and it's getting very personal. We're starting to see very targeted attacks that have scraped an immense amount of information about a person.'
Index analysis
The availability of generative AI tools lowers the entry threshold for advanced cybercrime, allowing bad actors to easily create more personalized and convincing emails that appear to be from trusted sources. Experts warn these attacks are expected to grow in sophistication and frequency.
Email security defenses at Gmail, Outlook, and Apple Mail do not yet have adequate protections to stop these attacks. The human interaction element of social engineering combined with AI's technological capabilities makes mitigation harder unless users reduce their public online presence.
Governance controls
The main safeguard against phishing attacks is for users to never click links sent in emails and instead use their own bookmarks or type in known URLs. Security experts recommend that users bolster online account protections and reduce what they post online.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.