Matthew Rosenquist breaks down an AI-generated phishing email targeting job seekers, showing how scammers use Gmail addresses, fake LinkedIn profiles, and .app domains to impersonate recruiters. Watch for non-functional website buttons, fabricated executive bios, and anonymous email services like tutah.io.
Chapters
AI-powered phishing and fraud are getting better. Let me show you a recent example and how to detect it. In my inbox today, I found this impressive fraudulent phishing message. Now, a few things to note here. First off, the Gmail address, and that's telling because most companies aren't going to be using Gmail. So that is a warning sign. Now, impressively rich detail about my particular career derived from research, likely scraped from my LinkedIn profile or from numerous open source options out on the web. But there are a couple of errors here that an AI system would make. So I keyed in on that. Now, there is an introduction. Hello, Erica Lester. And she self-identifies as a headhunter with MediAscent Talent Solutions. This is important. If we go out to LinkedIn, Erica here doesn't have a profile and neither does this company. But what we can see is a well-written call to action that taps into common cognizant cognitive biases like financial gain and flattery. So fraudsters will typically use this. We don't see any spelling errors or any atrocious grammar flaws. And there is a Meet My Team link which goes to a website which we're going to click. Okay, here we are at the website. And the first thing we want to look at is this domain name. This .app is not a top-level domain. So that's a little odd, right? So we want to keep that in mind. Secondly, let's take a look at this background image. That's a big building. It's also an AI-generated image. Okay, fine. Maybe we wouldn't pick up on that, but let's keep going. Now, the company MediAscend, or MediAscend Talent Solution, doesn't actually exist. And it has no other webpage or professional listing. If we go out to Google, the only thing that comes back is this one webpage. So that seems a little odd, especially for a company that has such a beautiful building without any street numbers on it and is AI-generated. But the webpage is marked with this Anything button down here. And then if you look over here in the lower left, it actually calls back to a created.app. Now that actually links to create.xyz, which is an AI app builder. And these are AI-powered tools that with just a small amount of text, it will create a complete webpage for you. Well, almost complete. Because when we go back here, if I click on these buttons, they don't do anything. There are a few subpages like an About Us and Services which just go between pages, but some of these— Industries— they don't do anything. And if you ever go down to a page, there should be a Privacy link. Doesn't do anything when I click on it. Neither does the Support button. So yes, a very pretty shell of a web page with some great graphics were created, but nothing more than that. The links don't work, the main buttons don't work, and there is a reference to an email here, right? And if you can see this, and this is different than the email address from what we received, and it goes out to tutah.io. Now, this is actually part of a different company, and this company provides anonymous email accounts. So this is what a fraudster would want to use. It's encrypted, they don't have to give any identification. This is what they would use if they wanted to be connected or to reach out. So this is not what you would see on a legitimate web page from a company. In fact, let's go look at the About Us. We actually have on this webpage, we've got, you know, people apparently saying such a good company, attesting to it. And if we click on the team, it actually shows executives. Look at this, Melissa Teens as the CEO, 15 years. We've got again, Erica Lester, 10 years. Titus over here and Alyssa, many, many years, no pictures. And they also don't have any LinkedIn profiles. Hmm, a little odd. But there's one other interesting thing. If we go out here to the main page, we can scroll down and there are packages offerings ranging from about $200 to $600. And even a $350 monthly charge. And this is what I would expect the scammer to push the victims for once more contact is made. What's important to know is this is all fake. Fake people, fake company, fake business model, all intended to look sufficiently legit to get a victim on a call get their information and their money. The engaging email, fake contact profile, company webpage graphics, executive profiles, customer testimonials, all of it is all the work of AI. Cybercriminals are effectively leveraging AI solutions to improve their attack tactics and infrastructure to appear more convincing. And also for scaling out to more victims with very customized and compelling engagements. At this stage, I'm impressed as a cybersecurity professional who has fun identifying such attacks anyway. But I also know such scams will get much better. Consider this. Websites with fully functional links and buttons, seeding company information into search engines so when you do look it up, you get a lot of hits, and submitting that information into AI aggregators to boost recognition and the appearance of legitimacy. I expect future ones, not too long from now, to have better email addresses and domain names, smoother and more compelling phishing emails, more convincing testimonials, including some from legitimate review sites, more free services when emails are confirmed or personal data is provided, and I expect better executive profiles to appear, including fake LinkedIn accounts, pictures, web pages, everything about them to be able to give them a better backstory. Everybody should be concerned about this. We are all potential victims, and I don't expect many others out there to be professional security experts to be able to identify this all the time. These attackers are going to get better, and more people will be victimized. Email spam and filtering tools are far behind, and they will never become 100% effective. Individuals and businesses not only need better filtering tools, but also more robust data and asset protection processes and stronger cognitive skills to detect and resist these evolving fraudulent tactics. Cybersecurity moves fast, but the attackers are always a few steps ahead. Keep your wits about you and do not be an easy victim. Be sure to like and share if you found this interesting. Follow me on LinkedIn, Substack, and on the Cybersecurity Insights channel. The links are below.
