Hacking Humans with AI-as-a-Service
Singapore government researchers construct an automated spear-phishing pipeline powered by OpenAI's GPT-3 API, comparing AI-generated phishing to human campaigns.
Summary
The Weaponization of Large Language Models
The emergence of AI-as-a-Service (AIaaS) APIs—such as OpenAI's GPT-3—enables generating convincing, context-aware synthetic text at massive scale and minimal cost.
Constructing an Automated AI Spear-Phishing Pipeline
Eugene Lim, Glenice Tan, and Tan Kee Hock build an end-to-end automated phishing pipeline that scrapes target OSINT data and generates hyper-personalized phishing emails.
Empirical Comparative Testing Against Human Phishers
In controlled authorized testing across hundreds of subjects, the AI-generated phishing emails achieved click-through rates rivaling and occasionally exceeding expert human social engineers.
Defensive Verification in the Age of Synthetic Content
The authors discuss defensive countermeasures, automated linguistic anomaly detection, and training programs to prepare organizations for AI-driven deception.
Related talks
Village Presentations·52 min
Ian Harris
UC Irvine professor Ian Harris demonstrates using Natural Language Processing (NLP) and syntactic parsing to automatically detect social engineering intent.
Main Stage·43 min
Keanu Nys
Demonstrates how red teams can abuse legitimate Microsoft login branding parameters and OAuth endpoints to host convincing, high-trust phishing infrastructure.
Main Stage·36 min
Harrison Sand · Erlend Leiknes
Analyzes the evolution of enterprise phishing defense and demonstrates novel reverse-proxy adversary-in-the-middle tradecraft to bypass modern authentication.