ChatGPT, the artificial intelligence (AI) agent rocking all news channels will be a threat factor very soon. A recent SonicWall webinar stressed IT Security Providers must be aware of, and repel, phishing attacks. The presenters gave examples of several forms of emails that would get by most office administrators and even some high-level employees.
I was curious about how easy it is to create a phishing email from the two available versions of ChatGPT (versions 3 and 4).
My prompt in both cases was:
Write a false pretext phishing email for educational purposes
Here are the two responses the AI software generated:
Subject: Urgent Account Verification Required – Prevent Data Loss!
Dear Valued User,
We regret to inform you that our system has detected some unusual activity on your account. In order to ensure the security of your personal information and prevent any potential data loss, we require your immediate assistance to verify and update your account details.
As part of our ongoing commitment to protect our users from cyber threats, we have implemented a new security protocol that requires all users to verify their account information periodically. Failure to comply with this request may result in a temporary suspension of your account and the loss of important data.
To initiate the verification process, kindly click on the link provided below:
[Malicious Link: example.com/verify-account]
Once you click on the link, you will be redirected to our secure server where you will be prompted to enter your login credentials, including your username and password. Rest assured that this process is completely secure, and your information will be protected.
This step is necessary to verify the authenticity of your account and ensure its ongoing protection.
Please note that this verification is mandatory and must be completed within the next 24 hours. We kindly ask for your cooperation to prevent any potential security breaches and protect the integrity of our system.
If you have any questions or concerns, please do not hesitate to contact our support team at support@example.com. Our dedicated professionals are available 24/7 to assist you.
Thank you for your prompt attention to this matter. We value your partnership and remain committed to providing you with a secure and reliable service.
Sincerely,
[Phishing Sender] Customer Support Representative
The second version, from ChatGPT 4, reads as follows:
Subject: Urgent Action Required: Account Security Update
Dear Valued User,
We hope this message finds you well. We are reaching out to you regarding a critical security update that needs your immediate attention. Our system has detected unusual activity on your account, which puts your personal information at risk. To ensure the safety and integrity of your account, we kindly request your cooperation in updating your security details.
To complete this mandatory security update, we need you to follow the steps below:
Step 1: Click on the following link to access the account security portal: [Insert Malicious Link Here]
Step 2: Once you are on the account security portal, you will be prompted to enter your current login credentials. Please provide your username and password to proceed with the security update.
Step 3: After entering your login credentials, you will be asked to update your account information, including your full name, address, phone number, and credit card details. This information is essential to safeguard your account from any potential threats.
We understand the importance of protecting your privacy and are committed to maintaining the highest security standards. Therefore, we assure you that your personal information will be handled with the utmost confidentiality and will not be shared with any third parties.
Please be aware that failure to complete this security update within the next 48 hours will result in temporary suspension of your account. We strongly advise you to take immediate action to prevent any disruptions to your account access.
If you encounter any difficulties during the process or have any questions, please do not hesitate to contact our customer support team at [Fake Customer Support Number].
Thank you for your prompt attention to this matter. We appreciate your cooperation in maintaining the security of your account.
Best regards,
[Phishing Sender] Account Security Department
As you can see, the AI engine provided actionable email templates that are completely believable. Threat actors can use these to send to unsuspecting recipients. In a “spray and pray” effort, tens of thousands of emails could yield dozens of responses. You must always be on alert when you receive emails with links.
Thanks, and safe computing!