Egress, provider of an Intelligent Cloud Email Security suite that uses patented self-learning technology to detect inbound and outbound threats, is warning businesses to be on guard against the growing security threat posed by large language models (LLMs) and social engineering campaigns.
Jack Chapman, VP of Threat Intelligence at Egress, said: “Without a doubt chatbots or large language models (LLMs) lower the barrier for entry to cybercrime, making it possible to create well-written phishing campaigns and generate malware that less capable coders could not produce alone.
“However, one of the most concerning, but least talked about applications of LLMs is reconnaissance for highly targeted attacks. Within seconds, a chatbot can scrape the internet for open-source information about a chosen target that can be leveraged as a pretext for social engineering campaigns, which are growing increasingly common.”
While there is potential for cybercriminals to use LLMs and chatbots to create phishing email campaigns, the second Egress Phishing Threat Trends Report suggests that AI detector tools are currently less effective at identifying chatbot-written emails.
Egress says that because they utilise LLMs, the accuracy of most detector tools increases with longer sample sizes, so they often require a minimum of 250 characters to work. With 44.9% of phishing emails under 250 characters and a further 26.5% under 500 characters, AI detectors won’t work reliably or at all on 71.4% of attacks.
The report also warns that the proportion of phishing emails employing obfuscation techniques to hide attacks from certain detection mechanisms has risen by 24.4% to 55.2%. According to data from the Egress Defend Integrated Cloud Email Security solution, 47% of phishing emails that use obfuscation contain two layers to increase the chances of bypassing email security defences
and reaching the target recipient. HTML smuggling is the most popular obfuscation technique, accounting for 34% of instances.
In addition, there has been an 11% increase in phishing attacks sent from compromised accounts. Because compromised accounts are trusted domains, these attacks usually get through traditional perimeter detection, including secure email gateways.
Egress data shows that the percentage of emails getting through Microsoft defences was 25% higher this year, with 47.7% of missed phishing attacks sent from compromised accounts. The percentage of attacks getting through secure email gateways (SEGs) was 29% higher.
Chapman said: “If you’re relying on traditional perimeter detection that uses signature-based and reputation-based detection, then you urgently need to evaluate integrated cloud email security solutions that don’t rely on definition libraries and domain checks to determine whether an email is legitimate or not.”
He added: “Legacy approaches to email security rely heavily on quarantine, barring end users from seeing phishing emails, but as our report highlights, phishing emails will inevitably get through. This is one of the reasons why we’ve flipped the quarantine model on its head, adding dynamic banners to neutralise threats within the inbox. These banners are designed to clearly explain the risk in a way that’s easy to understand, timely and relevant, acting as teachable moments that educate the user. Ultimately, teaching someone to catch a phish is a more sustainable approach for long-term resilience.”
Egress has expanded its partner network significantly over the last year and a half, resulting in a 220% growth in partner- generated revenues in the last 12 months, including a 400% year-on-year increase in revenue from its MSP programme
Be First to Comment