Do Scammers dream of electric Phish? Lessons learned from deploying AI-driven phishing ops

DEF CON 33 Social Engineering Community Village (Aug/2025)

Effective phishing campaigns traditionally demand extensive manual effort, involving detailed target reconnaissance, crafting believable scenarios, and setting up infrastructure. These manual processes significantly restrict scalability and customization. This talk explores a practical approach to leveraging Generative AI for automating core aspects of phishing workflows, drawing on direct experiences and real-world threat actors such as Emerald Sleet, Crimson Sandstorm, and Charcoal Typhoon.

The session thoroughly compares results from different models and platforms, including OpenAI ChatGPT, Anthropic Claude, and local alternatives, highlighting distinct strengths, weaknesses, and techniques for optimizing outcomes. Attendees will gain insights into deploying an end-to-end phishing campaign, emphasizing the models’ effectiveness in reducing the technical barrier of scaling phishing attacks. Finally, the talk underscores that while AI significantly enhances operational efficiency, it functions best when complemented by human judgment and expertise, reinforcing the critical human factor in cybersecurity practices.

DEF CON Social Engineering Community Village: https://www.se.community/presentations/

Transcript

1. Do Scammers Dream of Electric Phish? Lessons learned from deploying AI-driven phishing ops Daniel Marques (0xc0da)
2. Disclaimer The views and opinions expressed in this talk are our own and do not necessarily represent those of our employer. These slides are for educational purposes only and are not to be relied upon as professional advice.
3. Daniel Marques @0xc0da
4. GenAI can help scale phishing campaigns.
5. TYPICAL PHISHING WORKFLOW Pretext creation Recon GO! Deploy Infrastructure Craft emails Launch campaign Data collection & correlation Scenario ideation Automation & orchestration Text generation
6. Most of these activities require TIME AND MANUAL EFFORT (Specially for cross-border targets in spear phishing campaigns)
7. Threat actors abusing AI for phishing? Are there any https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/ Emerald Sleet (THALLIUM) Using LLMs to generate regionalized content. Crimson Sandstorm (CURIUM) Using LLMs to generate phishing emails and web scraping. Charcoal Typhoon (CHROMIUM) Using LLMs for translations and communications.
8. Threat actors still face challenges and concerns Guardrails and Jailbreaking Fake models and bad data OPSEC and monitoring
9. COMPARISON BETWEEN MODELS AND PLATFORMS A quick
10. GPT-4.1 Claude Sonnet 3.7
11. Claude Sonnet 4 GPT 5
12. Mistral
14. Original GPT 5
16. Original Sonnet 4
17. UNCENSORED AND LOCAL MODELS But test them thoroughly. They are like a box of chocolate. Look into
19. Turning theory into practice USING LLMs FOR PHISHING
20. Recon – Target selection Eyewitness Data collection Analysis and classification Decision making
26. IDEAS WORTH SPREADING Somebody might be watching Models “want” to make you happy These models are tools, not the holy grail Keep these in mind when working with AI models
27. Building the (ALMOST) COMPLETE WORKFLOW
29. Key. Takeaways Your phishing workflow can be automated You might still need to do some clean-up work Consider your OPSEC and jailbreaking effort
30. Thank you!
31. Credits • Opening slide background: IA generated with human touch-up. • A Person Holding a Prosthetic Arm - cottonbro studio - https://www.pexels.com/photo/a-person-holding-a- prosthetic-arm-6153345/ • Two People Using Computers - Tima Miroshnichenko - https://www.pexels.com/photo/two-people-using- computers-5380607/ • Pensive black man thinking in light room – Andres Ayrton - https://www.pexels.com/photo/pensive-black-man- thinking-in-light-room-6578415/ • LinkedIn logo - https://www.vecteezy.com/png/18930480- linkedin-logo-png-linkedin-icon-transparent-png • ‘Thank you’ slide background: IA generated with human touch-up.