AI Just Made Phishing Much Harder to Spot
In this monologue, cybersecurity expert Kevin Surace warns that AI-generated phishing emails are dramatically increasing corporate vulnerability. He cites a 35% employee click‑through rate on AI‑crafted phishing messages, noting that the content is indistinguishable from legitimate communications. Surace references Microsoft’s recent takedown of a hacking ring that uncovered roughly 96,000 successful compromises of the Microsoft Authenticator app, illustrating the scale of the problem. He explains the typical attack flow: phishing kits deploy a relay site that captures credentials, which the attacker then uses to log into real services such as Salesforce or Workday and exfiltrate data. Surace argues that any organization lacking biometric authentication is effectively open to breach, and he underscores the financial impact with a real‑world ransom case where a company paid $1.8 million after being compromised. The overall message is a stark warning that AI has lowered the barrier to effective phishing, making traditional defenses insufficient.
