Huntress Demonstrates How AI Can Enhance Phishing, Smishing and Vishing
Summary
A Huntress episode recap shows how AI can help create convincing phishing, smishing, and vishing attacks, including voice-cloning demonstrations, and recommends MFA-protected authorization for sensitive actions.
Key points
- Huntress researchers demonstrated how a basic prompt with names, job titles, companies, and vendors could produce a convincing phishing email in about five minutes.
- The article says LLMs can help attackers scale social engineering, translate messages, and sustain convincing SMS conversations.
- In a voice-cloning demonstration, the team used about 2 MB of audio—roughly 70 seconds—to create a close copy of a known voice within minutes.
- The article describes cloning legitimate landing pages and using MFA-capture tools such as Evilginx as additional phishing tactics.
- It cites a $25 million heist involving deepfaked video and cloned voices to persuade a finance worker to make a wire transfer.
- For sensitive actions such as fund transfers, the article recommends authorization through a portal with MFA enabled.
Article Details
- Topic
- AI-assisted phishing, smishing, and vishing techniques, including voice cloning, cloned landing pages, and MFA capture.
People
Products
ChatGPTChatGPT and other AI tools now empower threat actors with a dynamic level of flexibility, allowing them to adapt phishing, smishing, and vishing well beyond previous limitations.ElevenLabsIn a short vishing demo using AI, Kain reviewed an exercise using inexpensive programs like ElevenLabs to adapt known voices—like that of Huntress CEO and co-founder Kyle Hanslovan.
Tools
EvilginxFrom using landing page delay to leveraging MFA capture with programs like Evilginx, this lightning round of demos serves as a cautionary tale for organizations navigating reduced cybersecurity budgets in a worldSingleFileWith tools like SingleFile, attackers can now convert these pages into cloned versions that act as the perfect accessory to add to the “AI-powered” tacklebox of tools.