Social engineering manipulates people into disclosing information, granting access, or taking actions that benefit an attacker. In generative-AI-enabled attacks, language models make deception more scalable, fluent, personalized, and difficult to detect. section 5.1 section 5.2
Phishing and Business Email Compromise (BEC) are established forms of social engineering. Large language models (LLMs) can gather public information, adjust tone, and produce many tailored messages quickly, lowering the effort needed to target specific people or organizations. section 5.2
Generative AI changes the human layer of cyberattacks by:
- Generating convincing phishing and impersonation messages at low cost. section 5.2
- Supporting intrusion workflows from reconnaissance through message creation and execution. section 5.2
- Combining social manipulation with prompt injection, jailbreaks, or tool access that can produce unintended actions and wider harm. section 10.10
A targeted phishing test
In a 2023 test, Claude and GPT-4 helped a researcher without a cybersecurity background gather public data, create 1,000 targeted emails for $10, and run a simulated campaign in under three hours. The example illustrates scale and accessibility, not guaranteed success. section 5.2
Figure 5.1 Leveraging LLMs for targeted spear-phishing attacks [10]
Shows how language models support targeted spear-phishing through public-data gathering, personalization, and message generation. section 5.2
