FEATURE
When phishing becomes harder to recognise
One of the most immediate consequences of generative AI is the growing sophistication of phishing and social engineering attacks.
For organisations, this means cybersecurity awareness programmes must evolve beyond teaching employees to identify suspicious language. Verification procedures, identity controls and a culture of questioning unusual requests are becoming more important than ever.
Traditionally, phishing emails were often identifiable through poor grammar, spelling mistakes and awkward language. These warning signs are becoming less reliable as generative AI enables criminals to produce convincing communications tailored to specific countries, languages, industries and individuals.
For Africa, where linguistic diversity has historically complicated large-scale social engineering campaigns, this represents a particularly significant development.
Karl Fischer, CTO at Obsidian Systems, has already encountered examples of AI-generated content in Afrikaans that were difficult to distinguish from authentic communication.
“ Yes, I’ ve seen some AI content in my home language, Afrikaans, and I had to blink twice to work out whether it was real or fake. It looked convincing and it sounded convincing, and that makes it very difficult for people, especially people who might not be tech savvy, to notice if something is AI. These things will probably become almost indistinguishable at some point.”
The ability to generate natural, culturally appropriate language removes a barrier that previously limited the effectiveness of some phishing campaigns.
Entonu believes this development is making traditional security awareness advice increasingly inadequate.
“ A badly written phishing email full of spelling mistakes used to be an obvious warning sign. Attackers can now produce convincing messages in different languages, adjust the tone for a particular market and personalise them using information gathered about the individual or organisation. That makes some of the old clues people were taught to look for much less useful.”
Deepfakes challenge digital trust
The threat extends beyond written communications.
AI-generated voice cloning and deepfake video are making it possible to impersonate senior executives, colleagues and public officials with increasing credibility. For financial institutions, businesses and government agencies, the potential consequences include fraudulent payments, unauthorised disclosure of sensitive information and compromised access to critical systems.
AI-generated voice cloning and deepfake video are making it possible to impersonate senior executives, colleagues and public officials with increasing credibility. For financial institutions, businesses and government agencies, the potential consequences include fraudulent payments, unauthorised disclosure of sensitive information and compromised access to critical systems.
Fischer believes organisations need stronger verification procedures to address this emerging risk.
“ It’ s very bad, because anybody can phish or try to impersonate anybody. So it is a big, emerging threat, and I think businesses should have a lot more checks and balances in place to make sure that certain things are fact-checked and doublechecked, even if that means putting a person in the middle to verify information with the people on the other side. That is, if the people on the other side aren’ t AI themselves.”
Entonu agrees that organisations can no longer rely on a familiar face or voice as sufficient proof of identity.
“ If an attacker can convincingly impersonate a CEO, colleague, or government official, a request to transfer money, disclose information, or change access becomes much harder to question.”
He argues that sensitive or unusual requests should be independently verified through a separate communication channel.
The broader implication is that organisations must rethink how they establish digital trust. As synthetic content becomes more realistic, identity
Vincent Entonu, Managing Director Africa at Westcon-Comstor
Karl Fischer, CTO at Obsidian Systems www. intelligentcio. com
INTELLIGENT CIO AFRICA
25