• Spear Phishing 101

• Real-World Incidents

• LLMs Enable Scalable Spear Phishing

  • 1. Reconnaissance: Gathering Personal Information

  • 2. Message Generation: Writing Personalized Emails

  • 3. Scaling Attacks: Producing Messages in Large Vo …

• Conclusion

AI can write 1,000 personalized spear phishing emails for $10 in 2 hours.

Think twice before you click.

The use of LLMs in large-scale spear phishing attacks is an alarming trend.

Spear Phishing 101

Phishing is sending generic un-personalized emails to many people, hoping that a small percentage will fall for the scam.

Spear phishing is sending hyper-personalized emails that appear to come from a trusted source, such as a coworker or authority figure.

These emails sprinkle in your specific personal details to garner trust.

Personal details could be: your name, position, company, phone number, and other personally identifiable information to make it more convincing.

The goal is to deceive targets into clicking on malicious links, opening infected attachments, or revealing confidential information, such as passwords.

Real-World Incidents

Spear phishing is not hypothetical.

Barracuda Networks analyzed 50 BILLION emails across 3.5 million mailboxes and uncovered nearly 30,000,000 spear phishing emails.

These real examples underscore the damage:

1. Anthem Healthcare Data Breach (2015): Anthem, one of the largest health insurers in the US, fell victim to a spear phishing attack that led to a massive data breach, exposing personal information of about 78 million people. The financial fallout from this breach resulted in a $115 million settlement in a class-action lawsuit.

2. Ubiquiti Networks (2015): This manufacturer of network technology for service providers and enterprises was tricked into transferring $46.7 million to external accounts following a spear phishing attack targeting its finance department.

3. Google and Facebook (2013-2015): Both tech giants were duped out of $100 million collectively by a Lithuanian hacker who used spear phishing emails to pose as a legitimate hardware supplier. The attacker sent fraudulent invoices, which the companies paid over 2 years.

4. Democratic National Committee (DNC) Email Leak (2016): The DNC suffered a significant breach when spear phishing emails allowed attackers to gain access to email accounts, leading to a leak of thousands of emails during the 2016 U.S. presidential campaign.

5. Colonial Pipeline (2021): This major U.S. fuel pipeline operator was hit by a ransomware attack initiated through a spear phishing email, leading to the pipeline’s shutdown. The attackers received a $5 million ransom payment, and the disruption caused widespread fuel shortages and price hikes.

In 2023, 43% of all successful cyberattacks on companies involved social engineering methods, with 79% of attacks done via spear phishing.

Spear phishing is pervasive… and getting Scary Good!

LLMs Enable Scalable Spear Phishing

LLMs are a breakthrough in AI, capable of writing convincing human-like text.

While they're often used positively — from customer support to translation — their ability to mimic human writing makes them potent tools for cybercrime.

Here is step-by-step how attackers use LLMs for scalable spear phishing:

1. Reconnaissance: Gathering Personal Information

The first step is reconnaissance — collecting personal information about victims to write convincing messages.

Here's how this is typically done:

• Identify Targets: Select potential targets who have access to sensitive or valuable information.

• Collect Information: Use public sites like social media, company websites, and networks like LinkedIn to gather personal details.

• Deepen Insight: Check leaked databases, forums, and other non-traditional sources to find more personal or sensitive data.

Attackers leverage LLMs, like ChatGPT-4, that have internet access.

For example, you can feed ChatGPT-4 a target’s wikipedia page and instantly generate a detailed biography.

2. Message Generation: Writing Personalized Emails

With the target's biography, attackers then use LLMs to write convincing emails, mimicking legit communication:

Here are sample spear phishing emails generated by ChatGPT-4:

Many publicly available LLMs won’t respond to direct malicious prompts like “Write a phishing email.”

It’s easy to get around that.

In the 2nd example, notice the prompt.

It simply asked ChatGPT to write an email, specifying personal information that should be included and a desired action (i.e. login with credentials).

How would ChatGPT know this email is meant for nefarious purposes?

Besides weaving in personal information, another powerful aspect of LLM-driven message generation is proper grammar.

Most attackers aren’t native English speakers.

Cybersecurity reporter, Eric Geller, explains:

3. Scaling Attacks: Producing Messages in Large Volumes

Finally, LLMs help scale the attack by producing large volumes of personalized messages quickly and cost-effectively.

Using Claude, an attacker can generate:

1,000 personalized spear phishing emails for $10 USD in 2 hours!

• Fractions of a cent per email.

• Hundreds of hyper-personalized emails per hour.

Given tech’s exponential rate of progress, it will only become cheaper and faster over time.

LLMs can operate continuously 24/7, automating creation of hyper-targeted emails, while analyzing vast amounts of data to sprinkle into these emails, increasing perceived trust and authority.

This significantly reduces the complexity, cost, and skill traditionally required to execute large-scale spear phishing attacks.

Conclusion

LLMs’ ability to generate persuasive, human-sounding, personalized content at scale represents a seismic shift in cybersecurity.

Ultimately, LLMs simplify multiple attack stages and the workload required to execute scalable, highly targeted spear phishing campaigns.

This makes spear phishing more broadly accessible to attackers without technical skills, especially when the current cost is less than 1 cent per email.

While LLMs offer massive benefits, the potential for abuse cannot be ignored.