AI Deepfakes Fuel Cyberattacks: North Korea Leads Charge

In 2025, North Korean hacking groups like PutridSlug industrialized the use of generative AI, employing deepfake video and audio to impersonate company executives during Zoom calls. This advanced social engineering tactic aimed to trick tech employees into downloading malicious code, facilitating financial theft. AI tools now enable attackers to create hyper-realistic fake personas, gaining unauthorized access to sensitive data and secure environments.

The proliferation of generative AI has fundamentally altered attacker economics, making sophisticated attacks more accessible and less costly. Gone are the days of simple phishing emails; now, large language models and AI coding assistants help craft personalized, compelling outreach. This has led to a significant rise in phishing, with a 1,265% increase reported in 2025. Hackers can now exploit human pressures like urgency and authority with unprecedented effectiveness.

Beyond phishing, AI supercharges scams using deepfakes for cloned voices and visuals. This includes fake advertisements and manipulated video interviews for remote jobs, all designed to breach company systems. Experts note that live video calls are no longer a foolproof verification method, as threat actors execute corporate espionage and identity fraud in real-time. The rise of synthetic identities, created with backstories, presents a complex defense challenge as these identities can build trust and accrue history.

Defenders are also leveraging AI for 'liveness detection' and analyzing contextual data like typing cadence to verify identities. Businesses are urged to educate staff, implement zero-trust frameworks, and conduct cyber crisis exercises. Preparing for AI-enabled social engineering is crucial, as the human vulnerability remains, but the attack vectors have evolved dramatically.