‘Alarming' Gmail, Outlook Attacks—Do Not Use Your Password

Forbes

15-05-2025

You have been warned — make changes today.
We were warned — 2025 was always going to be the year AI attacks surged. And here we now are, with unbeatable attacks targeting Gmail and Outlook users at work and at home. 'Sophisticated, never-before-seen phishing schemes' as well as 'automated malware delivery and polymorphic attacks' are coming for your accounts.
'Attackers now have access to unparalleled tools that allow them to amplify the scale and effectiveness of cyber threats,' warns a new report from Cofense. And while Google, Microsoft and others laud their AI innovations ion better defending such attacks, 'offensive AI will always maintain an edge over defensive AI, as it operates without the legal and ethical constraints that safeguard responsible development of AI.'
Attackers can train and deploy models without limits, and can then use 'distributed networks of compromised computers to run processing-intensive algorithms that would be cost-prohibitive for legitimate organizations.' This means using AI 'to craft highly targeted and cosmetically perfect campaigns' without the usual tells.
It also means that 'by analyzing publicly available data, such as company names and job titles, from social media platforms, leaked databases, and online footprints, cyber criminals can create customized messages that resonate with specific targets." That might be 'an AI-generated phishing email referencing a victim's recent purchases, professional affiliations, or interests, thereby increasing the likelihood of engagement.'
Cofense warns this makes such campaigns 'both highly convincing and alarmingly effective,' citing Deloitte research suggesting 'generative AI will multiply losses from deepfakes and other attacks by 32% to $40 billion annually by 2027.'
So-called polymorphic attacks are also surging, with phishing emails constantly tweaked to bypass defenses hunting for replicas of flagged emails. 'Attackers use sophisticated algorithms to alter subject lines, sender addresses, and email content in real time, effectively bypassing static signature-based email filters. Each iteration of the phishing attempt is uniquely crafted, reducing the probability of detection and enabling threat actors to execute their campaigns with alarming efficiency.'
The aim is to send you to a seemingly legitimate phishing website and have you enter your account password. Cofense says it tracked a new phishing email every 42 seconds last year, as malicious campaigns 'mutated in real-time to bypass traditional filters — creating an unprecedented challenge for defenders.'
Advances in AI also results in 'more than 40%' of detected malware families being new to the Cofense team and 'Business Email Compromise emails increasing by 70%.' Most of this malware was keylogging spyware, remote access trojans and infostealers, all of which are deployed to steal credentials an hijack accounts.
The usual advice not to click links or open attachments becomes more difficult with the devious tactics now being enabled by AI. If you think you know and trust the sender and the message is personalized you're likely to click. And so it's now critical to protect accounts with more than just a password and simple two-factor authentication (2FA).
The advice is clear — stop using passwords. Per last week's World Password Day warnings, set up passkeys on accounts — especially your Google and Microsoft accounts. Microsoft wants its billion-plus users to then delete their passwords to ensure no extant vulnerabilities. Google is not going that far, but don't leave SMS 2FA in place. Use an authenticator app as a minimum and remove SMS 2FA from your account.