Yes and also, interestingly, this tool takes all of the most commons steps used to hack people & companies — from OSINT (open source intelligence) via social media, to target selection, to pretext development, to contact + phishing — and automates it completely for attackers.
https://twitter.com/savannahfeder/status/1890487425425711566
Imagine an attacker uses this tool to seek out people discussing their anger about working at a specific company they are employed by (rather than for its intended purpose of finding competitor’s users who are complaining), seeks those individuals out in an automated fashion, and delivers a believable and potent phishing lure via automated message.
Sure, this tool can be used for marketing but it can also be used for highly targeted phishing campaigns, and phishing is how many hacks begin.
Sure, this tool can be used for marketing but it can also be used for highly targeted phishing campaigns, and phishing is how many hacks begin.
You may be thinking, but Rachel, don’t tell these criminals what to do! You must remember that cyber criminals are smart — this is their job and they are good at it. They don’t need me telling them how to think about hacking with an AI tool, they are experts themselves.
So what can we do to stay safe?!
- For companies building AI tools that automate tasks that can be used for phishing: work with ethical hackers (you can find them at @defcon) and ensure you understand how your tool can be used for nefarious purposes, and how to spot it and shut it down programmatically on your end.
- For companies building AI tools that automate tasks that can be used for phishing: work with ethical hackers (you can find them at @defcon) and ensure you understand how your tool can be used for nefarious purposes, and how to spot it and shut it down programmatically on your end.
So what can we do to stay safe continued…
- For defenders at orgs whose employees can be targeted with tools like this: educate your team on how to spot and shut down these lures, not just via email, but also on social media, DMs, calls, etc AND require the right MFA for their threat model + password manager to limit the impact of your users falling for an AI automated targeted phishing campaign
- For defenders at orgs whose employees can be targeted with tools like this: educate your team on how to spot and shut down these lures, not just via email, but also on social media, DMs, calls, etc AND require the right MFA for their threat model + password manager to limit the impact of your users falling for an AI automated targeted phishing campaign
So what can we do to stay safe continued again
- For everyday folks and their families: communicate to your family and friends that these types of AI automated targeted phishing campaigns will likely increase via social media comments and DMs in addition to the ever present hacking attempts via email, calls, texts, etc. Help them imagine their threat model, show examples like this, help them turn on MFA and use a password manager or passkeys to limit attack impact.
- For everyday folks and their families: communicate to your family and friends that these types of AI automated targeted phishing campaigns will likely increase via social media comments and DMs in addition to the ever present hacking attempts via email, calls, texts, etc. Help them imagine their threat model, show examples like this, help them turn on MFA and use a password manager or passkeys to limit attack impact.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
