← VCE Data Analytics U4O2

Attackers using AI

An attack where criminals use AI to work faster and fool people more easily, such as realistic phishing emails, deepfake voices and automated scanning for weaknesses.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 137, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 43

Understanding Attackers using AI in VCE Data Analytics U4O2

What it does: Automation of attacks means one tool repeatedly tests many systems for vulnerabilities, increasing the speed and scale of an attack. AI-written phishing can be tailored to each person using public details, which makes the message more believable and harder to filter. A deepfake uses AI to imitate a real person's voice, face or video so that victims trust the request. Automation lets attackers probe huge numbers of systems quickly, looking for unpatched software or open ports, without manual effort. AI makes attacks faster and cheaper by automating tasks that once took people hours or days. Deepfakes can look and sound real. Staff procedures such as call-back verification reduce the risk.

Common mistakes: AI-written phishing is usually fluent and polished, so the old warning sign of spelling mistakes is gone. The quality should be fluent with no typos. A deepfake voice is made by AI cloning a short audio clip. The real boss is not speaking, so line 1 should be voice ← AI.clone(audio_clip).

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Attackers using AI to a class →

This module's key terms are also in a printable crossword (Modules 135–150) and word search (Modules 115–150).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Attackers use AI to write phishing emails. What is the main advantage for the attacker?

The emails read as fluent and personalised, so they are harder to spotThe emails can no longer be blocked by any filter

Matches

if email.has_no_spelling_errors: trust(email)

↓

Assuming a message is safe because it is well written. AI-written phishing is polished and has no obvious errors, so spelling cannot be the only check.

Applying

Meanings

Term

AI-powered attack

Meaning

An attack where criminals use AI to work faster and fool people more easily, such as realistic phishing emails, deepfake voices and automated scanning for weaknesses.

Practice

BEGIN AI_powered_attack

Testing

Gaps

email ← .writePhishing(victim)

Check Answer

Spots

2message ← tool.write_email()

3quality ← "full of typos"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Attackers use AI to write phishing emails. What is the main advantage for the attacker?

A. The emails can no longer be blocked by any filter

B. The emails read as fluent and personalised, so they are harder to spot ✓

AI can remove the spelling and grammar mistakes that once gave phishing away and can tailor each message to its target. Filters can still catch many of them.

2. Which one is an example of a deepfake attack?

A. A spreadsheet formula returns an error when a payroll file is opened

B. A cloned voice of a CEO phones staff and asks for an urgent payment ✓

A deepfake uses AI to imitate a real person's voice, face or video so that victims trust the request.

3. True or false: AI lets attackers automate scanning for weaknesses across thousands of systems.

A. True ✓

B. False

Automation lets attackers probe huge numbers of systems quickly, looking for unpatched software or open ports, without manual effort.

4. Which statement best describes how AI changes the speed of attacks?

A. Tasks like writing messages and finding targets can be done in seconds at scale ✓

B. Attacks now need more time because AI must be trained for each victim

AI makes attacks faster and cheaper by automating tasks that once took people hours or days.

5. A staff member gets a video call from their manager, but the voice sounds slightly off and the request is unusual. What is the best response?

A. Verify the request through a separate, trusted channel before acting ✓

B. Act on it straight away because the person looks and sounds familiar

Deepfakes can look and sound real. Staff procedures such as call-back verification reduce the risk.

Match the Pairs

AI-written phishing → A scam message written by AI that has no spelling errors, copies a real company's tone and can be personalised to each target

Deepfake voice → AI-generated audio that copies a real person's voice, used to trick staff into sending money or sharing data

Attackers use AI to automate scanning, so thousands of systems can be probed for weaknesses far faster than a human could manage → automated_scan(targets)

Attackers use AI to produce a different, personalised phishing email for each victim at very low cost → generate_phishing(target_name)

if email.has_no_spelling_errors: trust(email) → Assuming a message is safe because it is well written. AI-written phishing is polished and has no obvious errors, so spelling cannot be the only check.

if voice_sounds_like_boss: send_payment() → Trusting a voice without verifying it. Deepfake audio can copy a real person's voice, so sounding right is not proof of identity.

Key Term

AI-powered attack

An attack where criminals use AI to work faster and fool people more easily, such as realistic phishing emails, deepfake voices and automated scanning for weaknesses.

Fill in the Blanks

1. email ← AI.writePhishing(victim) send(email, victim)

Hint: Type the two-letter abbreviation for the technology that writes the convincing scam message.

2. voice ← deepfake(bossSample) call(staff, voice)

Hint: Type the term for AI-generated fake audio or video that copies a real person.

3. FOR EACH ip IN range scan(ip) IF open THEN record(ip)

Hint: Type the function name that automatically probes each address for weaknesses.

4. FOR EACH target IN victims msg ← AI.writePhishing(target) send(msg, target)

Hint: Type the loop keyword that repeats the attack for every target, which automates it.

5. IF aiEmails > humanEmails THEN faster ← TRUE

Hint: Type the comparison operator showing AI can send more messages than a human can.

Spot the Error

Question 1

A tool ← "AI text generator"

B message ← tool.write_email()

C quality ← "full of typos"

D send(message, target)

Line C — AI-written phishing is usually fluent and polished, so the old warning sign of spelling mistakes is gone. The quality should be fluent with no typos.

Question 2

A voice ← real_boss.speak()

B call ← phone(voice, staff)

C IF staff believe voice THEN

D transfer(money)

Line A — A deepfake voice is made by AI cloning a short audio clip. The real boss is not speaking, so line 1 should be voice ← AI.clone(audio_clip).

Question 3

A targets ← list_of_websites

B FOR EACH site IN targets

C human.check(site)

D save(weak_points)

Line C — Automated scanning uses software to check thousands of sites in a loop without a person. It should be AI.scan(site), not a human checking each one.

Question 4

A data ← scrape(social_media)

B email ← same_template(data)

C send(email, target)

Line B — AI can use scraped personal details to write a tailored, convincing email for each target. A single same template would not be personalised. It should be AI.write(data).

Question 5

A bot ← AI.phishing_bot()

B left ← 100000

C WHILE left > 0

D human.send(next_target)

E left ← left - 1

Line D — Automation lets a bot send huge numbers of messages without a person. A human sending each message would remove the speed advantage. It should be bot.send(next_target).

Student with a class code? Join your class →