Putrid Slug, a North Korean hacking group, used deepfake video and audio in 2025 to impersonate executives on Zoom calls, tricking employees into downloading malicious code. This exemplifies how AI has industrialised social‑engineering, letting attackers craft hyper‑realistic personas at low cost.

According to Deep Strike, phishing attacks surged 1,265 per cent in 2025, driven by generative AI tools that scrape public data to produce highly personalised emails and synthetic identities. Attackers now combine SMS, messaging apps, and follow‑up voice calls over days, making manipulation harder to spot.

Experts warn that live video is no longer proof of identity. Defenders are deploying liveness‑detection biometrics and zero‑trust frameworks, while recommending pre‑established passphrases and regular crisis simulations. Yet some argue training alone cannot stop AI‑enabled fraud; proactive controls to limit damage are essential.