Criminals Are Using AI to Make Phishing Scams Look More Real

Security researchers at Rapid7 discovered an exposed server containing tools that criminals use to create convincing phishing scams. The server held 1,048 files including fake website templates and malware delivery tools. One active scam targeted people in Mexico through a fake government ID lookup website that infected computers and stole personal information. This scam used WebDAV technology to deliver malware to Windows computers. If you clicked on what looked like a legitimate government website to check ID information, your computer could be infected with software that steals passwords, banking information, and other private data.

While this specific campaign targeted users in Mexico, the exposed toolkit shows how criminals are building similar scams that could appear anywhere. If you recently visited any government website asking you to download files or enter personal information, take these steps now. First, run a full antivirus scan on your computer using Windows Defender or your installed security software. Second, change passwords for important accounts like banking, email, and government services. Third, check your bank and credit card statements for any unusual activity. Fourth, be extra cautious about any emails or websites claiming to be from government agencies. Going forward, remember that real government websites rarely ask you to download files to view basic information. Before entering personal details on any official-looking site, verify the web address matches the actual government agency. Type the agency name into a search engine separately rather than clicking links in emails. Enable two-factor authentication on all accounts that offer it, which adds a second layer of protection even if your password is stolen.