Cybersecurity experts warn of rising AI-generated phishing scams targeting all ages

Tech experts are warning about a troubling trend of using AI platforms in phishing scams.

Tech experts are sounding the alarm about a troubling trend of bad actors utilizing AI platforms to generate thousands of realistic phishing emails in seconds.

Mohammed Jowkari, a cybersecurity student at BCIT, said people close to him have received phishing emails that appeared legitimate—and at least one was fooled into clicking on the scam.

“The reason they fall for it is because AI was able to bypass Gmail’s spam folder,” Jowkari told CTV News.

These new phishing emails are not just targeting the elderly, Jowkari explained, but also more tech-savvy Gen Z individuals.

Jowkari demonstrated how ChatGPT could be used to create a phishing email. While his first attempt was blocked by the platform, with a revised prompt the AI not only helped “create the phishing email, it actually created a full website as well,” he said.

By leveraging these AI platforms, bad actors can cast a wider net, increasing the probability of someone clicking on a fraudulent link.

“If you give it 24 hours, you can send over 10,000 emails,” Jowkari stated.

Varonis, a data security company, has reported an “unprecedented surge in attack volume,” including a 202 per cent increase in phishing messages over a period of six months—blamed on the use of AI.

Mike Agerbo, a tech expert, said he wasn’t surprised that AI-generated phishing emails can penetrate spam filters. “They’ve got all the background of our human scams and spam, and they essentially use that to create human-sounding emails that can bypass many filters,” Agerbo explained.

Contacted for comment by CTV News, Google said Gmail blocks “99.9 per cent of spam, phishing and malicious messages from reaching inboxes.”

“We continually update and evolve our protections to stay ahead of attackers, including deploying groundbreaking AI defenses that quickly spot and neutralize new phishing tactics,” the company said in a statement. “To augment these strong defenses, we strongly encourage users to enable two-step verification and adopt passkeys, which are both effective protections against phishing.”

Agerbo reiterated that with the rapid evolution of AI, it’s challenging for any tech company to keep pace: “The scammers are always using the latest tools and getting better at it. Tech companies are, you know, playing catch-up, trying to get ahead of the game.”