Frank Costa, President of NEXGEN Protection Services on Phishing Threats:
As AI-powered tools become more accessible, phishing threats are aon the rise. Attackers are increasingly targeting multiple channels to bypass security measures, beginning with phishing emails that contain links to video meetings featuring a deep fake.
Phishing attacks are becoming increasingly sophisticated, making it essential for organizations to assess their vulnerability. Hackers now have access to advanced AI-powered tools that enable them to craft email messages, create malicious payloads, and even generate deep fakes. These technologies—and the cyberattacks they facilitate—are more accessible than ever, particularly as cybercriminals tap into the growing “Crime as a Service” (CaaS) ecosystem. Providers now sell everything from attack tools to pre-packaged phishing kits designed to bypass native defenses and secure email gateways (SEGs).
Threat actors can leverage AI at every stage of a phishing attack, from speeding up the intelligence-gathering process on potential targets to automating the creation and distribution of highly personalized attacks. The use of AI accelerates and scales up attack creation, allowing even less-experienced cybercriminals to launch sophisticated campaigns.
Impersonation attacks are another common tactic. The most frequent form involves attackers posing as the recipient’s company, accounting for 16% of phishing emails. The Human Resources (HR) department is often impersonated in these attacks. Cybercriminals also use platforms like LinkedIn, company websites, and news announcements to identify new hires at target organizations. These newly hired employees are then targeted in impersonation and social engineering attacks. New employees are frequently the victims of phishing emails impersonating VIPs, particularly in CEO fraud schemes.
To strengthen defenses, organizations can adopt best practices that help build a “human firewall.” The first step is to understand and communicate what constitutes normal behavior for brands and suppliers, which can aid in detecting impersonation. Organizations should also standardize and validate communication channels, especially for roles like HR and IT. Finally, companies should assess their vulnerability to supply chain and vendor-based compromises.
Source:
Alger, J. (February 20, 2025). Mobile Phishing Threats Are Evolving, According to New Research. Security Magazine.