How staff profiles can become a phishing toolkit

Employee names, roles and photographs shared online can help criminals craft convincing impersonation attempts, with generative AI making personalised scams easier to produce at scale.

Companies that publish staff names, job titles, photographs and internal details online may be handing criminals a ready-made toolkit, according to Anastasia Patrusheva of the cyber-intelligence division at Russian security firm Bastion, speaking to RIA Novosti. She said organisations often share such material to promote corporate culture and strengthen their employer brand, while overlooking how it can be repurposed for fraud. The same concern is reflected in guidance from the UK National Cyber Security Centre, which says attackers frequently tailor phishing attempts to specific employees rather than sending generic messages.

According to Patrusheva, open sources can reveal enough about a company’s workforce for an attacker to build a believable pretext for contact, including a person’s full name, role, photographs from events, client relationships and even hints about internal hierarchy. The Canadian Centre for Cyber Security similarly warns that public information shared about the workplace can help threat actors map an organisation and identify plausible business contacts, making impersonation far more convincing. Research cited by USENIX Security has also documented how criminals exploit contextual clues from compromised accounts to make later messages appear routine and trustworthy.

Patrusheva said generative AI now makes it easier for fraudsters to turn that raw information into polished, personalised messages at speed. That kind of automation aligns with a recent research paper on generative AI and spear-phishing, which found that publicly available personal data can be used to scale context-aware campaigns. US cybersecurity guidance also notes that spear-phishing is phishing aimed at an individual using information about that person, underlining how open employee data can sharpen an attack.

She added that the most common delivery channels are corporate email and messaging platforms, where attackers may try to continue an existing conversation or pose as a colleague, supplier or partner. The FBI says business email compromise often succeeds because criminals exploit trusted accounts and familiar correspondence, while the US Cybersecurity and Infrastructure Security Agency warns that phishing messages can be designed to push recipients towards credential theft or malicious downloads. Bastion’s advice, echoed by other cyber agencies, is to limit the amount of employee information made public and to verify unusual requests through a separate channel before acting on them.

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph:

Source: Fuse Wire Services