ESET researchers warn of new phase of social engineering

According to ESET telemetry, in the six months from December 2024 to May 2025, phishing attacks accounted for roughly 37% of all threats detected in Malaysia.

AI powered social engineering is making it more complicated for organizations in Malaysia as cybercriminals are now capable of convincing communications, manipulating digital environments and influence user behavior.

In a media briefing in Kuala Lumpur, Righard Zwienenberg, Senior Research Fellow at ESET, shared that AI powered social engineering is wreaking havoc on organizations in ways that traditional phishing tools never achieved. Specifically, he believes that as AI systems are increasingly polluted by a mix of misinformation and intentionally crafted fake content, the polluted ecosystem provides attackers with endless material to weaponize, making it harder for users to recognize when something is fabricated, distorted, or malicious.

According to ESET telemetry, in the six months from December 2024 to May 2025, phishing attacks accounted for roughly 37% of all threats detected in Malaysia, making it the most prominent category. Other threat types appeared in far smaller volumes.

One of the threats detected in Malaysia is Formbook. The threat is designed to steal a wide variety of sensitive data. It represented about 26 percent of all detected infostealers, surpassing multiple other families and reinforcing its status as the leading tool used to harvest credentials across the country. Infostealers are information stealing malware that has become a major driver for identity theft.

Looking at the delivery mechanism in the country, scripts and executable files make up more than three quarters of all email threats in Malaysia, far exceeding malicious Office documents. This shift aligns with global patterns, where attackers increasingly rely on AI assisted automation to scale their campaigns.

Examples of script and executable files of attack are an AI powered ransomware called PromptLock, which was uncovered by ESET. Unlike conventional malware, which must be coded and refined by human developers, PromptLock used a locally deployed language model to generate malicious scripts in real time. The AI autonomously determined what to scan, copy, encrypt, or destroy, producing unique scripts with each execution.

ESET now detects more than 500,000 new unique malware samples every day. This number continues to climb as generative AI makes creation of malicious code more efficient.

Zwienenberg highlighted that such threats will only get more complicated and organizations will need to make sure they are well prepared to deal with these threats. At the same time, he also acknowledges the challenges companies face in ensuring their employees remain vigilant, especially when it comes to using AI tools and sharing personal data.

With social media being a platform whereby a lot of personal data including daily activities and such is shared, Zwienenberg pointed out that cybercriminals can be watching and tracking these activities as well to gather information on specific individuals of a company and to then use AI to manipulate the person’s identity to launch a cyberattack on a company.

ESET researchers believe there are five AI enabled methods that are now shaping the threat landscape. This includes:

“AI was supposed to make information clearer, but today it is increasingly polluted by misinformation and deliberately crafted fakes. That polluted ecosystem is now feeding the next wave of cyberattacks. Threats are moving faster, adapting quicker, and sounding more human than ever,” Zwieneberg said.

“In Malaysia, phishing and infostealing remain dominant, but the real shift is in how AI accelerates and reshapes these attacks. The goal is no longer to trick someone into clicking a link, it is to influence their judgement in a moment of urgency or trust. As long as people overshare and systems remain underdefended, attackers will continue to exploit that gap,” Zwienenberg added.

Zwienenberg also mentioned that many worry about privacy yet overshare more than ever, especially on social platforms and messaging apps. Coupled with the country’s strong FOMO driven culture, social engineering techniques thrive. These behaviors continue to fuel ransomware cases, credential theft, and scam-related financial losses.

As such, the best defense remains a mix of awareness and the right tools. Cybercriminals rely on human error and reducing that gap is key.