As industries across the board pivot towards AI, two things are becoming increasingly clear. On the one hand, there’s the potential for an unprecedented increase in productivity and innovation. On the other hand, AI is rapidly reshaping the cyber threat landscape. The present and future success of your business hinges on a keen awareness of the latter.
Related: Get More AI Insights at DualMedia News
Here are the five emerging threats to watch.
- LLM-Powered Phishing and Social Engineering Scams
AI isn’t only introducing new threats but revitalizing old ones to an astonishing degree. Phishing is a well-known threat that is straightforward to recognize and ignore. However, telltale signs like empty threats, transparent requests for clicking on malicious links, and the broken English many were written in are no more.
Attackers have embraced large language models and are combining them with extensive research into their targets to create convincing and highly effective phishing campaigns. The emails aren’t just grammatically correct now — they adapt to the context of the industry and the person they’re meant for. Such an email could liberally use industry jargon and even adopt an executive’s writing style if enough data is available for the model to train on.
Continuous employee training that accounts for rapid changes in phishing tactics will help them identify, verify, and report such scams before they can cause financial and reputational damage.
Additionally, companies may need to engage best data removal services to curb the amount of information available on their C-suite, middle managers, and other noteworthy employees whose profiles and mannerisms could be exploited to add credibility to phishing scams.
- The Rise of Vishing
Generative AI’s breakneck development has reached a point where even attentive humans are finding it hard to tell fabricated video and audio from the real thing. This lends itself well to the explosive rise of vishing or voice phishing, a scam in which attackers pose as higher-ups and ask employees to authorize money transfers or provide confidential information. Finance, healthcare, and government institutions are particularly at risk.
CrowdStrike’s latest Global Threat Report revealed that vishing attacks grew by a disconcerting 442% in the latter half of 2024 alone. Solutions are already being developed that can analyze and determine if a voice or video message is really a deepfake. Even so, such tools need to be bolstered by policies that prescribe employee behavior and additional checks they should perform when responding to sensitive requests.
- Shadow AI’s Impact on Information Security
Familiarity with AI tools is spreading and poised to become a fundamental part of employee skill sets across industries. Problems arise when overzealous employees start using unsanctioned tools that can adversely impact different aspects of business operations.
Sensitive data exposure comes to mind first. Samsung’s engineers famously used ChatGPT to check proprietary code for errors. It’s reasonable to assume that less tech-savvy employees will be even more likely to commit similar IP breaches and compliance violations.
AI use will only grow, so the best recourse is to tackle it proactively. Vet trustworthy AI providers and encourage employees to use their tools instead of taking matters into their own hands.
- Credential Attacks at Scale
Phishing remains the most successful method for obtaining credentials without authorization. However, hackers are also leveraging machine learning and deep learning advances to automate and expand the effectiveness of password guessing.
Leaks like RockYou2024 provide billions of real-world compromised passwords as training data. Models that use this data excel at brute force attacks since they account for the most common patterns. However, they can also make educated guesses based on industries or regional specifics that are more likely to succeed.
Luckily, business password managers remain an effective countermeasure. The passwords they generate are complex and unique without following discernible parties. Encrypted storage ensures password safety, while role-based access controls limit employee access to sensitive accounts without impacting productivity.
VPN for iphone are another worthwhile precaution, especially for remote employees. They encrypt any active internet connection, ensuring that no one who could be monitoring it gains access to the data that employees exchange. This could include proprietary information and account credentials they type in manually.
- Cyberattacks by AI Agents
The last threat we’ll touch on is also among the most concerning.
Even though they are largely automated and increasingly sophisticated, cyberattacks are still carried out by humans. However, the speed at which AI agents are developing suggests they’ll be able to identify weak targets, plan attacks, and execute them while making real-time changes to adapt to existing countermeasures. Cybercriminals aren’t leveraging this technology yet, but since it’s demonstrably feasible, it’s only a matter of time.
Criminals might drive such malicious innovation, but cybersecurity expert solutions are never far behind. We are likely in for battles between agents that try to breach cyber defenses and those who protect them, which will play out on timescales incomprehensible to humans, hopefully with favorable results.
