Artificial intelligence (AI) is enabling threat actors to send unholy volumes of fraudulent emails, personalized to a degree that mass emailers of old couldn't have touched.
Last month, Microsoft researchers tracked a phishing campaign in which an unattributed threat actor sent out more than one million emails in just three days. Despite the volume of content they had to juggle, the threat actor managed to specifically target relevant accounts payable departments and lightly personalize each message with the real names of targeted employees' executive leadership, most likely through serious assistance from AI. A few other bells and whistles, too, made the emails much more convincing than your average Automated Clearing House (ACH) fraud scam.
Personalized Mass Phishing
The basic premise of the emails was that victims' companies owed just shy of $50,000 to the enterprise cloud services company ServiceNow for an annual subscription. Attached invoices were detailed — with credible line items and dollar amounts that didn't add up to round numbers — and featured visual elements and branding true to the impersonated company.