Traditional social engineering relied on human deception—phishing emails, pretexting, baiting, and impersonation. With the advent of AI and machine learning, attackers have enhanced these techniques, increasing their effectiveness and reach.

Phishing remains the most common form of social engineering, and AI now enables attackers to make their messages even more convincing.

How AI enhances phishing:

• AI analyzes social media and email patterns to generate messages that appear legitimate.
• Automated tools can send mass phishing emails while adapting to responses in real time.
• Phishing messages used to be distinguishable by bad grammar and spelling errors, but attackers can use AI to generate their messages and avoid these red flags.

Example: Fast-developing technology gives hackers ability to craft ‘perfect’ fraudulent emails (ft.com, 2025)

Deepfake technology allows attackers to create realistic videos and audio recordings, which can be used for fraud, impersonation, and misinformation campaigns.

Key concerns:

• Deepfake audio and video can impersonate executives or colleagues, making fraudulent requests more convincing.
• Synthetic identities created for fraudulent activities.
• Manipulation of video evidence or media for disinformation.

Example: A UK-based energy company lost €220,000 after an employee was convinced by a deepfake CEO voice call to transfer funds (WSJ, 2023).

Example: In 2023, cybercriminals used AI-generated voice deepfakes to trick employees into transferring millions to fraudulent accounts (Forbes, 2023).

Attackers use AI-driven bots to automate social engineering attacks, scraping personal data from online sources to craft targeted attacks.

How it works:

• AI collects data from LinkedIn, Facebook, and other platforms to tailor spear-phishing attacks.
• AI chatbots engage with victims in real time, mimicking human interactions to extract credentials.
• Malicious AI-generated websites appear indistinguishable from legitimate ones.

Example: Threat actors used AI chatbots to pose as IT support staff, tricking employees into resetting their passwords (Cybersecurity & Infrastructure Security Agency, 2024).

BEC scams involve attackers impersonating executives, suppliers, or trusted entities to manipulate employees into making financial transactions or sharing confidential data.

How AI improves BEC attacks:

• AI-generated emails mimic writing style and tone.
• Machine learning refines tactics based on previous successful scams.
• Automated voice and video calls make impersonations more convincing.

Example: A parts supplier to Toyota was manipulated into paying over $37 million into fraudulent bank accounts. TripWire

While AI has empowered cybercriminals, organizations can still mitigate these risks through proactive security measures.

• Educate staff on AI-driven threats and red flags.
• Conduct phishing simulation exercises.
• Promote a culture of verification—always double-check requests, especially financial transactions.

• Require multiple authentication layers to prevent unauthorized access.
• Avoid SMS-based MFA as these can be compromised; instead use app-based authenticators or hardware tokens.
• Regularly review access controls.

• Use AI-driven threat detection to spot anomalies in communication.
• Deploy email filtering and anti-phishing tools powered by machine learning.
• Implement continuous authentication techniques (e.g., behavioural biometrics).

• Never circumvent traditional financial controls and use email as verification. Instead use an additional method (e.g., phone confirmation or in-person requests) to verify high risk requests).
• Train employees to be skeptical of urgent or unusual requests.
• Use digital signatures and encryption for critical communications.

Social engineering has evolved from traditional phishing emails to AI-powered deception. As attackers leverage AI to refine their tactics, businesses must stay ahead by combining technology with cyber security awareness. The key to defence lies in education, verification, and the strategic use of AI-driven security measures.

Iron Spear can help you implement advanced security solutions to stay ahead of cybercriminals.