Lookout rolls out Smishing AI to stop social engineering on mobile devices – News

Cybersecurity company Lookout Inc. today announced the launch of Smishing AI, an artificial intelligence-powered solution that aims to stop mobile-based social attacks that target people rather than systems.

The new solution addresses the issue whereby traditional phishing defenses rely on identifying telltale signs such as malicious URLs or mismatched sender details, but they’re not suitable for a new generation of mobile phishing threats.

Smishing is a type of phishing attack employing social engineering that uses SMS or text messages to trick people into revealing sensitive information, such as passwords, financial details or login credentials. Attacks typically involve innocuous messages that build trust to manipulate potential victims into giving up credentials or data without ever clicking a link.

For example, an attacker might initiate a conversation with a simple “Hi, this is a delivery notification from FedEx, can you please confirm your address?” or a text claiming to be from a colleague asking for an urgent wire transfer. The conversations build a sense of urgency or legitimacy and, in doing so, bypass traditional security measures.

Smishing AI changes the game by using large language models to understand the context and intent behind a message, not just its content. The result allows the new solution to detect previously unseen threats, including those that don’t contain a URL or any other obvious malicious signs.

The engine analyzes linguistic patterns, emotional cues and conversational flow to “read between the lines” and determine if a message is indicative of a social engineering attempt.

In the words of Lookout, the new solution is a “powerful example of using AI to combat AI.” As threat actors use generative AI to bypass language barriers and create perfectly crafted, believable messages, Lookout Smishing AI uses AI to analyze linguistic patterns and contextual cues to surface these threats before they can cause harm.

Given that Smishing AI needs to read user messages to analyze risks, the new solution has also been built with privacy at the forefront. The scanning is not enabled by default and is opt-in only, with both security administrators and end users needing to provide explicit consent. Only messages from unknown senders are scanned, personal information is de-identified and no data is stored or used for training.

The launch of Smishing AI is more than just a new feature, rather it’s a signal of the strategic direction the company is taking, Lookout said in a blog post.

Image: News/Reve