AI-powered OSINT lowers the barrier for mass victim profiling, making ordinary users viable fraud targets
ESET's WeLiveSecurity warns that AI and large language models (LLMs) now automate OSINT reconnaissance at machine speed. Profiling that once took a skilled attacker hours or days can be done by low-skill actors, so ordinary internet users are now economically viable fraud targets. Fraudsters can collect public information at scale, including images and video, to personalize phishing, deepfake impersonation, sextortion, virtual kidnapping scams and business email compromise (BEC). The article notes hundreds of under-18s in the UK reported sextortion victimization this year. The blurring of work and home life through hybrid working also exposes corporate credentials and colleagues.
Technical Details
- AI tools gather public material across the web, link it to victims and map relationships between people. They are particularly effective with unstructured data such as images and videos.
- LLMs can profile large numbers of targets quickly and draft social engineering scripts, which helps non-native speakers sound convincing. The result is an end-to-end fraud pipeline.
- Deepfake voice and video can be used to request money from relatives, fake kidnappings or create extortion material.
- Attackers can link personal and professional social accounts to harvest work credentials, or target colleagues while a victim is on holiday and cannot verify fraudulent requests, a useful window for BEC.
Remediation
- Restrict social profiles so they are not publicly accessible.
- Avoid sharing birth dates, children's schools, holiday plans and similar details.
- Be aware that photos can leak addresses and vehicle details.
- Avoid linking personal and professional identities online.
- Use multi-factor authentication and strong, unique passwords.
- Do not accept friend or follower requests from unknown people; verify through a separate channel.
- Assume anything published can be read by AI.
Linha do tempo
-
AI-powered OSINT lowers the barrier for mass victim profiling, making ordinary users viable fraud targets
ler a análise desta fonte ocultar
ESET's WeLiveSecurity warns that AI and large language models (LLMs) now automate OSINT reconnaissance at machine speed. Profiling that once took a skilled attacker hours or days can be done by low-skill actors, so ordinary internet users are now economically viable fraud targets. Fraudsters can collect public information at scale, including images and video, to personalize phishing, deepfake impersonation, sextortion, virtual kidnapping scams and business email compromise (BEC). The article notes hundreds of under-18s in the UK reported sextortion victimization this year. The blurring of work and home life through hybrid working also exposes corporate credentials and colleagues.
Technical Details
- AI tools gather public material across the web, link it to victims and map relationships between people. They are particularly effective with unstructured data such as images and videos.
- LLMs can profile large numbers of targets quickly and draft social engineering scripts, which helps non-native speakers sound convincing. The result is an end-to-end fraud pipeline.
- Deepfake voice and video can be used to request money from relatives, fake kidnappings or create extortion material.
- Attackers can link personal and professional social accounts to harvest work credentials, or target colleagues while a victim is on holiday and cannot verify fraudulent requests, a useful window for BEC.
Remediation
- Restrict social profiles so they are not publicly accessible.
- Avoid sharing birth dates, children's schools, holiday plans and similar details.
- Be aware that photos can leak addresses and vehicle details.
- Avoid linking personal and professional identities online.
- Use multi-factor authentication and strong, unique passwords.
- Do not accept friend or follower requests from unknown people; verify through a separate channel.
- Assume anything published can be read by AI.