Artificial intelligence is making it increasingly easy to scam people online. With remarkable ease ethical hacker Inti De Ceukelaire managed to create a phishing platform using AI. “Until recently, you needed quite a bit of technical knowledge to do that. Now anyone can do it in just a few minutes.”
Home News
How do you recognise AI phishing after ethical hacker creates phishing tool using AI in minutes?
Colin Clapson
Published:
In less than half an hour, De Ceukelaire was able to have Claude, Anthropic’s latest AI model, create a complete phishing page.
“Until recently, you needed quite a bit of technical knowledge to do that. Setting up a phishing campaign sometimes took days or weeks. Now anyone can do it in minutes,” he told VRT.
From Nigerian princes to personalised scams
In the past, everyone received the same phishing emails, like those from a so-called Nigerian prince asking for money. Most people can now spot these. But thanks to new AI applications, scammers can now make their emails much more personalised.
“An AI system can scan your social media and see, for example, that you like football. You then receive a phishing email that directs you to a fake website supposedly selling tickets for the World Cup. Such hyper-personalised pages used to be far too expensive for fraudsters to create.”
Why AI models fail
AI models are not designed to carry out illegal tasks. Initially, they will refuse to create a phishing tool. But these safety mechanisms turn out to be surprisingly easy to circumvent.
“If you ask the model to place a large warning on the page, supposedly to protect users, it will create one after all,” explains De Ceukelaire.
“If then, at the end, you ask it to remove the warning, the system simply does so.” That’s how you end up with a working phishing tool. It takes less than half an hour.
How to recognise AI-powered phishing
How can you, as a user, protect yourself against these new forms of phishing? According to De Ceukelaire, it is particularly important to learn to recognise the use of artificial intelligence. He offers a few tips.
Look out for the long dash ‘—’. This comes from English texts and is virtually never used in Dutch, yet AI systems are keen to use it. If you see such a dash, there is a good chance the text was written by AI.
Websites created by AI often look blue or purple.
There is often a green dot at the top of an AI website with text next to it.
AI systems use a lot of emojis, which you don’t normally see on professional websites.
And Inti De Ceukelaire’s most important tip: be critical, don’t click without thinking, and certainly don’t pay any deposits without checking the website.