{"id":7079,"date":"2025-09-20T10:04:10","date_gmt":"2025-09-20T10:04:10","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/09\/20\/phishing-attacks-using-ai-powered-platforms-to-misleads-users-and-evades-security-tools\/"},"modified":"2025-09-20T10:04:10","modified_gmt":"2025-09-20T10:04:10","slug":"phishing-attacks-using-ai-powered-platforms-to-misleads-users-and-evades-security-tools","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/09\/20\/phishing-attacks-using-ai-powered-platforms-to-misleads-users-and-evades-security-tools\/","title":{"rendered":"Phishing Attacks Using AI-Powered Platforms to Misleads Users and Evades Security Tools"},"content":{"rendered":"

Phishing Attacks Using AI-Powered Platforms to Misleads Users and Evades Security Tools
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Phishing campaigns have long relied on social engineering to dupe unsuspecting users, but recent developments have elevated these attacks to a new level of sophistication.<\/p>\n

Attackers now harness advanced content-generation platforms to craft highly personalized emails and webpages, blending genuine corporate branding with contextually relevant messages.<\/p>\n

These platforms analyze public social media profiles, corporate press releases, and user activity to generate text that mirrors a victim\u2019s communication style, greatly increasing the likelihood of engagement.<\/p>\n

The resulting emails often bypass basic filters by avoiding known malicious keywords and employing dynamic content that changes with each delivery.<\/p>\n

At the same time, these platforms integrate real-time language models to refine phishing templates on the fly, adapting to evolving email defenses and user responses.<\/p>\n

This continuous learning loop allows campaigns to shift message templates within minutes, making static blocklists effectively obsolete.<\/p>\n

Trend Micro researchers identified<\/a> several clusters of these AI-enhanced phishing waves in August 2025, each targeting different industry verticals\u2014from financial services to healthcare\u2014demonstrating the breadth of the threat landscape.<\/p>\n

\n
\"\"
Fake captcha page (Source \u2013 Trend Micro)<\/figcaption><\/figure>\n<\/div>\n

As organizations scramble to deploy heuristic and behavior-based filters, attackers counter with polymorphic payloads that mutate both text and embedded URLs in real-time.<\/p>\n

Beyond email, attackers leverage these platforms to generate convincing duplicate login portals hosted on cloud infrastructure, complete with valid SSL certificates and region-specific IP addresses.<\/p>\n

\n
\"\"
Captcha page does not redirect to the phishing page if the answer is incorrect (Source \u2013 Trend Micro)<\/figcaption><\/figure>\n<\/div>\n

The combination of genuine-looking domains, valid certificates, and personalized messaging leads many users to overlook subtle warning signs.<\/p>\n

Trend Micro analysts noted that such campaigns often include a brief authentication step mimicking multi-factor prompts, further reducing suspicion by aligning with standard corporate login flows.<\/p>\n

\n
\"\"
Phishing page after the captcha is solved (Source \u2013 Trend Micro)<\/figcaption><\/figure>\n<\/div>\n

Once credentials are harvested, follow-on malware<\/a> delivers a lightweight loader that contacts a command-and-control server over HTTPS, blending in with normal web traffic.<\/p>\n

In parallel with credential theft<\/a>, these campaigns deploy various evasion techniques within their code. Embedded scripts employ encryption and obfuscation routines to conceal their true purpose, only decrypting at runtime.<\/p>\n

The loader, written in PowerShell, leverages native Windows API calls to disable monitoring services before deploying the final payload.<\/p>\n

A representative snippet illustrates how the script resolves API functions dynamically:-<\/p>\n

$kernel = Add-Type \u2013MemberDefinition @\"\n    [DllImport(\"kernel32.dll\")]\n    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);\n\"@ \u2013Name \"Kernel\" \u2013Namespace \"Win32\"\n$hMod = [Kernel]::GetModuleHandle(\"ntdll.dll\")\n$addr = [Kernel]::GetProcAddress($hMod, \"NtOpenProcess\")<\/code><\/pre>\n
Evasion Techniques and Detection Challenges<\/strong><\/h2>\n
A critical aspect of these AI-driven campaigns lies in their ability to evade signature-based and behavioral detection systems.<\/p>\n
The dynamically generated HTML payloads include randomized element IDs and inline style definitions that change with each interaction, rendering signature matching ineffective.<\/p>\n
On the network side, attacker-controlled domains employ fast flux DNS<\/a> to rotate authoritative name servers, while the malicious loader establishes encrypted tunnels over standard ports, camouflaging traffic among legitimate SSL connections.<\/p>\n
Endpoint sensors that rely on static heuristics are frequently bypassed as the loader disables Windows Event Logging for PowerShell<\/a> execution, then reinstates logging settings once the secondary payload activates.<\/p>\n
This hit-and-run strategy leaves minimal forensic artifacts, complicating post-incident analysis and prolonging dwell time for threat actors.<\/p>\n
Find this Story Interesting! Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>.<\/p>\n
The post Phishing Attacks Using AI-Powered Platforms to Misleads Users and Evades Security Tools<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Phishing Attacks Using AI-Powered Platforms to Misleads Users and Evades Security Tools Phishing campaigns have long relied on social engineering to dupe unsuspecting users, but recent developments have elevated these attacks to a new level of sophistication. Attackers now harness advanced content-generation platforms to craft highly personalized emails and webpages, blending genuine corporate branding with […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-7079","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/7079"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=7079"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/7079\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=7079"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=7079"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=7079"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}