When we think about cyberthreats these days, we’re often thinking of ransomware, DDOS and social engineering attacks. The ones that tend to hit the headlines and cost a lot of money.
But there’s a new wave of cyberattacks that we need to be aware of, such as ones that target the validity of the data businesses leaders use to make their decisions and those that can potentially do significant reputational damage.
Pink Slime: fake news sites with real consequences
We’re seeing a wave of websites that seem like legitimate local or industry news outlets, but which exist to push specific agendas. They look like the real deal, but they’re generated by AI and are cheap and easy to create.
The potential threat to organisations arises when people or organisations use these sites to generate articles that are critical of certain organisations.
In the past, one lone ‘hit piece’ blog may not have done much, but Pink Slime sites tend to be supported by networks of bots.
These bots share their articles across social media, boost it by posting outraged comments and go as far as to tag customers, journalists and even regulators. It’s easy for one of these stories to start trending as other, real, social media users read it (or just the headline) and get angry enough to share it with their network too.
While some people do fact check and highlight when an article is mis or disinformation, posts that set the story straight tend to spread much slower than outrage. Plenty of damage is already done.
Bot-driven petitions that pile on fake public pressure
Petitions are a powerful way for people to get their voices heard, and while bots have been signing petitions for years, now AI-tools are making it easy for people with an axe to grind to use them against organisations they take issue with.
Whether it’s hacktivists, a disgruntled current or ex-employee or a competitor, it’s easy for someone to create a petition and manufacture thousands of signatures that show the public, media and other stakeholders how passionately people are against a certain business decision, for example.
But many petitions are, of course, genuine. Spotting the fake ones comes down to looking for things like signatories posting the same comments and large spikes in signatures.
Organisations that are actively listening to their communities often know when a decision is provoking genuine upset, but they still have to deal with the reputational damage that these fake petitions create.
LLM poisoning aka poisoning the well
This is something you see regular social media users encouraging each other to do to sabotage AI, but it’s also happening on a much wider scale. It’s also happening naturally, as more content online is generated by AI, and then AI uses that content to generate yet more content, things get, well messy.
On a large, deliberate, scale you may see attackers flooding the web with misleading info hoping that it gets hoovered up by AI and suddenly pops up in things like the Google Search AI summary for a business. They hope it ends up in training models, basically teaching AI to repeat the desired narrative.
If your organisation uses an internal knowledge source to train AI, someone could input incorrect data or put malicious instructions in the information that feeds the AI tool.
Whether the information comes from internal or external sources, the risk is that businesses come to trust an AI tool that’s been spiked with incorrect data. That’s why it’s vital to just use AI information as a starting point, and to continue using human experience and critical thinking skills to refine and analyse any outputs.
Deepfakes are on the rise
It’s quicker, cheaper and easier to create very convincing deep fakes these days.
All someone needs is a clip of your CEO speaking at a conference and they can create a video of your CEO saying whatever they want them to say. They can then use these videos on Pink Slime sites to further fuel anger against the business.
Sometimes they use these videos in calls to persuade employees to send money to their accounts. And OpenAI and Meta have raised concerns that deepfake video and audio is becoming so sophisticated that it could become harder to verify evidence in trials.
It might seem like it won’t happen to you, but it’s vital to put security processes in place and to prepare you team for being targeted by an attack like this.
How can leaders combat this?
It comes down to trust and planning.
Does your brand have a clear, authoritative and trusted voice and communications channel that people will go to if they see dubious information? Will they trust you when you try to set the record straight?
Is your organisation prepared to deal with someone posting disinformation and the possibility of it creating a much larger misinformation problem that will need to be managed?
These are the sorts of issues organisations are facing today.
—
Image by Kevin Horvat on Unsplash
