AI-aided scams are here. And ESET comes up with tools to stop them

The reality of cybersecurity in the AI era is evolving rapidly, but several trends have already become clear. AI is not creating futuristic “super malware,” yet it is making attackers and their tools far more efficient. Tasks that once required significant skill and time, such as crafting convincing phishing emails, producing deepfake content, or assembling malicious code, can now be completed much faster, leading to a surge in the volume and speed of attacks rather than a dramatic leap in sophistication.

Scammers, in particular, benefit from these advancements. Unlike traditional cybercriminals who rely heavily on malware, scammers focus on social engineering and reaching as many targets as possible. AI enhances their ability to scale these efforts quickly and convincingly, making their campaigns more widespread and harder to detect.

At the same time, even popular legitimate AI tools have become targets themselves. Attackers can exploit or manipulate them to spread malicious links or amplify scams.

In response to this shifting landscape, ESET has enhanced its anti-scam protection within ESET HOME Security, protecting everyday users, and ESET Small Business Security, tailored for small offices / home offices (SOHO), with new features aimed specifically at addressing AI-driven threats and safeguarding AI tools.

Key points of this article:

• AI is scaling up traditional attacks, not replacing them. Common attack methods (like phishing, social engineering, and scam campaigns) are faster, cheaper, and easier to spread.
• From personalized phishing and deepfake voice/video impersonation to fake ads and chatbot-driven fraud, AI significantly enhances scammers’ abilities to deceive victims at scale.
• AI tools themselves are becoming targets. Attackers increasingly exploit legitimate AI systems (like AI assistants or chatbots) to spread malicious links, inject harmful code, or access sensitive data.
• To defend their digital lives, users first need to be aware of these new threats and then harden their security with anti-scam technology.
• ESET increasingly identifies scams as a main threat to consumers and small businesses, so it has introduced new features dealing with AI-related attacks to help combat them in both ESET HOME Security and ESET Small Business Security.

How AI has changed cybersecurity

The malicious use of AI is already visible in multiple cyberthreat reports. Its use is quickly evolving, but so far, AI has mostly helped attackers become more effective when using traditional techniques.

This can be seen, for example, in Verizon’s analysis of Anthropic’s (developers of the Claude AI model) data: An average attacker prompting Anthropic’s large language models (LLMs) was attempting to get assistance with around 15 already well-known malicious techniques mostly used in phishing (44%), exploit of software vulnerabilities (32%), and password and login credential abuse (21%), according to the Verizon 2026 Data Breach Investigations Report.

When it comes to more sophisticated attacks, there are only a handful of AI-powered malware samples in the wild, such as PromptSpy discovered by ESET researchers.

ESET AI-powered security is designed to even detect never-seen-before or zero-day cyberthreats. However, at the time of writing, ESET’s threat data contains zero incidents in which generative AI played a significant “active” role (i.e., direct use of AI to generate malware and scripts).

On the other hand, ESET researchers see how attackers increasingly target legitimate AI tools, just as they target any other popular legitimate software. ESET analysis of around 800,000 agentic skills between March and May 2026 found over 25,000 suspicious cases and more than 2,500 that could be classified as malicious right away.

What’s an AI agentic skill? AI skills are similar to browser plugins. They are small packages of instructions, data, code, and sometimes even tools that extend the functionality of your AI agent. However, just like some browser plugins, AI skills can be abused to turn your AI agent into spyware or to deliver other types of malware.

What’s an AI agentic skill?

AI skills are similar to browser plugins. They are small packages of instructions, data, code, and sometimes even tools that extend the functionality of your AI agent. However, just like some browser plugins, AI skills can be abused to turn your AI agent into spyware or to deliver other types of malware.

IBM’s Cost of a Data Breach Report 2026 confirms that AI tools are becoming high-value targets, with 21% of organizations reporting breaches that involved their AI models or applications.

How scammers use AI

In 2025, Americans lost $64.8 billion to scams, with the average American encountering a scam attempt on a daily basis (377 times per year), according to the Global Anti-Scam Alliance (GASA) report highlighting the increase in scam sophistication due to AI tools.

Let’s see how scammers can abuse AI for their malicious needs.

More convincing phishing emails

AI can generate clean, well-written emails with proper grammar, tone, and formatting. This removes the classic “bad English” giveaway and makes messages look like they came from real companies or colleagues.

Personalized spear‑phishing

Attackers can feed AI with publicly available data (LinkedIn profiles, company websites, social media, or stolen data from data breaches) to craft highly tailored messages that reference a person’s job, projects, or contacts.

Automated social media reconnaissance

AI can rapidly scrape and analyze large amounts of social media data to map relationships, interests, habits, and routines, helping attackers choose the right angle for a scam.

Deepfake voice scams (vishing 2.0)

AI-generated voices can imitate real people, such as a CEO or family member, to trick victims into sending money or sharing sensitive information during phone calls.

Deepfake video impersonation

In more advanced cases, criminals use AI-generated video in meetings (or recorded clips) to impersonate executives and authorize fraudulent transactions. They also can impersonate recruiters or job applicants in recruitment scams.

Realistic fake ads

Scammers create fake ads, often featuring famous personalities selling miraculous products or investment opportunities. These ads serve as initial hooks for phishing via contact forms or websites.

Spoof websites and ‘realistic fake’ websites

AI tools help create professional-looking landing pages and fake online stores that closely mimic legitimate brands, increasing the chances people will trust them.

Chatbot-powered scams

Malicious actors can deploy AI chatbots that interact with victims in real time, answering their questions, building trust, and guiding them through scams (e.g., fake tech support).

Language translation and localization

AI can instantly translate scam content into many languages, making attacks global and culturally adapted instead of generic.

Fake reviews and reputation building

AI-generated reviews can make scam websites or products look trustworthy, boosting credibility before victims even realize something is off.

Image and document forgery

AI tools can create realistic-looking invoices, IDs, screenshots, or payment confirmations to support scams and make them more believable.

AIFix

Often discussed as an AI boosted ClickFix, this social-engineering technique uses AI-generated content (fake tech support messages, fake CAPTCHA checks, or fabricated error screens) to trick users into manually running malicious commands on their own devices.

How to protect yourself from scams

As technology progresses and makes phishing more personalized and deepfakes increasingly believable, users need to stay more vigilant than ever before. Don’t assume that you can recognize phishing just by typos in an email.

Assume real-looking content can be fake

AI can create emails, voices, videos, and websites that look completely genuine. Even if something appears professional or familiar, it might not be real. Always be cautious about trusting appearances.

Verify requests through a second channel

If someone asks for money, passwords, or sensitive information, confirm the request another way. Call the person directly or contact them using a method you already trust instead of replying to the original message.

Watch for urgency and pressure

Scammers often try to rush you with messages that demand immediate action. They may say something is urgent or confidential. These situations are designed to make you act without thinking, so always slow down.

Never share credentials or one-time codes

No legitimate company will ask for your password or verification codes. Even if the message looks official, do not share login details. Always go directly to the website instead of using links in messages.

Be careful with fake online identities

AI can create convincing profiles on social media and professional platforms. Someone can appear trustworthy over time while building a fake relationship. Do not assume someone is real just because they seem consistent.

Treat audio and video with caution

Voices and videos can now be faked using AI. A message that sounds like your boss or colleague might not actually be from them. If something feels unusual, verify it before taking action.

Be cautious with AI tools

Do not share sensitive information with unknown or untrusted AI services. Also remember that AI can produce confident but incorrect results, so important information should always be verified.

Be skeptical of investment offers

AI is used to create very convincing financial scams, especially in cryptocurrency and online investing. Offers that promise high or guaranteed returns should be treated with suspicion.

Pause before acting

The most important habit is to stop and think before responding. Scammers rely on quick emotional reactions. Taking a moment to check and verify can prevent most scams.

Maintain good security habits

Use strong and unique passwords, enable multifactor authentication, and keep your devices updated. These basic steps can prevent many common attacks.

How ESET uses AI to prevent AI-powered scams

Following the “fight fire with fire” principle, ESET uses advanced AI, guided by human expertise, to stop modern scams across the multiple operating systems (Windows, macOS, Android, iOS) and devices people rely on.

ESET HOME Security is not just an antivirus software; it’s all-in-one protection for your digital life, covering the most common entry points for attackers (including AI tools) and providing extra layers of security against scammers. At the same time, it has been created with the goal of being very easy to operate so users do not get lost in complex functionality.

ESET AI Security:

AI Conversation Security – Safeguards interactions between end users and ChatGPT (other major LLMs will be integrated in the future.) ESET AI Conversation Security proactively scans URLs found in LLM responses and flags content that originates from phishing, malicious, or potentially unwanted content sources and then informs users that the referenced content may not be safe before they click on it. It also scans scripts (functional section of software code) generated by the LLM to help prevent users from running malicious code on their devices.

AI Agent Security – Scans what AI agents want to access and download before execution happens. It proactively protects against unsafe files or scripts downloaded by AI tools and suspicious external URLs.

AI Skills Checker – A free online tool powered by AI Agent Security technology. It scans AI skills (add-ons for AI tools, enhancing their functionality) for signs of malicious activity and risky behavior before users install and use them.

AI Behavioral Monitoring – Works closely with AI Agent Security, constantly observing the behavior and actions of AI agents to detect anomalies and potential security threats in real time.

ESET protection against scams:

Anti-Phishing – ESET Anti-Phishing protects users against malicious links that may appear in messages sent by scammers leading to phishing websites designed to steal sensitive data. It also prevents users from opening malicious websites while browsing the internet. ESET Anti-Phishing is also available for iOS as a part of ESET Mobile Security for iOS.

Safe Banking & Browsing – This feature creates a secure, isolated browser window for browsing, banking, and making online purchases. This isolated environment offers additional protection against malware, keyloggers, and other digital threats, helping to safeguard your financial data during online transactions.

Browser Privacy & Security – ESET browser extension for Windows checks Google search results and rendered HTML in the browser for phishing, malware links, and potentially unwanted content delivered, for example, via search engine poisoning (SEO poisoning).

Browser Screen Protection – ESET has now expanded its Safe Banking & Browsing with Browser Screen Protection, preventing attackers from taking screenshots or screen recordings of the opened browser window. This can come in handy if scammers trick users into granting them remote access privileges (for example, during fake tech support scams).

Identity Protection – ESET provides a dark web scanning service, alerting users to any harmful or inappropriate activity related to their personal data. This can help prevent various impersonation scams and spear phishing attacks.

ESET LiveGuard – If scammers trick users into downloading and installing malware (for example, through a malicious email attachment), it’s time for an ESET AI-powered anti-malware solution. ESET LiveGuard is a cloud-based protection module that runs suspicious samples in a virtual sandbox where they are evaluated by our advanced malware detection engines.

Real-Time File System Protection – This feature checks all files in the system for malware when opened, created, or run.

Exploit Blocker – Some scammers can test the maturity of your software by checking for popular applications with a pending update or can exploit unknown vulnerabilities in zero-day attacks. ESET Exploit Blocker protects commonly exploited application types, such as web browsers, PDF readers, email clients, and Microsoft Office components, via constant monitoring of processes for suspicious activities.

Protecting SOHO Microbusinesses and self-employed users are as vulnerable to scams as regular users. That is why ESET Small Business Security includes all the above anti-scam features and AI tool protection, along with a Safe Server feature for file servers. It also includes Web Control, which regulates employees’ access to selected websites and helps prevent exposure to harmful or inappropriate content

Protecting SOHO

Microbusinesses and self-employed users are as vulnerable to scams as regular users. That is why ESET Small Business Security includes all the above anti-scam features and AI tool protection, along with a Safe Server feature for file servers.

It also includes Web Control, which regulates employees’ access to selected websites and helps prevent exposure to harmful or inappropriate content

Stay safe in this new AI era

AI is fundamentally reshaping the cybersecurity landscape, not by introducing entirely new forms of cyber threats but by dramatically increasing the speed, volume, and sophistication of existing ones. Scammers and cybercriminals are leveraging AI to automate and personalize attacks at scale, making them harder to detect and more convincing than ever. As a result, relying on traditional clues and warning signs like poorly written emails is no longer sufficient.

To stay safe in this new environment, users must combine heightened awareness with modern security tools. Solutions like ESET HOME Security demonstrate how AI can be used defensively to detect and block these evolving threats across devices and platforms. Ultimately, the most effective protection comes from a layered approach: smart security software, cautious online behavior, and a mindset that questions even the most realistic-looking digital interactions.

Frequently Asked Questions (FAQs)

How exactly is AI used in scams today?

AI is used to generate convincing phishing emails, create deepfake voices or videos, build fake websites, automate conversations through chatbots, and personalize attacks using publicly available data.

Are AI-powered cyberattacks more dangerous than traditional ones?

They are not necessarily more technically advanced, but they are more effective because they are faster, more scalable, and more convincing, making them harder to detect.

What are “AI skills,” and why are they risky?

AI skills are add-ons that extend an AI agent’s functionality, similar to browser plugins. If compromised, they can be abused to deliver malware, spy on users, or inject malicious instructions.

How can I protect myself from AI-driven scams?

You should verify requests through a second channel, avoid sharing sensitive data, be cautious with urgent messages, question realistic-looking content, and use strong security tools with AI-based protection.

How does ESET help protect against AI scams?

ESET HOME Security and ESET Small Business Security offer features like AI Conversation Security, anti-phishing protection, secure browsing environments, AI skills scanning, and real-time threat detection to defend against both traditional and AI-enhanced attacks.

What is ESET AI Security?

ESET AI Security is a brand-new security layer designed to protect against emerging threats that exploit increasingly popular AI tools. It consists of several features:

• AI Conversation Security monitors interactions between users and large language models, detecting and flagging malicious content, suspicious URLs, and unsafe generated scripts.
• AI Agent Security inspects the access requests and downloads initiated by AI agents to prevent potentially harmful actions. It also analyzes AI skills before installation, identifying signs of malicious activity and risky behavior.
• AI Behavioral Monitoring constantly monitors AI agents’ behavior and actions.