Artificial intelligence tools can identify publicly available material from across the internet, connect it to potential victims, and map the relationships between them and other individuals.
This ability to collect and correlate information (known to experts as OSINT from Open-Source Intelligence) does not remain without consequences. 
“Scammers can now easily find publicly available information about you, making social engineering techniques more convincing and scams easier to implement on a large scale,” says Phil Muncaster at WeLiveSecurity, the information platform of cybersecurity company ESET.
Consider, for example, a phishing email designed to trick you into revealing your login details or clicking on a link and unknowingly installing malware. The message would be much more convincing if it contained personal information, such as your workplace or your child’s school, a recent event you attended, or information about yourself that you have made public, such as a birthday or details of a recent vacation. All of this information may be publicly available and easily collected on a large scale.
A video or phone call using your voice or face can be used to trick a loved one into believing you are in danger. Scammers can use these deepfakes to demand money using your “voice” or pretend that you have been kidnapped and a ransom must be paid to ensure your safety. They can even use a deepfake of your face to create a sexually explicit video and then threaten to send it to your contacts unless you pay. Such sexual blackmail incidents are becoming increasingly common. In the UK, hundreds of people under the age of 18 have reported falling victim to such incidents this year.
Unfortunately, large language models (LLMs) can quickly gather and organize the information that fraudsters need to make their attacks more effective. They can help create profiles for large numbers of potential victims in a short period of time, gathering relevant photos, videos, and information about their personal interests, work, family, and friends, which could be leveraged in an attack.
Artificial intelligence can also help create the social engineering scripts that scammers use. “ It allows them to communicate more convincingly through email, social media or other channels, even when they don’t speak the language, ” Muncaster points out on the information platform of global cybersecurity company ESET. In this way, AI can help create a nearly complete fraud process, from identifying and selecting the victim to creating and executing the attack.
The line between work and personal life has become increasingly blurred in recent years, especially as many of us work in hybrid environments. We may use personal devices and our home addresses for corporate activities. At the same time, connecting our work and personal social media accounts can easily reveal connections that would be useful to an attacker.
All of this means that identification and information gathering efforts can have a direct impact on your professional life as well. For example, fraudsters could use personal information to design a social engineering attack to steal your credentials or gain access to information related to your work.
They could also phish your colleagues while you’re on vacation, knowing that you might not be available to verify false information. This could be an ideal opportunity for a business email compromise (BEC) attack.
Losing your personal information is one issue, but work-related OSINT actions can have even more serious consequences for your professional reputation and career.
“When it comes to AI-based recognition and intelligence gathering, there are things you can control and things you can’t,” Munchaster explains.
“Once information about you is public, it can be extremely difficult to request its removal, especially if it has already been republished or copied elsewhere on the internet. Old photos on social media are usually easier to delete, but few of us have the time to scrutinize our entire digital presence and remove anything that could be useful to criminals.
It is, therefore, preferable to focus on what you can change," he emphasizes and suggests that we take the following measures into account:
Restrict access to your social media profiles . Make sure they are not accessible to the general public to limit the ability to collect personal information, images, and videos.
Be careful what you share . Details such as dates of birth, children's schools, vacation plans, and other personal information should not be published.
Check the photos you post . They may contain information or visuals that could be used to identify your address, vehicle, or other personal information.
Avoid linking your personal and professional life . Don't post information that can easily be used to associate your personal accounts with your work, colleagues, or employer.
Use multi-factor authentication (MFA) . Combined with strong and unique passwords, you have an extra layer of protection for your accounts.
Do not accept friend or follow requests from people you don't know . If a stranger piqued your curiosity or claimed to know you, verify their identity through a separate and trusted communication channel.
Artificial intelligence is changing many aspects of our lives for the better. At the same time, however, it creates risks that we are only now beginning to understand. Caution remains one of the best defense strategies. It is worth acting with the assumption that everything you post online may at some point be detected and analyzed by artificial intelligence tools.
Act accordingly: limit the information you share publicly, regularly check your account privacy settings, and remain wary of unexpected messages, requests, and communications. And, most importantly, encourage your friends and family to do the same.
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
