The ease of access to AI tools and their relative power means that cyber attackers can craft realistic-enough phishing messages in text, and increasingly, voice and video.
Given that phishing, like spam, is a ‘numbers game’, bad actors can automate their attacks on many thousands of targets, with each attack of a higher quality than would have been possible just three or four years ago.
Credential phishing remains the primacy vector, but any attack that involves an element of social engineering has been made significantly easier to create. That means smaller campaigns can yield the results hackers want, and not necessarily trip any alarms organisations may have set to spot large-scale activity.
The weakest link remains the people in an organisation, whether they’re socially-engineered at home or in the workplace. And the line of thought that staff training is the best way to avoid the pitfalls of phishing isn’t born-out by objective data from independent academic and governmental studies (it tends to be the commercial suppliers of training that produce stats showing positive reductions in phishing incidents after training).
Although traditional, rule-based filtering has been the subject of some criticism (not fit for purpose, relatively static, based on spam-era technology), its unsuitability for the age of the AI-equipped bad actor is especially relevant.
Behavioural analysis, a reassessment of tooling around cybersecurity, XDR platform exploration (extended detection and response), and MFA are the current focus of many cybersecurity professionals. These are among the elements due to be discussed in KnowBe4’s upcoming webinar, ‘Your Best Defense Against 2025’s Most Dangerous Phishing Attacks‘.
The 2025 problem
The problems posed by ‘smart-phishing’ are on the rise this year, with many rogue messages identical in tone, vocabulary, and phrasing to the original. In a single documented breach, a finance worker at Arup was deceived into authorising a fraudulent HK$200 million ($25.6 million) transaction after attending a video-conference call during which fraudsters used deepfake technology to impersonate the company’s UK-based chief finance officer.
Cybersecurity Dive reported in February this year that over 60% of major breaches in the first quarter of 2025 came from credential harvesting. Careful impersonation of the people whose identity was stolen is now just a few mouse clicks away.
Phishing ‘kits’ available on the dark web now include CAPTCHA evasion, and can be hosted on mainstream cloud infrastructure, meaning they can continue operating for several days before being blacklisted. At a time when automation is simpler than ever, even a few dozen hours of operating is enough for bad actors to target thousands with crafted, individualised phishing messages.
DNS spoofing techniques and automatic, verbatim reproduction of bogus companies’ online presence add to phishing sites’ seeming authenticity, so there are fewer red flags raised in victims’ minds as they proceed to, effectively, give away the family silver. Even standard, usually effective measures like MFA can prove no defence; as gangs have been found to be exploiting so-called ‘MFA fatigue’ and SIM-swapping techniques to get around the final, human-controlled hurdles.
Tune in to find out more
These issues and their implications in 2025 are the subject of discussion KnowBe4’s upcoming webinar, ‘Your Best Defense Against 2025’s Most Dangerous Phishing Attacks‘. It’s a timely event as organised criminals appear to have finessed many techniques around phishing, using the advanced technology that’s available to anyone online.
And while cybersecurity teams and bad actors continue their endless game of cat and mouse, the first few months of this year seem to show that the phishing gangs are, for now at least, on the front foot. Join us on 15 May 2025 at 2pm ET to learn how to regain the front foot in the cybersecurity war.
