Summary:
Arctic Wolf released an article highlighting the growing use of generative AI in social engineering attacks.

The company notes that the rise of generative AI has led to a significant surge in the number and success rate of phishing and social engineering attacks. AI allows threat actors to create hyper-personalized, grammatically flawless, and contextually rich messages that mimic the tone and style of trusted individuals. The core process involves:

1. AI-powered reconnaissance: Data mining public information to create detailed target profiles.
2. AI-generation of content: Crafting individualized messages.
3. Adaptive conversation loops: Using AI to automate responses and adjust persuasion tactics in real time.

Arctic Wolf claims this sophistication has caused AI to dethrone ransomware as the principal concern for security leaders. The article specifically details how AI enhances phishing to bypass traditional security filters and how it improves BEC by enabling the cloning of executive communication styles, voices, and even visual likenesses (deepfakes) to fraudulently request fund transfers.

Security Officer Comments:
The article includes several key statistics and reports to illustrate the threat:

• Global management consulting firm McKinsey & Company reported a 1,200% global surge in phishing attacks since the rise of generative AI in the latter half of 2022.
• IBM reports that AI-powered spear phishing attacks have a 47% success rate against trained security experts.
• Arctic Wolf’s own Human Risk Behavior Snapshot: 2nd Edition revealed that nearly two-thirds of IT and security leaders self-reported falling for a phishing attempt.
• The FBI reported that BEC attacks cost organizations a collective $2.77 billion (USD) in 2024.
• For the first time, AI has dethroned ransomware as the principal concern of security leaders, according to Arctic Wolf's 2025 The State of Cybersecurity Trends Report.

Suggested Corrections:

• Use phishing simulations with AI-generated lures for more realistic content and preparation against emotional triggers.
• Leverage AI security tools to detect anomalous writing styles, unnatural communication frequency, or unusual financial requests.
• For high-risk financial or operational requests (like wire transfers), always rely on in-person verification when possible. If not, use protected channels like company messaging systems to verify.
• Implement FIDO2-based multi-factor authentication (MFA) or passkeys that use biometrics.
• Ensure 24x7 endpoint monitoring to detect and respond to credential-harvesting malware.
• Be vigilant about requests that reference real projects or ongoing financial milestones, and use verification protocols for any fund transfers.

Link(s):
https://arcticwolf.com/resources/blog/how-to-combat-ai-enhanced-social-engineering-attacks/