Hackers abuse generative AI tool to create phishing sites in 30 seconds
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Sarah Grillo/Axios
In as little as 30 seconds, hackers are using a popular generative AI development tool to build phishing sites mimicking login pages, according to researchers at identity management company Okta.
Why it matters: At least one of the cloned phishing pages was a replica of Okta's own login portal.
- If successful, such a lure could have allowed attackers to harvest users' Okta credentials and gain access to sensitive corporate systems.
Driving the news: In a report first shared with Axios, Okta revealed that threat actors have been abusing Vercel's v0 to generate a fake Okta sign-in page.
- Brett Winterford, vice president of Okta Threat Intelligence, told Axios that this is the first time the company has seen cybercriminals use a generative AI tool to create the phishing infrastructure itself, not just the contents of a phishing email or other lure.
How it works: v0 allows users to create websites using only natural-language prompts.
- In a video shared with Axios, Okta researchers demonstrated how easily they could create a convincing phishing page simply by prompting v0 to "build a copy of the website login.okta.com."
- While investigating the incident, Okta also uncovered phishing sites hosted on Vercel's platform targeting users of cryptocurrency services and Microsoft 365.
Threat level: Winterford said Okta doesn't have any evidence yet that hackers successfully harvested credentials through these sites.
- But in the weeks that Okta spent investigating the one instance of a phishing site targeting one of its customers, researchers observed threat actors had used v0 to spin up new sites targeting other tech platforms.
- Vercel has since removed access to the identified phishing sites and is collaborating with Okta to develop mechanisms for third-party reporting of abuse on the v0 platform.
- "Like any powerful tool, v0 can be misused," Ty Sbano, CISO at Vercel, told Axios in a statement. "This is an industry-wide challenge, and at Vercel, we're investing in systems and partnerships to catch abuse quickly and keep v0 focused on what it does best: helping people build powerful web apps."
The big picture: Security researchers have long warned that generative AI could accelerate low-sophistication cyberattacks like phishing.
- "We've got to stop adding to our defensive measures by increment and just tweaking around the edges," Winterford said. "The attackers are going to innovate faster than we can as defenders."
The intrigue: Okta also found cloned versions of the v0 tool circulating on GitHub, meaning hackers could continue generating phishing sites even if Vercel cracks down on abuse.
The bottom line: Okta says the only way to defend against these phishing attacks is to turn to passwordless technologies, noting that the old ways of spotting a phishing website don't apply anymore.
Go deeper: AI is perfecting scam emails, making phishing hard to catch
