KnowBe4’s Phishing Threat Trends Report Volume Seven shows that 86 percent of phishing attacks are driven by AI. Cybercriminals are shifting their focus from email to calendars and collaboration tools, making phishing a multichannel threat.
Phishing continues to evolve and poses a greater challenge to businesses today than ever before. According to the latest report from KnowBe4, based on data from more than three thousand threat actors, AI is playing an increasingly important role in phishing campaigns. Furthermore, attackers are combining different communication channels to bypass security and deceive users.
The classic phishing email is no longer the only weapon for cybercriminals. The use of AI is giving rise to new forms of attack, with calendars and collaboration tools such as Microsoft Teams increasingly becoming targets. The scale and efficiency of these attacks are increasing significantly.
Personalized phishing
AI is enabling a new generation of phishing attacks that are both scalable and personal. While phishing used to target large groups, attackers now generate personalized messages using public data. This allows for the creation of completely unique phishing emails tailored to the victim, also known as polymorphic phishing.
This development makes it harder for companies to recognize phishing in time. The messages are more convincing and harder to distinguish as fraudulent, increasing the likelihood of successful attacks.
Deepfake
On top of that, attackers are using deepfake audio and video to make live conversations more credible. Researchers estimate that AI attacks are up to seven times more efficient than traditional methods. A recent study by ACFE and SAS shows that deepfake fraud is increasing sharply. For instance, 77 percent of respondents reported an increase in deepfake social engineering over the past two years.
Beyond the inbox
Cybercriminals are increasingly targeting channels other than email. According to the report, phishing via calendar invitations increased by 49 percent in the last six months. Malicious .ics files allow attackers to automatically place appointments in calendars, exploiting the implicit trust people have in their schedules. As a result, employees are quicker to click on invitations than on suspicious emails.
Microsoft Teams is also being used more frequently by attackers, with a 41 percent increase in the last six months. Due to the informal nature of Teams, users respond faster and less critically, making it easier for attackers to build trust and manipulate victims step-by-step.
KnowBe4 recently launched a phishing button in Microsoft Teams where users can report suspicious messages with a single click.