AI-driven OSINT in the wrong hands – and why everyone could be a target for fraud

AI is changing the threat landscape, one model at a time. The pace at which the technology is evolving means activities that once took a skilled cybercriminal several hours or even days to achieve can now be done in a fraction of that time by someone with little or no prior knowledge. This matters, because it’s lowering the barrier to entry for cybercriminals. We’re seeing it with vulnerability exploitation. We’re seeing it with basic malware generation. And we’re seeing it with victim reconnaissance.

This should put even regular internet users on high alert. If attacks are getting cheaper and easier for fraudsters to carry out, everyone could be a target.

There was a time when open-source intelligence gathering (OSINT) was something only used on high-profile and potentially high-value targets. That’s because it took skill and time to carry out. The term itself originates outside of the cyber world, referring to military and intelligence efforts to collect publicly available information which could be used to achieve strategic goals.

With the advent of the web, and more recently social media, these efforts have become a familiar part of the digital world, used by researchers and threat actors alike. But until AI came along, there was often still a major bottleneck. An adversary needed to spend time finding their targets’ public-facing accounts, interests, friends, family and colleagues. They might have to use dedicated tools or trawl through countless websites, accounts and posts, correlating and cross-checking information, working out relationships between individuals, and deciding what to use in an attack.