The evolution of AI is not only affecting various industries, but it has also transformed cybercriminals’ tactics. One alarming trend is the use of AI to enhance phishing scams, refining them, targeting specific individuals, and making these attacks almost impossible to recognise.

Kaspersky reviews how AI is changing phishing techniques and why even the most cyber-aware employees may fall for these scams.

According to a recent Kaspersky study, the number of cyberattacks experienced by organisations in the last 12-months is reported to have increased by nearly half (48%) in the Middle East, Turkiye and Africa (META) region.

The most ubiquitous threat came from phishing attacks, with 51% of those questioned in the META region reporting this type of incident. With AI becoming a more prevalent enabler for cybercriminals, over half of the respondents in META (53%) anticipate significant growth in the number of phishing attacks. In this text, Kaspersky examine how AI is used in phishing and why experience alone is sometimes not enough to avoid becoming a victim.

Personalisation through AI

Previously, phishing attacks relied on a generic mass message sent to thousands, hoping some of the recipients would fall for the bait. AI has changed this into scripting highly personalised phishing emails in large numbers. Using publicly available information like that on social media, job boards, and companies’ websites, these AI-powered tools can generate emails tailored to an individual’s role, interests, and communication style.

For example, a CFO might receive a fraudulent email that mirrors the tone and formatting of their CEO’s messages, including accurate references to recent company events. This level of customisation makes it exceptionally challenging for employees to distinguish between legitimate and malicious communications.

Deepfake technology

AI has also introduced deepfakes into the phishing arsenal. These are increasingly being leveraged by cybercriminals to create fake but highly accurate audio and video messages, crafted to reflect the voice and appearance of the executives they seek to impersonate.

For example, in one reported case, attackers used a deepfake to impersonate multiple members of staff during a video conference, convincing the employee to transfer approximately $25.6 million. As deepfake technology continues to advance, it is expected that such attacks will become more frequent and harder to detect.

Bypassing traditional defenses

Cybercriminals can manipulate the script of traditional e-mail filtering systems with the use of AI. By analysing and mimicking legitimate email patterns, AI-generated phishing emails can bypass security software detection. Machine learning algorithms can test and refine phishing campaigns in real time, enhancing their success rates and making them increasingly sophisticated.

Why experience is not enough

Even experienced employees are falling victim to these advanced phishing attacks. The level of realism and personalisation that AI can achieve may override the skepticism that keeps experienced professionals cautious. Moreover, AI-generated attacks often exploit human psychology, such as urgency, fear, or authority, pressuring employees into acting without double-checking the authenticity of the request.

Combatting AI-hyped phishing

To defend against AI-driven phishing attacks, organisations must adopt a proactive and multi-layered approach that emphasises comprehensive cybersecurity. Regular, up-to-date AI-focused cybersecurity awareness training is critical for employees, helping them identify the subtle signs of phishing and other malicious tactics.

Kaspersky Automated Security Awareness Platform can help with such training. Alongside this, businesses should implement robust security tools, such as Kaspersky Next and Kaspersky Security for Mail Server, capable of detecting anomalies in emails, such as unusual writing patterns or suspicious metadata.

A zero-trust security model also plays a vital role in minimising the potential damage of a successful attack. By restricting access to sensitive data and systems, this approach ensures that even if attackers breach one layer of security, they cannot compromise the entire network. Together, these measures create a comprehensive defense strategy, combining advanced technology with vigilant human oversight.

At least 10 out of every 100 Nigerians have fallen victim to data breaches since 2004, according to a new report by global cybersecurity firm Surfshark, raising serious concerns about the country’s long-standing vulnerability to cyber threats.

Surfshark’s research is based on data gathered from 29,000 publicly available databases.

Each unique breached email address is treated as a separate user account, and breaches often include additional personal data such as passwords, phone numbers, IP addresses, and postal codes.

The data was anonymised before analysis, and countries with populations under one million were excluded from the study.

Findings of the report revealed that a staggering 23.2 million Nigerian user accounts have been compromised in the past two decades, an alarming figure in a country with an estimated population of over 230 million.

This includes 7.3 million unique email addresses and 13 million passwords leaked into the public domain.

“Cyberattacks remain a persistent and growing threat globally, and Nigeria is no exception,” Surfshark stated in its analysis.

Despite a significant 85 per cent drop in new data breaches in the first quarter of 2025, falling from the previous quarter’s numbers—Nigeria still recorded over 119,000 breached accounts during the period. This places the country 34th worldwide in total breach volume.

Even with the recent decline, the scale and depth of past breaches remain troubling.

According to the report, 56 percent of Nigerian users affected by breaches are at heightened risk of identity theft, extortion, and unauthorised access to their online accounts.

“In Q1 2025 alone, an estimated one Nigerian account was breached every minute,” Surfshark noted.

The global picture also shows a dramatic shift: the number of leaked accounts dropped 93 percent year-on-year—from nearly 974 million in Q1 2024 to just 68.3 million in Q1 2025.

Countries with the highest number of breaches include the United States (16.9 million), Russia (4.4 million), and India (4.2 million).

However, when adjusted for population, smaller nations like South Sudan, Spain, and Slovenia reported the highest breach density, with South Sudan recording 61 breached accounts per 1,000 residents.

Luís Costa, Surfshark’s research lead, warned that the downturn in breach numbers should not lead to a false sense of security.

“Cyberthreats are constantly evolving, and attackers are adapting their tactics. Strong security practices, frequent password updates, and enabling two-factor authentication remain essential,” Costa stated.

The report underscores the urgent need for improved cybersecurity infrastructure and public awareness in Nigeria, as millions remain exposed to potential exploitation due to past breaches.

Nigerians seeking to correct their date of birth on the National Identification Number (NIN) database will now pay N28,574, following a major upward review of service charges by the National Identity Management Commission (NIMC).

Bisoye Coker Odusote, CEO, NIMC

The new fee represents a 75 per cent increase from the previous charge of N16,340, making it the most expensive data modification service under the Commission’s revised price regime.

The change is part of a broader review of NIMC’s service fees, which the agency says is necessary to reflect current economic realities, including a national inflation rate of 32.70 percent, rising operational costs, and the need for self-sustenance.

Under the new structure, corrections to other personal details such as names, addresses, and gender now cost N2,000 per modification — up from N1,522, a 31 percent increase.

Re-issuance of the NIN slip, previously pegged at N500, will now attract a fee of N600.

Meanwhile, premium services offered at select enrollment lounges and visa centers will cost N20,000 for NIN enrollment, and N3,500 for re-issuance of slips.

For Nigerians in African countries, NIN enrollment now costs $50 for adults and $30 for children.

Data modifications cost $55 for date of birth changes, and $10 for other fields.

Outside Africa, name corrections are charged at $60, with other data fields remaining at $10 per change.

In an executive summary accompanying the new pricing list, NIMC stated that the adjustments followed consultations across its departments and benchmarking against charges by other government agencies like the Nigeria Immigration Service and the Federal Road Safety Corps.

“For over a decade, our service charges remained stagnant despite expanding our infrastructure and service offerings. This new price regime ensures we can maintain our systems, support national revenue goals, and align with global identity management standards,” the Commission said.

NIMC also cited its role in broader policy objectives such as tax unification, social interventions, and digital identity expansion.

While the Commission insists the fee hike is necessary, many Nigerians have expressed concern about the affordability of the new charges, particularly the high cost of correcting date of birth — an error that often arises from initial registration challenges in rural or crowded centers.