Inside the New Era of AI-Driven Cyber Threats

The rapid democratization of generative artificial intelligence has transformed the corporate landscape, offering unprecedented gains in efficiency and productivity. However, these powerful tools are a double-edged sword. Cybercriminals are leveraging the exact same technologies to scale their operations, lower technical barriers to entry, and execute highly sophisticated social engineering campaigns.

To help organizations navigate this evolving threat landscape, Nate, Director of Cybersecurity at CIT Solutions, recently hosted a deep-dive session on how threat actors use AI and what businesses must do to build resilience.

The Shift in Cybercrime Economics: Speed, Scale, and “Vibe Coding”

AI has dramatically lowered the cost and skill barrier for cyberattacks. Threat actors now use generative AI to automate target reconnaissance, translate phishing lures with flawless grammar, and generate functional malware code in seconds—shifting cybercrime from a manual effort to an automated, high-volume numbers game.

Before the advent of generative AI, executing a highly targeted cyberattack required significant manual labor. Crafting a convincing, personalized phishing email took time, and developing functional malware required deep programming expertise. Today, cybercriminals operate like modern businesses, prioritizing efficiency, return on investment (ROI), and speed.

With AI, the cost of generating a highly tailored phishing lure has dropped to a fraction of a cent. Furthermore, the rise of “vibe coding”—where individuals with zero programming background use AI to generate functional software—has extended to the dark web. Attackers now use specialized, malicious large language models (LLMs) like WormGPT and FraudGPT to write command-and-control (C2) proxy code and remote tunnel scripts in seconds.

To combat this automated code generation, organizations must deploy robust endpoint defenses. Solutions like Threatlocker provide zero-trust application blocklisting, ensuring that only pre-approved, safe software can execute on your network, while SentinelOne uses behavioral AI to detect and halt malicious processes in real time.

Advanced AI Phishing Attacks and Open-Source Intelligence (OSINT)

Modern cybercriminals leverage advanced AI tools to parse massive amounts of public data, scraping social media and corporate websites in minutes. This automated open-source intelligence (OSINT) allows attackers to craft highly contextualized, hyper-targeted phishing lures that easily trick traditional security filters and human targets alike.

In a recent live security training session, Nate demonstrated the terrifying speed of AI-driven reconnaissance. Using an AI assistant, Nate initiated an automated open-source intelligence (OSINT) scan on a target organization. Within ten minutes, the AI scraped the company’s website, public social media profiles, and news releases to map out:

• The names and roles of key executives (CEO, CFO, and department heads).
• Active supplier and vendor relationships.
• The company’s primary customer base.
• Recent public events or conferences attended by staff.

In the past, security awareness training taught employees to look for broken grammar and spelling mistakes as telltale signs of a phishing attempt. AI has completely eliminated those indicators. An attacker can now instantly translate a phishing lure into any language with flawless syntax and perfect cultural context.

For example, an employee named Priya might receive an email that appears to come from a known vendor, referencing a specific industry expo she attended the previous week. The email establishes immediate rapport, references real context, and requests a routine update to payment remittance details. Because the email lacks traditional red flags, it is highly likely to succeed without advanced defensive measures.

Deepfakes and Voice Cloning: When Seeing and Hearing is No Longer Believing

Generative AI has made real-time voice cloning and video deepfakes highly accessible and convincing. Cybercriminals use these technologies to impersonate executives and family members, bypassing traditional authentication methods and leading to catastrophic financial losses through high-pressure, emotionally manipulative social engineering campaigns.

Perhaps the most alarming escalation in AI cybersecurity threats is the use of deepfake audio and video. Using only a few seconds of recorded audio—often harvested from public webinars, YouTube videos, or corporate presentations—threat actors can clone an individual’s voice with near-perfect accuracy.

This is not a hypothetical threat; it is actively occurring in the wild:

• The $25 Million Video Conference Heist: A UK-based engineering firm, Arup, was targeted in a highly coordinated attack. An employee was tricked into attending a video conference call with what appeared to be their Chief Financial Officer and several colleagues. In reality, every other participant on the call was a real-time video and audio deepfake. The employee was convinced to authorize multiple transactions, resulting in a $25 million loss.
• The WhatsApp Executive Impersonation: An employee at LastPass received an urgent, after-hours WhatsApp message accompanied by a five-minute deepfake voice memo claiming to be the company’s CEO. Fortunately, the employee recognized the unusual communication channel, paused, and flagged the message to their internal security team, successfully thwarting the attack.

These incidents demonstrate that traditional visual and auditory verification are no longer sufficient. Organizations must establish strict out-of-band verification protocols for any high-privilege action.

Real-World Threat Case: The Real-Time Deepfake “Wage Mole”

Nation-state threat actors are now using real-time deepfake audio and video to pass remote job interviews. Once hired, these “wage moles” deploy hardware-based remote access tools to infiltrate corporate networks, using AI translation tools that introduce slight response delays during live interactions.

CIT Solutions recently investigated a highly sophisticated insider threat for a client. The organization had grown suspicious of a newly hired remote employee. Although the individual had successfully passed the video interview process, their daily interactions felt unusual.

During the investigation, CIT discovered that the employee was a “wage mole”—a foreign national working on behalf of a nation-state threat actor. The physical laptop shipped to the employee had been connected to an internet-enabled Keyboard-Video-Mouse (KVM) switch, allowing a remote hacker in another country to control the device entirely.

When managers conducted voice calls with the employee, they noticed a consistent one-to-two-second delay before the employee responded. The employee’s answers were technically flawless, but the timing was unnatural. The investigation revealed that the attacker was routing the live audio through an AI-powered, real-time voice translation and cloning application to impersonate the identity of the person hired during the interview.

This case highlights the critical need for modernized human resources (HR) onboarding practices, such as requiring remote hires to present physical identification on camera or conducting localized, third-party identity verification checks.

Building an AI-Aware Defensive Strategy: Actionable Steps for Your Business

Defending against AI-powered threats requires a multi-layered approach combining strict financial validation policies, phishing-resistant multifactor authentication (MFA), comprehensive data classification, and continuous security awareness training to empower employees as active defenders.

To build systemic resilience against AI cybersecurity threats, businesses must move beyond basic security tools and implement a comprehensive defense-in-depth strategy.

Implement Out-of-Band Financial Validation

Establish a rigid policy for verifying financial transactions, payroll adjustments, and wire transfers. Any request to alter payment details—regardless of whether it comes via email, text, or a voice call—must be verified through a secondary, pre-established communication channel. For instance, if an email request is received, the employee must call the vendor using a trusted phone number already on file, not the number listed in the suspicious email.

Deploy Phishing-Resistant MFA and Passkeys

Traditional multifactor authentication (MFA) that relies on SMS text codes or voice calls is highly vulnerable to AI-driven interception and social engineering. Organizations should transition to phishing-resistant MFA, such as Microsoft Authenticator number matching, FIDO2 hardware security keys, or biometric passkeys. By utilizing tools like LastPass to securely manage and store corporate credentials, you ensure that even if an employee is tricked by a deepfake, the attacker cannot harvest a usable password.

Classify Data to Restrict AI Access

Generative AI tools are only as powerful as the data they can access. If your organization is adopting internal AI tools like Microsoft Copilot, you must ensure your data is properly structured. Use data classification tools, such as Microsoft Purview sensitivity labels, to mark highly sensitive files, intellectual property, and personally identifiable information (PII). This prevents internal AI agents from indexing or exposing restricted data to unauthorized users.

Empower Your Workforce with Knowbe4 Training

Your employees are your most critical line of defense. Rather than viewing them as a security risk, empower them to act as active sensors for your organization. Implement continuous security awareness training through platforms like Knowbe4 to educate staff on the realities of voice cloning, deepfakes, and high-context phishing. When employees feel supported and trained, they are significantly more likely to pause, verify, and report suspicious activity.

Start This Week

Securing your business against AI-driven threats can feel overwhelming, but you can take immediate, low-effort steps to drastically reduce your risk profile:

1. Define Your AI Toolset: Clearly identify which AI tools (e.g., Microsoft Copilot, Claude, ChatGPT) are authorized for business use. Provide official, enterprise-licensed accounts to prevent employees from using free, unsecured versions that train on your proprietary data.
2. Conduct a Financial Process Audit: Review your current accounts payable and payroll workflows. Ensure that any transaction above a specific threshold (e.g., $10,000) requires dual authorization and out-of-band verification.
3. Update Your Incident Response Plan: Ensure your incident response procedures account for AI-specific scenarios, such as executive impersonation via deepfake audio or suspected remote employee identity fraud.

Sign up for the full series webinar here.

Sources:

Arup Deepfake Incident
LastPass Deepfake Attempt
NIST AI Risk Management Framework