In simulated phishing attacks targeting corporate employees, emails promoting AI and the latest technology recorded high click rates. The analysis said employees can be easily deceived by attacks that subtly exploit work-related interests.

On Oct. 19 (local time), IT media outlet TechRadar reported that global cybersecurity firm Kaspersky said an analysis of anonymous data from its phishing simulator found AI and technology-related emails were the most effective type of attack. The study was based on more than 150,000 simulated phishing emails sent this year from January to September to employees in 120 countries worldwide.

In particular, an email using the subject line "Introducing next-generation AI" led 45 percent of recipients to click the link. It meant close to 1 in 2 employees clicked a suspicious link out of interest in new technology.

The average click rate for healthcare and insurance-related emails was 28 percent. Among them, a specific email disguised as a hygiene inspection report recorded a 92 percent click rate. Emails on IT policy and compliance had 26 percent, giveaways and promotions 24 percent, and HR and internal notices 22 percent.

In an individual case, an email saying recipients could receive a prize by wearing a national soccer team jersey also had a click rate of 66 percent.

Svetlana Kalashnikova (스베틀라나 칼라슈니코바), a security awareness expert at Kaspersky, explained, "Employees respond more easily to emails closely tied to real work or local interests." She pointed out that the spread of generative AI has also made it easier for attackers to craft such tailored messages.

As the sentences and phrasing in phishing emails become more natural, it has become harder to distinguish attacks based only on awkward grammar as in the past. Kaspersky advised, "You should check the sender address, links and attachments, and be wary of emails demanding urgent action by citing things like account suspension." It also stressed, "Based on our own security training materials, regular training and simulated attack drills can reduce the phishing vulnerability rate from 60 percent to 5 to 7 percent."

Kaspersky added that the results were based on an analysis of simulated training rather than actual cyberattacks, and click rates do not necessarily mean personal data leaks or malware infection rates.