AI has not invented new categories of cybercrime. It has removed the manual labor that used to keep the old ones rare. Phishing, QR scams, session hijacking, MFA fatigue, and deepfakes all existed before generative models. Each one now runs faster, cheaper, and at a scale that breaks the habits people built to spot them.
Ransomware and data breaches still dominate the headlines. The quieter threats do more day-to-day damage, mostly because people judge them by how they looked in 2019.
That mental model expired. Google’s Threat Intelligence Group documented a case where AI agents built and ran a credential-harvesting campaign in under six hours, handling the planning, the execution, and their own error-fixing with barely any human input. Criminals never lacked ideas. They lacked logistics. Agent tooling solved that problem for them.
Here is what the five most underrated threats look like after that shift, and what still works against each one.
AI Phishing: Why Bad Grammar Stopped Being a Warning Sign
People screened email by feel for two decades. Broken English, strange spacing, a greeting addressed to “Dear Valued Customer.” Those tells existed for a boring reason: attackers wrote in a second language, at volume, under time pressure.
Language models deleted that constraint overnight. Someone with no English at all now produces clean, on-brand copy in seconds.
Specificity is the bigger jump. Your LinkedIn profile, your company’s team page, and a handful of public posts give an attacker enough material to personalize these messages down to your manager’s name and the project you shipped last quarter. Generic blasts convert at a fraction of a percent. Tailored ones convert far better.
The data you hand to AI tools feeds the same machine from the other side. Chat logs and uploaded files live on somebody else’s servers, and every breach of that storage turns into raw material for the next round of targeted messages.
What still works. Polish changed. Intent did not. Every phishing attempt needs you moving fast — a frozen account, a declined payment, a bonus that disappears at midnight. Treat manufactured urgency as the signal, and stop reading spelling as evidence of anything.
Hover over each link and confirm the domain before you click. A password manager catches what tired eyes miss, because it simply will not autofill on a lookalike domain. That refusal is the tell. Paid tiers do cost money, so hunt down NordPass discount codes if a subscription stretches the budget.
Quishing: Why QR Codes Skip the Filters That Catch Bad Links
A QR code exists in physical space, which quietly disarms people. Someone who would never click a link in a strange email will scan a sticker on a parking meter without a second thought.
Attackers love the format for a structural reason. Your email security tools read URLs and score them. They cannot read a square of pixels inside a JPEG, so the malicious destination walks straight past the filter. Print the code on a sticker and slap it over a real one, and no filter sits in the path at all.
Where does the scan lead? A credential-harvesting page, a malicious app download, or a checkout form built to capture your card. Restaurant menus, parking payments, event tickets, and delivery notices all get targeted, since people expect a QR code in those exact places.
What still works. Scan nothing you found in public, especially anything printed on a sticker layered over existing signage. Run your thumbnail along the edge of a code on a menu or meter. A peeling corner tells you plenty.
When you do scan something, read the URL preview your camera shows before you tap through. Then apply the same suspicion you would give any link that arrived by text from a stranger.
Session Hijacking: What HTTPS on Public Wi-Fi Does Not Cover
Web security genuinely improved. HTTPS is now the default, so an attacker on the café network can no longer pluck your password out of the air as you type it.
They stopped trying. The workaround is cleaner: steal the session cookie your browser holds after you log in. That token proves to the server that you already authenticated. Anyone holding a copy inherits your logged-in state. No password required, and your second factor never fires, because from the server’s view nobody logged in again.
Airport lounges, hotels, and coworking spaces make good hunting grounds. So does any network where someone stands up a plausible-looking access point and waits.
What still works. Run a VPN on every network you do not control. Encrypting the tunnel puts your traffic out of reach of anyone monitoring the local network, cookies included.
Log out of sensitive accounts and back in every so often, particularly after you travel. Each fresh login issues a new session token and retires the old one, which strands anybody holding a stale copy. Most banking and email providers also list active sessions in their security settings. Kill the ones you do not recognize.
MFA Fatigue: Why Push Approval Became the Weakest Factor
Multi-factor authentication blocks the overwhelming majority of account takeovers. Attackers found a way around it that requires no technical skill whatsoever — just persistence, which software supplies for free.
An attacker who already holds your password triggers login attempt after login attempt. Your phone lights up with approval prompts. Ten of them. Forty. They schedule the wave for 2 a.m., because a half-asleep person taps “approve” to make the buzzing stop. One tap ends it.
Automation is what makes this viable at scale. A script fires thousands of prompts across thousands of accounts overnight, and a fraction-of-a-percent success rate still pays. The same agent loops that let software retry until a task completes make this trivial to run against a large list.
What still works. Approve nothing you did not personally start, no matter how many prompts arrive or what time they arrive. Repeat prompts mean an attacker already has your password, so change it immediately.
Switch every account you can from tap-to-approve over to code-based verification. Typing a six-digit code from an authenticator app requires you to actually pick up the phone and read it, which defeats an attack built entirely on reflex. Number-matching prompts, where you select a digit shown on the login screen, close the same gap.
Deepfake Scams: Why Spotting the Fake Is the Wrong Defense
Voice cloning needs a few seconds of audio now. Your voicemail greeting covers it. So does any video you posted.
Companies absorbed the first wave, and finance teams have already wired money on the strength of a cloned executive voice. Families are next. A parent gets a call from a child in trouble. A grandparent hears a grandchild who needs bail money tonight and begs them to keep it quiet.
Most advice tells you to look for the seams — odd blinking, flat audio, mouth movement that lands slightly wrong. That advice is aging badly. Hany Farid spent twenty-five years building detection systems and now says detection alone can no longer carry the load. Generation improves with every dollar and every user. Detection improves only after the fact, by studying what already got through. The gap widens rather than closes.
What still works. Shift the burden off your perception and onto a process. Hang up and call the person back on the number you already have saved. A real relative will not mind. A cloned voice cannot follow you to a different channel.
Secrecy plus urgency plus money is the pattern worth memorizing. Any two of those together should stop you cold.
Best of all, work out a safeword with the people who matter to you. One agreed word, never written down anywhere online, settles the question in four seconds. No model can guess what your family picked over dinner.
The Pattern Connecting All Five
Look at what each defense has in common. None of them ask you to detect anything.
The password manager refuses the fake domain. The callback reaches the real person. The safeword confirms identity. The authenticator code forces a deliberate act. Every one of them moves verification to a channel the attacker does not control.
That is the whole shift. Trusting your instincts made sense when scams carried the fingerprints of rushed human work. AI sanded those fingerprints off. What it cannot do is answer a question on a second channel it never touched.
Frequently Asked Questions
Q. Can AI-generated phishing emails be detected by spam filters?
Partially. Filters catch known malicious domains and flag suspicious attachments. They perform poorly against novel, well-written messages sent from clean infrastructure, which describes most AI-assisted phishing today.
Q. Is a VPN enough to stop session hijacking?
A VPN handles the network layer, which covers the public Wi-Fi scenario. It does nothing about malware on your device or a cookie stolen through a phishing page, so pair it with regular logouts and a password manager.
Q. How much audio does voice cloning need?
Current tools produce a usable clone from roughly three to ten seconds of clear speech. Voicemail greetings, social videos, and podcast appearances all qualify.
Q. Does MFA still help if attackers can spam approval requests?
Yes, substantially. MFA fatigue only works when a victim taps approve. Code-based and number-matching methods remove that possibility, and both stay far safer than a password alone.
Bottom Line
Nobody expects to be the one who falls for it. That assumption is the actual vulnerability, and it held up better in an era when running a scam cost real human hours.
Those hours are gone. The defenses that survive share one trait: they verify through a channel the attacker never touched. Build that habit into how you handle money, credentials, and urgent requests, and the quality of the fake stops mattering.
Related: AI Hackers Stole 23,800 Credentials in Just 6 Hours
