Beyond Phishing: How AI and Deepfakes Are Powering a New Generation of Scams

Phishing and online scams are no longer confined to poorly written emails and obvious fake websites. A new report from Kaspersky Labs highlights how cybercriminals are harnessing artificial intelligence, deepfakes, and advanced social engineering to launch scams that are nearly indistinguishable from legitimate communications.

“Phishing and scams are dynamic types of online fraud that primarily target individuals, with cybercriminals constantly adapting their tactics to deceive people,” the report warns.

Traditionally, phishing attempts were littered with grammatical errors and formatting issues. Today, attackers use neural networks to generate convincing, error-free messages and cloned websites. According to Kaspersky, “cybercriminals are increasingly turning to neural networks for help. They use these tools to create highly convincing messages that closely resemble legitimate ones.”

Beyond emails, AI-powered bots now populate messaging apps and dating platforms, maintaining conversations with victims to build trust. This trend fuels scams such as “pig butchering,” where victims are tricked into investing in fraudulent cryptocurrency schemes.

One of the most alarming developments is the rise of deepfakes. Scammers are producing realistic videos and cloned voices to impersonate colleagues, celebrities, or even bank representatives. Kaspersky notes that “the advancement of AI technology for creating deepfakes is blurring the lines between reality and deception.”

This technology is already being weaponized in large-scale fraud. Victims report YouTube Shorts featuring fake celebrity giveaways, while others receive AI-powered calls from “bank security services” demanding SMS-based two-factor authentication (2FA) codes—codes that ultimately allow attackers to access their accounts.

Telegram has emerged as a major platform for phishing and scams. Its open ecosystem and support for crypto payments have made it a haven for malicious bots. These bots impersonate postal services, run fake token airdrops, and lure users into “easy money” schemes.

Kaspersky highlights how scammers exploit the persistence of bots: unlike websites, which can simply be closed, bots can continue sending messages, including phishing links or requests for admin access to group chats.

Attackers are also abusing legitimate platforms to stay under the radar. Phishing campaigns now exploit:

• Google Translate to cloak fake websites with trusted domains.
• Telegraph, Telegram’s publishing tool, to redirect users to phishing sites.
• CAPTCHAs to appear authentic and bypass anti-phishing detection.
• Blob URLs to hide malicious scripts inside browsers, making them harder to trace.

“Cybercriminals are shifting their focus from stealing usernames and passwords to obtaining irrevocable or immutable identity data, such as biometrics, digital signatures, handwritten signatures, and voiceprints,” Kaspersky warns.

By targeting services like DocuSign or e-government portals, attackers can gain access to critical legal and financial systems. In some cases, phishing sites even request camera access to harvest biometric data under the guise of identity verification.

Phishing is evolving faster than ever. The report concludes: “Whereas they once relied on fake emails and websites, today, scammers use deepfakes, voice cloning and multi-stage tactics to steal biometric data and personal information.”

Kaspersky advises both individuals and organizations to strengthen defenses, increase awareness, and prepare for a future where fraudsters don’t just trick victims with text—but with voices, faces, and identities that look real.

Related Posts:

• Deepfake Scams on the Rise: CEOs, News Anchors, and Government Officials Impersonated
• Deepfakes and Deception: The Rise of Synthetic Identities in Remote Work
• Taylor Swift Deepfake Scam: Fake Freebies Alert for Fans
• 73% Danger: The Chilling Reality of Speech Deepfake Detection
• North Korea’s AI-Powered Cybercrime: Deepfakes & Fake Personas Infiltrate 300+ US Companies via Remote IT Jobs