According to the IBM X-Force 2025 threat intelligence index, threat actors are today, on average, larger and wider campaigns than they have done in the past. This development is partly a question of tactical change, as many attackers have moved their attention to the attacks of the supply chain which affect many victims at the same time.
But it is also a question of changing tools. Many attackers have adopted a generative AI such as an trainee or an assistant, use it to create websites, generate malware and even write phishing emails. In this way, AI helps actors threaten to make more attacks in less time.
“AI models really help attackers to clean their messages,” says Carruthers. “Make them more succinct, making them more urgent – to make them in something for which more people fall.”
Carruthers points out that bad grammar and awkward phrase turns has long been among the most common red flags in phishing attempts. Cybercriminals tend not to be assiduous with spelling verification, and they often write in the second and third languages, leading to a higher volume of errors overall.
But generative AI tools can generate technically perfect prose in almost all major languages in the world, hiding some of the most obvious social indications and deceiving more victims.
AI can also write these messages much faster than a person cannot. Carruthers and the X-Force team have had some experiences and found that the generator can write an effective phishing email in five minutes. For a team of humans to write a comparable message, it takes approximately 16 hours, with in -depth research on the targets representing a large part of this time.
Also consider that Deepfake technology allows AI models to create false images, audio and even video calls, lending additional credibility to their patterns.
In 2024 only, the Americans lost 12.5 billion dollars to phishing attacks and other frauds. This number could increase as more scams use a generative AI to create more convincing phishing messages, in addition to languages, in less time.
And with the arrival of AI agents, fraudsters can still evolve their operations.
