Humans are fundamentally social creatures. Language therefore determines how we socialize and communicate. Language is the foundation of our society because it ensures that we understand each other. As humans, we actually speak two languages: those of government and business and the dialect of the region in which we grew up. And when we hear or read this final version, we feel a kind of solidarity with the person who writes or speaks it. Dialect creates a disarmament effect.

The problem is that Generative AI (GenAI) helps threat actors get into our minds, even if they don’t directly know the subtle accents of our dialect language. Thanks to GenAI, they can more easily establish a social connection with their victims, further amplifying their already compelling fraud and disinformation campaigns.

The language of cybercrime

When we read the dialect of our hometown or our childhood, it can have a strange psychological effect. It creates a feeling of empathy with the person writing it. Even if we see that it is artificially created by GenAI, it may have similar effects.

But unfortunately there are also opportunities for cybercriminals here. Take phishing, for example, which remains one of the leading methods of cyberattacks and accounted for almost a quarter of all ransomware cases in the fourth quarter of 2023. Essentially, phishing is based on social engineering: a fraudster tries to get his victim to comply with his wishes. feed. They do this by using official logos and sender domains. But language also plays an important role.

This is where GenAI can give opportunistic threat actors an advantage. By writing phishing messages in a dialect that the recipient immediately understands, the attacker can gain trust and mislead his victim. This may not work as well in a corporate environment, but it can be used in consumer fraud. GenAI is already predicted to accelerate phishing by generating grammatically perfect content in multiple languages. Why not several dialects?

GenAI is already predicted to accelerate phishing.

Pieter Molen

By the same logic, fraudsters could use GenAI to gain the trust of their victims in romance novels and other forms of trust fraud. The use of dialects can play a crucial role in overcoming our increasingly skeptical attitudes towards people we meet online.

Building bombs and spreading fake news

Another threat is big this year: disinformation. Disinformation and fake news were recently ranked by the World Economic Forum (WEF) as the biggest global risk for the next two years. In 2024, a quarter of the world’s population will vote. As a result, there is growing concern that malicious actors may attempt to influence the results in favor of their preferred candidates or undermine trust in the entire democratic process. As more sophisticated internet users become increasingly critical of the news they read online, dialect could once again be an advantage for threat actors.

Firstly, it is not widely used. This means we pay more attention to content written in a particular dialect. We might read a social media post written in dialect, if only for the pleasure of being able to decipher its meaning. If it’s our own dialect, we may feel more familiar with the person – or machine – who posted it. Politicians and cybersecurity experts can warn us about foreign election interference. But what could be less “foreign” than an account that posts in a local or regional dialect close to home?

Finally, consider how dialects can enable threat actors to “jailbreak” GenAI systems. Researchers at Brown University in the USA used ChatGPT to use rarely spoken languages ​​such as Gaelic. The OpenAI chatbot has special security measures such as: E.g. refusing to give a user instructions on how to build a bomb. However, when the researchers asked ChatGPT to do unethical things in rare languages, they gained access to the forbidden information. According to media reports, Open AI is aware of the risk and is already taking measures to mitigate it. But we must remember that while GenAI appears “intelligent,” it sometimes has the naivety of a four-year-old.

Time for education

Then what is the solution? Of course, AI developers need to build in better protections against misuse of GenAI’s dialect generation capabilities. However, users may also need to better assess potential threats and become more skeptical about what they read and watch online. Companies should incorporate dialect into their anti-phishing/fraud training programs. And governments and industry organizations could run awareness campaigns on a larger scale. As GenAI is increasingly used for malicious purposes, poor language skills may eventually even become a sign of credibility in written communication.

This may not be the case today, but as cybersecurity professionals we must recognize that it could soon be the case.

This is a contribution from Pieter Molen, Technical Director Benelux at Trend Micro. Click here to learn more about the company’s solutions.