Phishers’ latest weapon: ChatGPT | Ahmedabad News
AHMEDABAD: Since the artificial intelligence-powered chatbot tool ChatGPT launched last November, many of us have used it as a creative partner for everything from gripping scripts to eloquent letters. Cyber scammers are now harnessing the power of AI to create phishing emails with malicious code embedded.
Previously, the lack of language and cultural knowledge was a significant hurdle for scammers who struggled to make their emails realistic enough to achieve their goals. However, this February, an officer from the Mumbai Police Cyber Cell arrived in Gujarat and followed the trail of phishing scammers “who had used ChatGPT to compose two and five business emails SMS“.
Mumbai police traced an email written on behalf of a non-existent Patan-based “Bhakti Enterprises” trading in spices, a senior Gujarat official said CID detective. “The Mumbai company lost lakhs to the cyber crooks. Police interrogated some suspects and found that the cybercriminals used the AI tool to mimic the language and tone of authentic business emails and text messages,” the official said.
Phishing attacks are emails or other messages that attempt to trick recipients into clicking on an apparently innocuous document or website link, which then attempts to install malware on the user’s device. Between January 2022 and February 1 of this year, the CID Crime branch received 938 complaints about fake emails. Of these, 90 were classified as emails from companies posing as senior officials.
Most of these emails were sent by scammers offering cryptocurrencies or posing as agricultural traders, petrochemical company officials, car parts sellers, etc. These emails were sent from fake addresses that appeared to be from legitimate companies, making it difficult for victims to identify them as fake.
What worries Gujarat police, however, are phishing gangs using AI tools to craft flawless business emails and SMS. “Not all hackers are fluent in English, which works against them. Most organizations look for unconventional uses of grammar and unusual wording to weed out phishing emails. But ChatGPT fixes this problem, making messages appear more genuine and therefore much more likely to be successful as a basis for attacks,” the CID official said.
“A simple request with keywords like ‘Draft business letter with client ‘XYZ’ name to purchase 200 scooters, send check number, photo of check, GST number’ was enough for ChatGPT to generate a professional email,” added the CID official.
Mukesh Chaudhry, Cybercrime Advisor at Jaipur Police, told TOI: “Basic working and security protocols should be in place when dealing with emails. It must be informed in good time about changing crime trends. The skills of employees and team members to detect fraud need to be improved.”
He added that the phishing gangs are located in Bihar, Jharkhand and villages at the tri-border area of Haryana, Rajasthan and Uttar Pradesh. Now they have started operating from northeastern states like Tripura and Mizoram.
Sumit Mishra, Director of DoT Gujarat, told TOI: “Any customer service SMS coming from a 10-digit number should be considered a scam. Real SMS do not contain links. According to the latest TRAI regulations, messages must be sent via alphanumeric short codes.”
Previously, the lack of language and cultural knowledge was a significant hurdle for scammers who struggled to make their emails realistic enough to achieve their goals. However, this February, an officer from the Mumbai Police Cyber Cell arrived in Gujarat and followed the trail of phishing scammers “who had used ChatGPT to compose two and five business emails SMS“.
Mumbai police traced an email written on behalf of a non-existent Patan-based “Bhakti Enterprises” trading in spices, a senior Gujarat official said CID detective. “The Mumbai company lost lakhs to the cyber crooks. Police interrogated some suspects and found that the cybercriminals used the AI tool to mimic the language and tone of authentic business emails and text messages,” the official said.
Phishing attacks are emails or other messages that attempt to trick recipients into clicking on an apparently innocuous document or website link, which then attempts to install malware on the user’s device. Between January 2022 and February 1 of this year, the CID Crime branch received 938 complaints about fake emails. Of these, 90 were classified as emails from companies posing as senior officials.
Most of these emails were sent by scammers offering cryptocurrencies or posing as agricultural traders, petrochemical company officials, car parts sellers, etc. These emails were sent from fake addresses that appeared to be from legitimate companies, making it difficult for victims to identify them as fake.
What worries Gujarat police, however, are phishing gangs using AI tools to craft flawless business emails and SMS. “Not all hackers are fluent in English, which works against them. Most organizations look for unconventional uses of grammar and unusual wording to weed out phishing emails. But ChatGPT fixes this problem, making messages appear more genuine and therefore much more likely to be successful as a basis for attacks,” the CID official said.
“A simple request with keywords like ‘Draft business letter with client ‘XYZ’ name to purchase 200 scooters, send check number, photo of check, GST number’ was enough for ChatGPT to generate a professional email,” added the CID official.
Mukesh Chaudhry, Cybercrime Advisor at Jaipur Police, told TOI: “Basic working and security protocols should be in place when dealing with emails. It must be informed in good time about changing crime trends. The skills of employees and team members to detect fraud need to be improved.”
He added that the phishing gangs are located in Bihar, Jharkhand and villages at the tri-border area of Haryana, Rajasthan and Uttar Pradesh. Now they have started operating from northeastern states like Tripura and Mizoram.
Sumit Mishra, Director of DoT Gujarat, told TOI: “Any customer service SMS coming from a 10-digit number should be considered a scam. Real SMS do not contain links. According to the latest TRAI regulations, messages must be sent via alphanumeric short codes.”