Bot her emails: most modern phishing campaigns are AI-enabled Give a man a phishing kit and he might get lucky a couple of times; teach an AI to phish and it'll change the landscape, if KnowBe4's latest phishing trends report is accurate. The cybersecurity and phishing awareness outfit released the seventh edition of its Phishing Threat Trends report on Thursday, and it appears that the …
Not!
I get 2-3 phishing emails every month, fortunately most of them are obvious phishing as I have a relatively small number of regular clients, but I can see that larger organisations might well be taken in by AI crafted phishing emails.
i'm totally unsurprised that scammers have discovered the "benefits" of AI for their activities.
No need to bother with scam emails if you've already got the payment details on file!
At what point does the internet become effectively unusable for a large number of people i.e. the ones who are basis users and not computer geeks?
The majority of businesses rely heavily on emails and I'll give the example of one of my recent customers (a large international organisation) which sells a particular range of products to a wide range of industries (in bulk) and retail outlets. They have a UK sales team of about 20 people plus a technical support team which provides advice to both commerical and domestic end users. They recently endured a phishing campaign that went on for several weeks with PDF or similar attachment in credible looking messages from a range of customers and users.
In the end anything that contained a link or an attachment was automatically quarantined until it was verified by the IT support team as being a genuine message. Some of the messages were fairly easy to spot due to mis-spellings and obviously fake names (Waine Joens, Filip Blenkenship etc) but others were more subtle e.g. 'I am using your product to do this but it isn't working properly, Please give me some advice' usually with a PDF or similar attachment.
Needless to say that a number of genuine enquiries were delayed in getting through and the IT team were working overtime.
It has eventually slowed to a trickle but it's clear that the attacks are getting more sophisticated.
I am lucky that I have a limited number of clients (about 20) and that I also have my data backed up onto external spinning rust drives that are only connected during the backup process but I feel for anyone who has to deal with messages from a whole range of people.
We are a "larger organisation" (more than 150k employees worldwide) and yeah, in spite of all the phishing education, the spam, scam, phishing etc filters, something gets responded to by an end user and they're usually relatively obviously dodgy (to me at least)
The AI campaigns can be quite scarily convincing and the good ones I've seen have had me wondering if it's genuine or not.
If there's lots of Teams phishing and Outlook Calendar compromises, that's M$ and people not being critical about what they receive via email and texts.
I don't use any of that. My Apple calendar is filled out manually. Automating the process doesn't do anything for me as it would fill up my calendar with useless entries in record time. I haven't worked for The Man in a long time so I've been spared exposure to anything Teams, Skype or Zoom. I also deleted the messaging app on my phone as I've found Text to be a waste of time. I can exchange more information, more efficiently in a short voice call than through texting.
If I get a message purporting to be from somebody I know, I follow up on the immediate question of why they are emailing me when we always talk by phone. I also discourage anybody from sending me unexplained links and will trash any that come in without clicking on them just as I toss out any food that I'm a bit concerned isn't safe. It's a cheap way to avoid expensive problems.
* Communicating in a noisy environment
* Delivering status or info which doesn't require a response from the messaged person
* Avoiding pointless, time-wasting, two-way voice comms with people who won't stay on relevant topics, who are long-winded, and who do not value your time. Sometimes these are your bosses.
"* Delivering status or info which doesn't require a response from the messaged person"
If that works for you, great. I have no need of it.
If I'm in a noisy environment, I will step aside someplace more quiet. If it's not important enough for a voice call, for me, it's just not important.
I have no problem staying on-topic and keeping others on topic. What I've found harder is getting people to answer questions in full and precisely enough when they used Text. If I sent 3 questions, I'd get back an ambiguous yes/no that didn't satisfy any of the questions. I could spend more time working on how I crafted my questions to guide people to providing the answer I need or I could just get them on the phone and handle it in far less time so I can get on with the things I need to get on with. I can even have a discussion with somebody while doing the dishes or looking up information I might need while we are on the phone since that often needs to be folded into the discussion.
In a perfect world, Text might work for me. The issue I have is that the people I had interacted with through Text could not understand what information I needed and it would take ages to illicit that info from them rephrasing the question in many different ways until something clicked.
Texting, "I rebooted RHB0335. Console messages say the DB engine is running. --Joe" is much-faster than walking through the corridors of a large air-conditioned building with racks of noisy servers, badging through several doors, calling your boss from the security foyer, then turning around, and walking back.
(Sorry, the edit window closed.)
Finding a mate you were planning to meet at a large, swarms-of-people event (concerts, sporting events, faires, etc.) can be impractical with voice comms, as the noise field is so wide-area you have to leave the venue to hear and be heard, and tickets to get back inside can be expensive and/or sold-out. (T&Cs I've frequently read state, "No re-entry".)
All that said, sometimes the topics and conversants are such that texts and/or emails, no matter how-carefully constructed, simply do not work.
"If I sent 3 questions, I'd get back an ambiguous yes/no that didn't satisfy any of the questions"
I suspect at least one my colleagues of treating this as some kind of game, & we end up in loop with me composing ever more precise and detailed follow-up messages, while in my head "look, you know what info I'm after" is playing on repeat.
Neither of those things are about Microsoft. Teams phishing isn't any different from Slack phishing or any other internal messaging system. Calendar invitations are the same whether they're going to Outlook or something else, and they work as long as the email-to-calendar connection is automatic* which is very common in business because manually managing all the invitations virtually guarantees that something will get missed unless you're lucky enough to have a job where events don't get created all the time by many different people.
* The systems I'm aware of tend to mark calendar invitations that came from external addresses and warn about them, but they still appear on the calendar unless you delete them.
See title. I can imagine sending out some messages after a company account has been compromised, but before that? Teams is a pretty bad messaging platform but the company domain was also perhaps the only one where I did not encounter any spam or similar nastiness, ever.
will be the thing that pushes email into signed messages or some other drastic change. I'd even be good with charging senders 1/2c for each email, me included. If postage in the US will be a buck in no time, charging 1/2c doesn't seem like a budget buster if it can clean up email. Imagine how much society would save if instead of 99% spam-phish/1% valid becomes 99% valid/1%spam-phish. And I'm even ok with the ISP getting the money if it eliminated 90% of the spam. Or maybe do a split, ISP be 1/4c and receiver gets 1/4c. Until it costs money to send poo, the poo will be to the rafters.
"I'd even be good with charging senders 1/2c for each email"
That would be hacked in no time and the only ones paying that rusty half credit will be the honest folk.
I expect it would have to be much more than 1/3c just to cover the billing in such a scheme. A friend of mine that had a metal stamping shop would give me washers I used in some of my products as his company was set up for really huge volumes and the billing would equal the cost of the washers if he charged me. I fixed his audio gear for his band as a trade. He, in turn, probably wrote off the inventory discrepancy as "shrinkage". With a barrel holding a stated 1mn washers, a couple thousand is no big deal.
This post has been deleted by its author
