{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Daily Security Review","title":"AI-Generated Phishing and Deepfakes Supercharge Social Engineering Attacks","html":"","width":"100%","height":180,"duration":3678,"description":"Social engineering has reclaimed center stage as today’s most reliable intrusion vector—and it’s not just email anymore. Recent warnings from law enforcement and national cyber centers underscore how adversaries exploit human psychology to “log in, not hack in,” bypassing hardened perimeters with phishing, vishing (voice phishing) against IT help desks, smishing, and polished impersonation. These campaigns pair urgency, intimidation, and empathy ploys with modern twists like deepfake audio/video and LLM-written lures that mirror a target’s tone, role, and business context. Once a foothold is gained, operators ride legitimate tools (PowerShell, RDP, admin consoles), blend into normal traffic, and quietly harvest high-value data.Meanwhile, ransomware has evolved from smash-and-grab encryption to multi-stage extortion. The Ransomware-as-a-Service (RaaS) and broader Cybercrime-as-a-Service (CaaS) markets have slashed barriers to entry: core developers lease turnkey kits, affiliates handle intrusion and extortion, and specialists sell initial access, phishing kits, or data leak hosting. Tactics now include data theft before encryption, countdown leak sites, direct calls to victims and their customers, public shaming, and even leveraging mandatory incident-reporting laws to increase pressure. Technical tradecraft has kept pace: dual-strain deployments, remote/hybrid encryption, uncommon languages to dodge signatures, and “living off the land” to evade EDR.A headline development is the consolidation of high-impact crews into the “Scattered LAPSUS$ Hunters”—an identity-centric operation that perfects the art of help-desk social engineering, MFA fatigue, SIM swapping, and OAuth consent abuse to capture credentials and session tokens. Post-compromise, they move fast: disabling EDR, exfiltrating from SharePoint, code repos, and cloud data lakes (think Snowflake and Amazon S3), even abusing backup tooling for stealthy transfers. The result is a repeatable pipeline from...","thumbnail_url":"https://img.transistorcdn.com/pL79_MJFeJHamQ_ztImsGmDSMdl27VMk_30TAkieujE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNzg5/ZjlhNzM5Y2M4Njli/NjkxNzgyODA2Nzhi/MDI2ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}