Exploring the Dark Side of AI: Advanced Phishing Attack Design and Deployment Using ChatGPT

TL;DR

This paper demonstrates how ChatGPT can be exploited to automate the creation and deployment of sophisticated phishing attacks, raising concerns about AI misuse and emphasizing the need for improved security measures.

Contribution

It presents a novel methodology for using ChatGPT to generate comprehensive phishing attack components and automate deployment, highlighting new security risks associated with AI advancements.

Findings

Phishing kits can be generated rapidly using AI.

Generated phishing pages closely resemble target websites.

AI can automate large-scale phishing deployment.

Abstract

This paper explores the possibility of using ChatGPT to develop advanced phishing attacks and automate their large-scale deployment. We make ChatGPT generate the following parts of a phishing attack: i) cloning a targeted website, ii) integrating code for stealing credentials, iii) obfuscating code, iv) automating website deployment on a hosting provider, v) registering a phishing domain name, and vi) integrating the website with a reverse proxy. The initial assessment of the automatically generated phishing kits highlights their rapid generation and deployment process as well as the close resemblance of the resulting pages to the target website. More broadly, we demonstrate that recent advances in AI underscore the potential risks of its misuse in phishing attacks, which can lead to their increased prevalence and severity. This highlights the necessity for enhanced countermeasures within AI systems.