Topic starter
11/11/2026 5:57 pm
TL;DR: Criminal operators are using AI services to make phishing, fraud, reconnaissance and impersonation faster and easier to scale, according to KELA. Security teams need to detect abnormal behaviour and identity abuse, not wait for obviously malicious infrastructure.
Editorial analysis by NHI Mgmt Group, based on content published by KELA: “Dark AI & Enterprise Risk: How to Defeat Malicious GenAI Models”.
Key questions
Q: What are the signs that an AI-assisted social engineering campaign is becoming dangerous?
A: Warning signs include prolonged back and forth contact, highly tailored references to a person’s hobbies or professional life, and a gradual shift from casual conversation to requests for information or action.
Q: How should teams verify executive payment requests against deepfakes?
A: Teams should verify executive payment requests through a separate channel using an independent callback to a known number or pre-registered contact, plus a second approver for release.
Q: How do malicious GenAI services change phishing risk?
A: They lower the labour needed to create convincing lures, localise them for different targets, and generate more variants in less time.
Practitioner guidance
- Strengthen behavioural detection for social engineering Tune monitoring for polished but unusual communications, abnormal approval timing and suspicious sequences of authentication or transaction events rather than relying on signatures alone.
- Require independent verification for high-risk requests Use separate verification paths for executive payments, account resets and sensitive approvals so voice, video or email urgency cannot be treated as proof of identity.
- Correlate external exposure with internal abuse signals Combine threat intelligence on underground AI services with monitoring for credential theft, phishing and impersonation indicators so campaign preparation and execution are reviewed together.
Bottom line: Dark AI does not replace established attack patterns, but it lowers the effort needed to run them at scale.
Glossary terms: Dark AI, AI-assisted phishing, Synthetic Media, Credential Theft
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Dark AI is an attack multiplier, not a new crime category: the core criminal behaviours remain phishing, fraud, impersonation and malicious code use, but the operating cost drops sharply. That means defenders should not wait for a novel AI-specific signature before treating this as a material risk. The practical conclusion is that familiar controls now need to work against faster, more convincing abuse.
A few things that frame the scale:
- 8 of the top 10 fastest-growing types of leaked secrets year-over-year are tied directly to AI services, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the best way to spot AI-driven reconnaissance before phishing?
A: The best way is to detect reconnaissance signals in identity, email and network telemetry before the phish lands: unusual mailbox enumeration, profile scraping, login probing, subdomain sweeps, and automated browser activity. Correlating these behaviours with rate limits, bot detection, and risky sign-in alerts helps spot AI-assisted targeting early.
👉 Read our full editorial: Dark AI lowers the barrier to phishing, fraud and impersonation