Cybercriminals are now using advanced AI tools to steal Gmail credentials and take over user accounts.
Hackers use artificial intelligence to steal data from Shutterstock email users
Artificial intelligence has beneficial uses, but there are also negative sides. Although most of the big corporations have developed artificial intelligence (AI / AI) models to contribute to the good of humanity, there are always people who use it for wrong purposes. One example is the use of AI to take control of digital accounts (“spoofing”), including Gmail, the world’s most popular email service provider.
With more than 2.5 billion accounts, Gmail is an easy target for cybercriminals who have started using a new method called “super realistic AI fake call” capable of fooling even tech-savvy users.
Microsoft expert Sam Mitrovic about to fall victim to a sophisticated scam
Sam Mitrovic, the founder of CloudJoy and an expert in cybersecurity products, recently explained in a blog post that hackers are using new tricks to target Gmail users, and how he came close to being fooled himself. He received an email imitating an approval notification to recover his Gmail account. Later, following the rejection, he received a phone call, with the caller ID – Google Sydney.
A week later, he received another Gmail account recovery notice and a phone call. Like the first time, the call came from a legitimate phone number listed on Google’s support page. The caller stated that his overseas account had been accessed for over a week and personal data associated with the account had been downloaded.
He then received an email, following his request, informing him of the same issue, but in text format. The email came from a Google domain, which could have fooled almost anyone. When Mitrovic received the call, he began to suspect it was a scam and began to investigate further. With the help of online forums such as Reddit, he confirmed that it was indeed a spoofing attempt to take over his Gmail account.
A legitimate phone number identical to that of Google Workspace support, an email from a Google domain but spoofed using a Salesforce CRM (which allows users to use any domain name they want), and an AI voice bot with a persuasive tone are more than enough to fool most users into thinking this communication is from Google. Many users would easily give away their Gmail credentials to criminals.
Beware of Voice Scams: How Hackers Use AI to Trick Users
Until a few years ago, cyber scams required actual human resources to make fake phone calls, such as those known in India as “Jamtara scams”. However, with the development of very realistic-sounding AI voice models, the process has become much simpler. Now, criminals can easily initiate thousands of such attempts at once.
This situation illustrates how hackers combine various tricks, including fake emails, spoofed phone numbers, and AI bots, to trick legitimate users. For now, there is no foolproof method to prevent these attacks. However, maintaining a high level of vigilance can help protect your Gmail account. Nowadays, our Gmail account is almost our digital identity, being used for both personal and professional purposes.
Useful recommendations
1. Google will never contact you by phone for your Gmail account. In general, unless your account is associated with a Google Business Profile, Google will initially contact you by email using an address associated with its domain.
2. Check the number if you receive a suspicious call. If you have a business profile on Google and receive a suspicious call, use platforms like Truecaller to check if the number has been reported as a scam by other users.
3. Monitor your Gmail account activity regularly. If you suspect unauthorized access, go to your profile picture, then select “Manage your Google Account” > “Data & privacy” > “My activity” to review your recent account activity.
4. Stay vigilant against cyber threats: In an era where data is extremely valuable, hackers are constantly developing sophisticated methods to trick users and gain access to digital accounts with the aim of stealing personal information. Protecting your data against these attempts depends on the attention you pay to suspicious activity.
It’s important to regularly change your passwords for your digital accounts and enable two-step authentication. These methods may include one-time access codes (OTPs), access keys, or authentication applications such as Microsoft Authenticator. By implementing these measures, you will make it much more difficult for hackers to access your accounts, even if they manage to compromise your password.
