The New Threat Actor pt. 2

As many of you know, I’ve been working with Pearl Technologies on researching behaviors of Threat actors in newer and modern technology, especially how they use marketing skills to trick victims. So, this is part two of a blog series I have dubbed “The New Threat Actors”. Let’s recap a bit from last time. Last time we discussed that threat actors don’t hide in the shadows anymore, they aren’t trying to be sneaky. They stand out in the light and make you feel you can trust them. They trick you into openly allowing them access to your data. Some key words here are misguided trust, and marketing. For this blog, some of our key words are Laziness and AI. “But wait Nick, how does laziness help Threat actors?”. I’m glad you asked, let’s dig in.

Story time! Through Pearl technology I’ve been researching how threat actors use phishing email scams for marketing purposes. I did all my research; I’ve read articles upon articles. I’ve typed out essays and fed it to my AI assistant to create an outline draft. I felt so proud of my work. I submitted the outline to Anthony and immediately this man called me out on the use of AI. “Oh cmon, man” I mentally screamed in my head. “Of course I used AI, it’s what it’s there for. My ADHD brain doesn’t have the patience to write it all out in an outline! I like blog style, because blog style you can be a bit messy. And ADHD does a bit better when there is a mess.” The thing I want people to wake up and realize is that while yes, AI is useful for automation in our day-to-day lives, it has caused us to become lazy. If I can automate AI to create an outline based on an essay I fed it, how easy would it be for a threat actor to utilize it in their threat vector to create sophisticated attacks. AI gave them the ability to become lazy in their attacks, but yet still powerful.

This past week, Anthony and I had the opportunity to read an article about the Madgicx Plus Application. This article was very eye-opening to the point that I wanted to shift gears a bit on how I wanted to address part 2 in this series. Madgicx is a public application where anyone can access it and utilize it to create AI generated ads. Let that sink in. AI generated ads. We are creating a network worldwide infrastructure where threat actors don’t even need to try to trick you, because with the use of AI, they can be lazy and let AI do it for them. It should terrify you how easily a threat actor can utilize an AI ad and attach them to an email template and then use a platform like Apollo to mass produce email production.

Now there is some back and forth between Anthony and I about the use of the Madgicx plus attack. Anthony pointed out to me that in his research, the chrome extension in itself has a malware payload in it. I missed that part in my initial research. But Cybersecurity is all about continued learning and this has been a testament to that. In this article we’re focusing on how threat actors utilize AI. I might deep dive into malicious web extensions in part 3.

Anyways, so now you might be asking yourself, “ok, a threat actor sent an ad. So what? They can’t force you to buy something”. Very true, but this is when the marketing tactic becomes the attack. Threat actors will send out very appealing ads, or urgent ads. That’s marketing, but once you click it, that’s when it becomes an attack. “How?”, you might ask. The way this happens is simple but powerful: once you click, the ad redirects you to a malicious landing page. That page might look legitimate—a fake login portal, a survey, or even a shopping cart—but it’s designed to harvest your credentials, drop malware, or trick you into providing sensitive information. The brilliance (and danger) of this tactic is that the marketing hook isn’t the attack itself, but the delivery system. Threat actors exploit our trust and curiosity, then leverage automation to scale these attacks far beyond what they could do manually.

So, what’s the solution? Proper security hygiene and education. The solution to this, like many other security concerns, is prevention techniques to mitigate risk. And how do you achieve this? Education. You won’t know how to defend if you don’t know what you’re defending against. Sophisticated passwords are an example of a good security posture, but long passwords won’t help you defend against the new rising threat of AI. Carefully analyzing content and studying the difference between human wording vs AI wording behavior. By education and carefully analyzing behavior is how we mitigate AI threats.

So, in conclusion, the behavior of the new rising threat actors is as followed; Marketing, False Trust, Laziness, AI. Mitigation techniques; Education, careful analysis of behavior. And as always, be resilient.