The techniques used for identifying phishing threats have been developed for another time. In 2024, AI makes the cost problem disappear for hackers, and most of the existing defense mechanisms are not tailored for this. An analysis by an IT specialist of the changes that have occurred, their causes, and what needs to be done today.
Phishing detection, for the most part of the past decade, was a pattern matching challenge. Teach a machine learning model with known malicious URLs, flag any suspicious domains for the senders, look out for keyword patterns that might indicate credential harvesting in emails.
It made perfect sense at that time when phishing attackers did not have many sophisticated methods. They relied on reused infrastructure. They misspelled things. They used the same lure templates for thousands of campaigns.
This age is long gone.
In 2024, I witness a fundamental shift in the way phishing campaigns are organized, and most detection solutions implemented within enterprise networks is simply not prepared to cope with that change. Threat intelligence sources catch yesterday’s campaigns.
Heuristic engines are optimized to detect attackers who belong to another age. The difference between what defenders can detect and what attackers can do has silently reached enormous proportions.
It is not about a new kind of vulnerabilities. It is not about a new exploitation technique. The driving force behind the change is the availability of large language models and fast adoption by criminals.
WHAT AI HAS ACTUALLY CHANGED AND WHAT IT HAS NOT
There is a variant on this discussion where the threat gets overstated. AI-generated phishing attacks are not magic. They do not subvert technical defenses in themselves.
The phishing emails are still delivered, the URLs they contain are still resolved, and the infrastructure used is still able to remain off-blocklist long enough to grab credentials. All these practical difficulties have not been negated by the arrival of GPT-4 to the public space.
What is different is the economics of the attack.
Previously, a successful targeted spear-phishing attack would require an investment from the attacker. The research on the target, the construction of the relevant lures, the translation to the language of the target, the creation of various permutations to beat signature-based defenses this would all take time and effort.
In 2024, that hurdle no longer exists.
Anyone with a ChatGPT account can now generate thousands of convincing phishing emails faster than I can analyze them. What keeps cyber defenders up at night is the variation problem of a lure, which would be nearly identical but would vary slightly to avoid being detected by means of signatures and similarities.
AI has not made phishing more advanced from a technical perspective; it has made phishing industrially scalable. The cost of a well-crafted campaign has plummeted from hours of labor to seconds of automated generation.
THE THREE ATTACK VECTORS I AM WATCHING MOST CLOSELY
- Contextual lure generation from OSINT
What all the most successful phishing attacks I have observed over the last eighteen months have in common is that they make some kind of reference to a specific context.
They do not say “Your account has been suspended,” but rather refer to something which can be verified as genuine. A recent project. An individual whom the recipient knows. A document title that is in keeping with recent presentations made by the target.
This new attack vector sees the attackers using an LLM to generate a contextual lure that passes the initial credibility check of an experienced analyst reviewing a suspicious email. The question “Would I know this information if I was not targeting this individual?” used to catch most spear-phishing emails, but it doesn’t catch these anymore.
The takeaway for security professionals is that generic user training based on looking out for generic signs such as “Suspicious sender. Suspicious urgency. Suspicious attachment.” is now fundamentally lacking in coverage. Users must be trained to look out for contextual phishing.
2. Redirect chains with multiple stages bypassing URL reputation mechanisms
URL reputation mechanisms operate based on the idea that malicious infrastructure will have a certain history. A newly registered domain, one that never saw any activity before and hosting the credential page the indicator of the malicious intent. It gets marked by URL reputation systems, added to the list of blacklisted sites and blocked.
In 2024, attackers systematically bypass this mechanism using redirect chains involving several steps. The redirect chain starts with a trusted infrastructure, a legitimate link to Google Docs, goes through a hacked WordPress site and a hidden redirector, and ends with the credential harvesting page.
At the point of landing at the malicious destination, the URL reputation mechanisms have already gone through at least three or four redirects, all of them legitimate.Implications for detection are considerable.
The detection problem in such an environment is difficult because point-in-time URL scanning, even with multiple layers of URL scans, cannot easily handle this sort of infrastructure since the malicious endpoint is never presented to the scanner but to the user following successful authentication through the redirect chain.
In some ways, this influenced the detection architecture implemented in the CyberScan threat analysis platform, particularly the detection of redirects and the domain entropy layer.
I have seen campaigns where a benign Google Docs URL starts the process and ends up on a credential harvesting webpage using a four-hop redirect chain, all starting with completely benign hops.
3. Voice-based and multi-vector social engineering
Phishing is becoming more than an e-mail issue. Some of the most effective phishing attacks that I have seen for credential compromise in 2024 start with e-mail but finish the trick through multiple vectors, such as a follow-up text message, a WhatsApp message with an impersonated phone number, and even, in some instances, a phone call using artificially generated voices to mimic a co-worker or technical support representative.
The problem is that each of these channel interactions, when considered on its own, has very little risk. A request for verification via email may seem suspect.
A request for verification via email, followed up by a WhatsApp message from someone you know, followed up by a phone call from your IT admin, all add up to create enough trust that any training against such attacks fails. These are spread out over multiple channels because the attackers don’t want any single channel to be examined.
Right now, enterprise security departments are analyzing each of these channels separately. Email security. Mobile device management. VoIP logging. The information is there; it’s just not being pieced together. That’s what I think will define the next generation of enterprise phishing defence.
WHY YOUR THREAT INTEL FEED IS ALREADY OUT OF DATE
Most commercial threat intelligence feeds work under the detection-then-share paradigm. There is an attack, there is infrastructure, there are indicators of compromise found, and these indicators are shared out to their subscribers.
The delay between attack and dissemination is typically hours or days. This works well for the commodity attacks with persistent infrastructure.
For AI-powered phishing attacks, the infrastructure rotation rate is such that the indicator-based approach simply doesn’t work anymore. I have seen examples of campaigns where the phishing domain was registered, utilized, and then dropped within a four-hour timeframe.
By the time that the domain made its way into any threat intelligence feed, the campaign was finished and the infrastructure was dropped.
The solution is not in feeding speed alone. It needs to transition from indicator-based to behavioral and structural detections that this URL demonstrates structural features of phishing webpage regardless of whether it has been seen previously.
Such detections as domain entropy scoring, homograph detection, redirects chain analysis, brand impersonation pattern recognition all these detections are indicator-independent and hence remain effective even for the infrastructure with no history whatsoever.
This is how the future direction should be headed for threat intelligence tooling in 2024 and beyond. Not big blocklists but more advanced structure analysis to classify new infrastructure according to its structure and not its past.
Campaigns seen in 2024 where phishing infrastructure is registered, utilized and abandoned in a span of 4 hours completely bypassing indicator-based detection engines whose time frame is hours to days.
WHAT SECURITY TEAMS SHOULD ACTUALLY DO RIGHT NOW
The below recommendations are made based on observations of live campaigns during 2024 and not from vendor frameworks or threat modeling exercises.
- Use AI-driven lures for your phishing campaigns simulations. If your phishing simulation program still utilizes template-driven lures that can be recognized easily by users through their telltale signs, then you are preparing your users against last year’s attack techniques.
- Conduct at least one phishing campaign simulation per quarter using LLM to create contextually relevant lures based on OSINT gathered about your staff. This will make them feel uncomfortable – this is the desired effect.
- Detect the full redirect chain. If your email gateway/proxy does not scan URL links for malware when redirect chains are involved, this means that you are missing detection capability here. In most cases, enterprise URL scanners do not follow the chain of redirects by default. Audit your configuration against this capability.
- Correlate across all communication channels. If you are logging and investigating email, SMS, and voice separately, you won’t catch multi-channel campaigns. Just a simple correlation rule that flags anyone receiving an external email and an external phone call within 30 minutes is a start towards finding campaigns you currently are missing.
- Do not use click rate to measure phishing resilience. If someone clicks an AI-created lure on what appears to be a trustworthy website, they’re not failing the training program – they have faced a completely new threat. It’s vital to measure this and communicate this to leadership because it shifts the narrative away from blaming users and toward architecture investment.
THE HONEST ASSESSMENT
AI has not made phishing attacks undetectable. The signs that set malicious infrastructure apart from legitimate infrastructure remain observable in domain registration patterns, redirect patterns, hosting patterns, URL composition patterns. Attackers can be detected.
It just takes better technology than most organizations are currently using, and it takes a shift from the reactive and indicator-driven approach to the proactive and structural approach.
The threat actors using AI to generate attacks are doing so because it allows them to increase the efficiency of their attack and make it larger in scope. They are no more sophisticated today than they were three years ago – they are just automating what used to be manual. The solution to that is automating the analysis, getting rid of the lag problem, and not depending on users catching attacks that should never have happened.
The coming year will see whether the defensive tools evolve fast enough to catch up. Based on my observations of campaigns happening right now, that timeline is not going to be comfortable.
Author bio: Jordan Nicholas is a cybersecurity analyst specializing in threat intelligence and enterprise phishing defence. He is the developer of CyberScan, built multi-layer threat analysis platform. He has been featured in TechPoint, Daily Times Nigeria, and The Nigeria Standard.
