While phishing attacks have plagued businesses for years, today, they are far more sophisticated, with attackers using AI-generated voices, chatbot impersonation and advanced personalisation to trick recipients. In this post, we explore the emerging phishing tactics being used by cybercriminals and explain how to recognise and defend against them.<\/p>\n
Phishing has become one of the most pernicious cyber threats facing businesses today. According to Astra Security<\/a>, 3.4 billion phishing emails are sent every day. In terms of impact, they are involved in 92% of data breaches<\/a>, 45% of ransomware attacks<\/a> and 94% of malware infections<\/a>.<\/p>\n While we primarily associate phishing with email, cybercriminals are now using a wider range of channels, from voice calls and text messages to live chat and app login popups. Many are also using AI, with some so realistic they can fool even experienced users.<\/p>\n Phishing tactics now include:<\/p>\n One of the most dangerous new trends is the use of cloned voices in phone scams. Simply by finding a short clip from a podcast or social media video, attackers can use AI to convincingly recreate someone\u2019s voice.<\/p>\n Scammers will search for and clone the voices of company executives and use them to send urgent calls or voice messages to internal staff, authorising payments or asking recipients to share access <\/a>credentials.<\/p>\n The accuracy of the cloned voices means protocols need to be put in place to verify unusual requests. Employees also need to be trained to spot them.<\/p>\n AI chatbots, a common feature of many websites, are now being deployed on fake sites where they pose as customer support. Able to engage users in realistic conversations, they craftily collect usernames, password or payment details from unsuspecting users.<\/p>\n Employees should be trained to spot signs of <\/a>malicious chatbots, such as redirecting to third-party sites or requesting sensitive data without context.<\/p>\n Are you taking advantage of chatbots? Read: Human vs AI Chatbot for Website Support: Which Is Best?<\/a><\/strong><\/em><\/p>\n Consent phishing involves tricking users into granting third-party apps access to their data via OAuth (Open Authorisation protocol). This usually occurs when users click on a \u2018Login with Google\u2019 or \u2018Connect your Microsoft account\u2019 button from a phishing page.<\/p>\n As many legitimate apps use OAuth, victims think they are just logging in. However, with content phishing, they are authorising a rogue app to access emails, files or cloud storage, and enabling permissions that can remain even after a password reset.<\/p>\n To protect against this, businesses should limit the types of apps that can be connected to corporate <\/a>accounts, audit OAuth permissions, and train staff to verify login screens before authorising access.<\/p>\n How secure is your website? Read: Defending Your Website: A Security Checklist for Site Owners<\/a><\/strong><\/em><\/p>\n With employees getting better at spotting phishing emails, cybercriminals have begun to use generative AI tools, like ChatGPT, to create messages that are fluent, persuasive and highly targeted and which don\u2019t have spelling mistakes, poor formatting or badly spoofed visuals. Moreover, they feed existing messaging from brands into the AI so that it accurately recreates brand voice and communication style guides.<\/p>\n When targeting businesses, attackers will also scrape social media and company websites to add personal details, such as job titles, managers\u2019 names or project <\/a>information \u2013 all of which increases the success rate.<\/p>\n Staff should be wary of messages that create urgency, use personal details unexpectedly or which contain unusual links or attachments.<\/p>\n Protecting your business from phishing requires a layered approach that combines smart tools with staff training and clear processes.<\/p>\n Given that credential theft is a major goal for phishing attacks, multi-factor authentication (MFA) is essential to prevent cybercriminals from getting access, even if a user\u2019s password is compromised. This should be enforced across all accounts.<\/p>\n Regular training and simulated phishing tests are valuable in helping employees recognise suspicious messages and reacting to them appropriately. Importantly, training should include emerging phishing tactics, so users know how to spot new methods of attack.<\/p>\n Businesses should also control third-party app access, particularly those that use OAuth. As part of this, admins should monitor which apps have been authorised and block access where appropriate.<\/p>\n To protect recipients of your outgoing emails, you should also configure your domain with SPF, DKIM and DMARC records. <\/a>These protocols verify that the emails are genuinely from your business and thus reduce the chance of spoofed emails reaching customer inboxes.<\/p>\n For more information, read: How to Implement DMARC for Google and Yahoo Compliance<\/a><\/strong><\/em><\/p>\n A reliable hosting provider can help protect you and your customers against phishing attacks and lessen the impact of malware and data breaches if an attack is successful. These protections include:<\/p>\n Smarter and more convincing, today\u2019s emerging phishing tactics now include AI-crafted emails, cloned voice calls, fake chatbots and spoof app logins. Moreover, with Phishing as a Service kits widely available, even amateur cybercriminals are able to launch sophisticated attacks. However, by educating staff, tightening access controls and login security, and choosing secure hosting, you can keep your business protected from the scammers.<\/p>\n At Webhosting UK, our hosting plans are built with security in mind. From spam protection and SSLs to automated backups and malware detection, we provide the infrastructure to keep your site and your staff better protected. For more information about our hosting solutions, visit our homepage<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" While phishing attacks have plagued businesses for years, today, they are far more sophisticated, with attackers using AI-generated voices, chatbot impersonation and advanced personalisation to trick recipients. In this post,…<\/p>\n\n
Deepfake voice phishing<\/strong><\/h3>\n
AI chatbots used in phishing attacks<\/strong><\/h3>\n
Consent phishing via authorisation abuse<\/strong><\/h3>\n
AI-enhanced phishing emails<\/strong><\/h3>\n
Defending against sophisticated phishing<\/strong><\/h3>\n
Protection from your hosting provider<\/strong><\/h3>\n
\n
Conclusion<\/strong><\/h3>\n