Humans are still better at creating phishing emails than AI — for now

AI-generated
phishing
emails,
including
ones
created
by
ChatGPT,
present
a
potential
new
threat
for
security
professionals,
says
Hoxhunt.

Amid
all
of
the
buzz
around
ChatGPT
and
other
artificial
intelligence
apps,
cybercriminals
have
already
started
using
AI
to
generate
phishing
emails.
For
now,
human
cybercriminals
are
still
more
accomplished
at
devising
successful
phishing
attacks,
but
the
gap
is
closing,
according
to
security
trainer

Hoxhunt’s
new
report
released
Wednesday.

Phishing
campaigns
created
by
ChatGPT
vs.
humans

Hoxhunt
compared
phishing
campaigns
generated
by
ChatGPT
versus
those
created
by
human
beings
to
determine
which
stood
a
better
chance
of
hoodwinking
an
unsuspecting
victim.

To
conduct
this
experiment,
the
company
sent
53,127
users
across
100
countries
phishing
simulations
designed
either
by
human
social
engineers
or
by
ChatGPT.
The
users
received
the
phishing
simulation
in
their
inboxes
as
they’d
receive
any
type
of
email.
The
test
was
set
up
to
trigger
three
possible
responses:

1. 
   Success:
   The
   user
   successfully
   reports
   the
   phishing
   simulation
   as
   malicious
   via
   the
   Hoxhunt
   threat
   reporting
   button.
2. 
   Miss:
   The
   user
   doesn’t
   interact
   with
   the
   phishing
   simulation.
3. 
   Failure:
   The
   user
   takes
   the
   bait
   and
   clicks
   on
   the
   malicious
   link
   in
   the
   email.

The
results
of
the
phishing
simulation
led
by
Hoxhunt

In
the
end,
human-generated
phishing
mails
caught
more
victims
than
did
those
created
by
ChatGPT.
Specifically,
the
rate
in
which
users
fell
for
the
human-generated
messages
was
4.2%,
while
the
rate
for
the
AI-generated
ones
was
2.9%.
That
means
the
human
social
engineers
outperformed
ChatGPT
by
around
69%.

One
positive
outcome
from
the
study
is
that
security
training
can
prove
effective
at
thwarting
phishing
attacks.
Users
with
a
greater
awareness
of
security
were
far
more
likely
to
resist
the
temptation
of
engaging
with
phishing
emails,
whether
they
were
generated
by
humans
or
by
AI.
The
percentages
of
people
who
clicked
on
a
malicious
link
in
a
message
dropped
from
more
than
14%
among
less-trained
users
to
between
2%
and
4%
among
those
with
greater
training.

SEE:


Security
awareness
and
training
policy

(TechRepublic
Premium)

The
results
also
varied
by
country:

• 
  U.S.:
  5.9%
  of
  surveyed
  users
  were
  fooled
  by
  human-generated
  emails,
  while
  4.5%
  were
  fooled
  by
  AI-generated
  messages.
• 
  Germany:
  2.3%
  were
  tricked
  by
  humans,
  while
  1.9%
  were
  tricked
  by
  AI.
• 
  Sweden:
  6.1%
  were
  deceived
  by
  humans,
  with
  4.1%
  deceived
  by
  AI.

Current
cybersecurity
defenses
can
still
cover
AI
phishing
attacks

Though
phishing
emails
created
by
humans
were
more
convincing
than
those
from
AI,
this
outcome
is
fluid,
especially
as
ChatGPT
and
other
AI
models
improve.
The
test
itself
was
performed
before
the
release
of
ChatGPT
4,
which
promises
to
be
savvier
than
its
predecessor.
AI
tools
will
certainly
evolve
and
pose
a
greater
threat
to
organizations
from
cybercriminals
who
use
them
for
their
own
malicious
purposes.

On
the
plus
side,
protecting
your
organization
from
phishing
emails
and
other
threats
requires
the
same
defenses
and
coordination
whether
the
attacks
are
created
by
humans
or
by
AI.

“ChatGPT
allows
criminals
to
launch
perfectly
worded
phishing
campaigns
at
scale,
and
while
that
removes
a
key
indicator
of
a
phishing
attack
—
bad
grammar
—
other
indicators
are
readily
observable
to
the
trained
eye,”
said
Hoxhunt
CEO
and
co-founder
Mika
Aalto.
“Within
your
holistic
cybersecurity
strategy,
be
sure
to
focus
on
your
people
and
their
email
behavior
because
that
is
what
our
adversaries
are
doing
with
their
new
AI
tools.

“Embed
security
as
a
shared
responsibility
throughout
the
organization
with
ongoing
training
that
enables
users
to
spot
suspicious
messages
and
rewards
them
for
reporting
threats
until
human
threat
detection
becomes
a
habit.”

Security
tips
or
IT
and
users

Toward
that
end,
Aalto
offers
the
following
tips.

For
IT
and
security

• Require
  two-factor
  authentication
  or
  multi-factor
  authentication
  for
  all
  employees
  who
  access
  sensitive
  data.
• Give
  all
  employees
  the
  skills
  and
  confidence
  to
  report
  a
  suspicious
  email;
  such
  a
  process
  should
  be
  seamless.
• Provide
  security
  teams
  with
  the
  resources
  needed
  to
  analyze
  and
  address
  threat
  reports
  from
  employees.

For
users

• Hover
  over
  any
  link
  in
  an
  email
  before
  clicking
  on
  it.
  If
  the
  link
  appears
  out
  of
  place
  or
  irrelevant
  to
  the
  message,
  report
  the
  email
  as
  suspicious
  to
  IT
  support
  or
  help
  desk
  team.
• Scrutinize
  the
  sender
  field
  to
  make
  sure
  the
  email
  address
  contains
  a
  legitimate
  business
  domain.
  If
  the
  address
  points
  to
  Gmail,
  Hotmail
  or
  other
  free
  service,
  the
  message
  is
  likely
  a
  phishing
  email.
• Confirm
  a
  suspicious
  email
  with
  the
  sender
  before
  acting
  on
  it.
  Use
  a
  method
  other
  than
  email
  to
  contact
  the
  sender
  about
  the
  message.
• Think
  before
  you
  click.
  Socially
  engineered
  phishing
  attacks
  try
  to
  create
  a
  false
  sense
  of
  urgency,
  prompting
  the
  recipient
  to
  click
  on
  a
  link
  or
  engage
  with
  the
  message
  as
  quickly
  as
  possible.
• Pay
  attention
  to
  the
  tone
  and
  voice
  of
  an
  email.
  For
  now,
  phishing
  emails
  generated
  by
  AI
  are
  written
  in
  a
  formal
  and
  stilted
  manner.

Read
next:


As
a
cybersecurity
blade,
ChatGPT
can
cut
both
ways

(TechRepublic)