There Is Only So Much Lipstick You Can Put on a Cybercriminal Troll

The report analyzes current social engineering and phishing trends, noting that most breaches involve a human element and that phishing and BEC remain dominant entry vectors. It observes a rise in likely AI-generated emails but finds many are verbose or incongruent, with attackers favoring tried-and-true tactics (e.g., QR code MFA scams) over sophisticated LLM output; CEO-fraud style emails generated by LLMs are often less convincing than concise human-crafted messages. The piece emphasizes the importance of user training, adherence to corporate communication norms, and verifying unusual requests via a second channel, as filters may miss well-crafted messages.