A sales director in India for tech security firm Zscaler got a call seemingly from the company’s chief executive. As his cellphone displayed founder Jay Chaudhry’s picture, a familiar voice said “Hi, it’s Jay. I need you to do something for me,” before the call dropped. A follow-up text over WhatsApp said, “I think I’m having poor network coverage as I am traveling at the moment. Is it okay to text here in the meantime?” The caller asked for help moving money to a bank in Singapore. Internal investigators found that scammers had reconstituted Chaudhry’s voice from clips of his public remarks in an attempt to steal from the company. At a cybersecurity conference, Zscaler cited AI as a factor in the 47 percent surge in phishing attacks it saw last year. Crooks are automating more personalized texts and scripted voice recordings while dodging alarms by going through such channels as encrypted WhatsApp messages on personal cellphones. Disinformation is harder to spot, security researchers said, the Washington Post reports.
Experts fear that attackers will use artificial intelligence to write software that can break into corporate networks in novel ways, change appearance and functionality to beat detection, and smuggle data back out through processes that appear normal. “It is going to help rewrite code,” National Security Agency cybersecurity chief Rob Joyce warned the conference. The result will be more believable scams, smarter selection of insiders positioned to make mistakes, and growth in account takeovers and phishing as a service, where criminals hire specialists skilled at AI. Scammers will use the tools for “automating, correlating, pulling in information on employees who are more likely to be victimized,” said Deepen Desai, Zscaler’s chief information security officer. Phishing awareness programs, which many companies require employees to study annually, will be pressed to revamp. On a more positive note, ransomware, while not going away, has stopped getting dramatically worse. The U.S. government has been sharing timely and useful information about attacks, this year warning 160 organizations that they were about to be hit with ransomware.