Threat Actors Leverage AI Agents to Conduct Social Engineering Attacks

Cybersecurity researchers describe agentic AI as autonomous, goal-driven systems that can learn and plan across multiple steps, a step beyond reactive, helpfully responsive AI that merely generates content. The article notes that threat actors are using these agents to run social engineering campaigns at scale, conducting continuous surveillance and adapting tactics in real time across platforms.

It cites a marked rise in AI-driven deception, with detected deepfakes surging tenfold globally and North America seeing a 1,740% increase, underscoring the rapid maturation of these threats. In practice, agentic AI can tailor multi-stage spear-phishing efforts across email, social networks, and SMS, achieving click-through rates of up to 54% compared with 12% for manual phishing.

Projections suggest that by 2028, one-third of AI interactions could involve such autonomous agents, driving broader and more efficient campaigns; defenders are urged to combine AI-powered security with human vigilance and to look for behavioural anomalies rather than solely linguistic cues. Verification through independent channels and reliance on pattern recognition to detect AI-generated content are highlighted as part of a hybrid defence strategy.