AI is removing friction from the attack lifecycle
Most cyberattacks can be broadly viewed as progressing through three stages: access, expansion and impact.
First, an attacker gains access to the environment, whether by stealing credentials, exploiting a vulnerability or socially engineering an employee. From there, they expand what they can access and establish persistence. Finally, they use their position to achieve an objective such as stealing intelligence, committing fraud, deploying ransomware or disrupting operations.
Across the attack lifecycle, AI can give attackers greater speed, scale, sophistication and stamina, what we at SimSpace call “The Four S’s.” EvilTokens demonstrates how those advantages can be packaged in a single service. It allows attackers to exploit Microsoft’s legitimate device code authentication flow, convincing victims to authorize attacker access without handing over their passwords. Once inside, AI identifies who controls payments, which business relationships carry trust and which invoices or transactions present opportunities for fraud. It then recommends impersonation targets and drafts convincing fraudulent messages grounded in real business conversations.
