Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Attackers Are Using AI for Social Engineering
Transcript
- Lucas: So it's May 2026, and we've been talking about AI transforming cybersecurity for years. But there's a shift happening right now that doesn't get enough attention — attackers are using generative AI for social engineering, and it's working disturbingly well. Luna: You mean beyond the typical phishing email with bad grammar? I've seen those — they're almost comically easy to spot. Lucas: Exactly. The old phishing playbook relied on volume and hope. But now, with tools like GPT-4 and voice cloning, attackers can craft personalized, context-aware messages that sound exactly like your boss or your vendor. And they're doing it at scale. Luna: Right, and if today's conversation helps you think about your own defenses a little differently, that's exactly why we do this. These conversations stay ad-free because of listener support — buy me a coffee dot com slash fexingo. Just a simple way to keep the show going. Lucas: Yeah, it's been great to hear from listeners who find these practical angles useful. So back to the attacks — let's talk about a specific case that happened just a few months ago. Luna: What's the story? Lucas: Mid-sized financial services firm in London. An employee in accounts payable gets a phone call. It's the CEO's voice — slightly rushed, says he's in a meeting, needs an urgent wire transfer to a new vendor. The employee had been trained to verify such requests, so she hangs up and calls the CEO back. Luna: But the CEO doesn't answer? Or he denies it? Lucas: He answers, says he didn't call. So the employee thinks it's all fine. Except the initial deepfake voice call had already planted a seed. Two days later, she receives a follow-up email — from what looks exactly like the CEO's address — referencing the call, apologizing for the confusion, and repeating the request. This time, she complies. Luna: Wow. So they layered the attack. Voice then email, making it seem like a real back and forth. Lucas: Exactly. And they cloned the CEO's voice from public earnings call recordings. You can pull those off any investor relations page. The email had zero spelling errors, perfect tone, even a realistic signature block. The employee lost the company about $600,000 before it was caught. Luna: And that's not even the most advanced example. I've read about attacks that use real-time deepfake video on Zoom calls. Lucas: Right. There was a case last year where a finance worker in Hong Kong thought they were on a video call with their CFO and several colleagues — all deepfakes. They authorized $25 million in transfers. The technology is evolving faster than most companies' training programs. Luna: So what's the click-through rate on these ai generated phishing emails? I've seen a number floating around. Lucas: The latest data from a KnowBe4 study this quarter shows that ai generated phishing emails have a click-through rate of 32 percent. Compare that to traditional phishing, which is around 3 percent. That's a tenfold increase. And those clicks often lead to credential harvesting or malware installation. Luna: So the old advice — look for spelling mistakes, hover over links — is basically obsolete. Lucas: Completely. Attackers are now using AI to scrape your LinkedIn profile, your company's internal communications if they've breached a less sensitive system, even your calendar to time the email when you're likely distracted. It's hyper-personalized. Luna: How are companies fighting back? Surely there's a counter ai arms race. Lucas: There is. One approach is using AI to detect ai generated text. Some email security vendors now analyze linguistic patterns — things like sentence length variance and word choice entropy — to flag machine-generated content. But it's a cat and mouse game. Luna: Is that enough? Or do we need to rethink the human element entirely? Lucas: That's the big question. Some firms are moving toward 'zero trust' for human communication too. That means every request for sensitive action must be verified through a separate, pre-agreed channel — like a phone call to a number you already know, not one from the email signature. Luna: So the old 'call back' advice still works, but only if the call is to a number you already trust, not one from the suspicious message. Lucas: Exactly. And some companies are adopting 'verified channels' — internal apps where you can send a one-time verification code. If your CEO says 'wire this money,' you don't just trust the voice or email. You open the company app and check for a matching request there. Luna: That's a culture shift, though. It requires executives to accept being questioned. Lucas: It does. But the cost of not doing it is becoming clear. The FBI's Internet Crime Report for 2025 showed that business email compromise losses exceeded $3 billion — and that's almost certainly underreported. The deepfake layer only accelerates that trend. Luna: What about the smaller companies that can't afford advanced AI detection tools? Are they just sitting ducks? Lucas: They're more vulnerable, but there are low-cost measures. Simple things like publishing a clear 'no verbal or email-only authorization' policy. Training staff to use code words for urgent requests. Some firms implement a mandatory 24-hour hold on any transfer above a threshold. That alone can break the attack chain. Luna: Because the attacker wants urgency. They want you to act before you think. Lucas: Exactly. The deepfake call creates panic. The follow-up email creates confirmation bias. If you introduce a mandatory cooling-off period, you remove the urgency weapon. Luna: I've also heard about 'social engineering red teaming' where companies hire ethical hackers to test employees with ai generated attacks. That seems like a smart training tool. Lucas: Yeah, it's becoming standard practice. You simulate the attack in a safe environment, so employees learn what to look for without real losses. The best programs then turn those employees into 'human sensors' — they become part of the detection system, reporting suspicious messages rather than just ignoring them. Luna: That's a more empowering approach than the old 'you failed the phishing test' shame game. Lucas: Absolutely. Security culture matters. If people feel they'll be punished for being tricked, they'll hide mistakes. But if they're rewarded for reporting, you catch attacks earlier. Luna: Let's talk about the future. How good will these deepfake attacks get in the next year or two? Lucas: Scarily good. Voice cloning already requires just a few seconds of audio. By next year, real-time video deepfakes on consumer hardware will be convincing enough to fool most people. We're heading toward a world where you cannot trust your eyes or ears. Luna: So the solution has to be process-based, not perception-based. Lucas: Exactly. The authentication has to happen outside the communication channel. That's why physical tokens, biometrics, and out-of-band verification are becoming critical. The human brain is the weakest link, but you can design systems that protect it. Luna: One last thought — are regulators paying attention? I know the FTC has been looking into AI fraud. Lucas: They are. In March, the FTC proposed new rules requiring companies to disclose when a customer interaction is ai generated. But enforcement is tough. The attacks are borderless, and the technology is open source. I think corporate policy will have to move faster than regulation. Luna: So the burden is on businesses to adapt their own processes. Lucas: It is. And the first step is just acknowledging that the old rules of trust no longer apply. If your CEO calls sounding urgent, you should still verify — because it might not be them.