Medcurity’s Post

Transcript

Is generative AI a good thing for scammers Well, it's definitely making some things easier for them Hello everyone welcome to the Med charity podcast today we want to look at how generative AI tools are enhancing phishing scams, making them more convincing, more sophisticated and easier to run So first let's break down what generative AI is essentially, it's a type of artificial intelligence think chachi BT right, something that's able to create new content, whether that's text, images, music and even. Videos and these tools are trained on massive amounts of data to be able to produce these high quality, highly effective and convincing outputs. Now, phishing scams are relatively old news, right? They've been around for a long time and traditionally these involve sending fake emails out and trying to trick people into providing sensitive information. Now, the success of the scam usually depended on the criminal's ability to craft a believable message right to. Right up, something that would get you to act. Now, part of the skill that was required to become a good scammer has actually been taken away with AI. Tool scammers don't need to be master wordsmiths or graphic designers. They actually can rely on AI to do that heavy lifting for them. Now, there are a few ways generative AI is making phishing scams more effective. I wanted to look at three of those today. Number one, we are seeing some highly convincing emails and messages generative AI can produce. Emails and text messages that are almost indistinguishable from the legitimate ones. It can mimic writing styles of certain people. It can. It has all the jargon right. It can generate contextually relevant content based on recent news or events, or even facts about the industry. And this makes it a lot harder for individuals to spot phishing attempts now. Bad grammar and spelling errors. Some of these things we used to look for are still good signs that an e-mail isn't what it appears to be. But those indicators are becoming less and less relevant when hackers can get incredible content in seconds. Now there have been recent reports of e-mail scams that are so well made that even cyber security experts are having trouble distinguishing them from the real deal. Number two, we are seeing personalized attacks by analyzing data from social media and other online sources, A I can craft these highly personalized phishing messages. These messages reference specific details about the target's life, making them more believable and increasing the likelihood that someone's going to fall for that attack. So remember, right, whatever you're putting out there on Facebook, on Instagram, whatever's on the Internet about you that's out there can be used against you. They can use that knowledge about you to scam you. Directly, or they can use that to send a fake e-mail that appears to be from you to another person within your organization. So be aware of what you're posting, what you're putting out online. Now, we've seen examples of these that contain details about leaders of organizations that have been scraped from the Internet. Remember, hackers only need to convince you enough to get you to hand over the keys to the system. And #3 now, this one may be less prominent, but it's still important. And that is the deep fake technology, right? Generative AI isn't limited to text content. It can also create realistic deep fake videos and audio clips. Imagine receiving a voicemail from your boss that's asking you to transfer funds, or maybe getting a video message from a colleague asking for sensitive information. These deep fakes are incredibly convincing and difficult to detect. Even five years ago, back in 2019, this technology was advanced enough for scammers to generate audio matching CEO's voice requesting a $243,000 bank transfer. And that attack was successful, and today it's only gotten more powerful. Now it's not all bad news though, right? The good guys are using AI as well. We're using AI over at Mid Curity. We've got cyber security experts using AI too. People are using this to create better tools to identify these scams and to protect organizations in other ways. Artificial intelligence is being used to defend sensitive data, not just to target it. And even though these scams are getting more and more convincing, training your employees on those common red flags is still. An incredibly effective way for you to reduce your risk now is an e-mail asking you to act immediately. Is it creating that sense of urgency? Look for that. That is still a tried and true indicator of fraud. Is this person asking for access to sensitive patient data? Make sure you're verifying that they are who they say they are now. It's still so important that healthcare employees know these scams are out there and know the best ways to avoid being hacked. At Med Curity, we've talked about this concept of having a healthy paranoia. When it comes to stuff like this, know enough to be able to stop and think twice when you're being asked to click on something that seems unnecessary or you're being asked to give up information that could be harmful if it ended up in the wrong hands. Now we're here to help. If you have any questions about how you can protect your patient data from cyber criminals, I want to thank you for tuning in today. Stay safe and secure, and let's continue to protect patient data in our organizations.