Attackers using AI

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Attackers use AI to write phishing emails. What is the main advantage for the attacker?

A The emails can no longer be blocked by any filter

B The emails read as fluent and personalised, so they are harder to spot

2. Which one is an example of a deepfake attack?

A A spreadsheet formula returns an error when a payroll file is opened

B A cloned voice of a CEO phones staff and asks for an urgent payment

3. True or false: AI lets attackers automate scanning for weaknesses across thousands of systems.

A True

B False

4. Which statement best describes how AI changes the speed of attacks?

A Tasks like writing messages and finding targets can be done in seconds at scale

B Attacks now need more time because AI must be trained for each victim

5. A staff member gets a video call from their manager, but the voice sounds slightly off and the request is unusual. What is the best response?

A Verify the request through a separate, trusted channel before acting

B Act on it straight away because the person looks and sounds familiar

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1AI-written phishing		Aautomated_scan(targets)
2Deepfake voice		BTrusting a voice without verifying it. Deepfake audio can copy a real person's voice, so sounding right is not proof of identity.
3Attackers use AI to automate scanning, so thousands of systems can be probed for weaknesses far faster than a human could manage		Cgenerate_phishing(target_name)
4Attackers use AI to produce a different, personalised phishing email for each victim at very low cost		DA scam message written by AI that has no spelling errors, copies a real company's tone and can be personalised to each target
5if email.has_no_spelling_errors: trust(email)		EAI-generated audio that copies a real person's voice, used to trick staff into sending money or sharing data
6if voice_sounds_like_boss: send_payment()		FAssuming a message is safe because it is well written. AI-written phishing is polished and has no obvious errors, so spelling cannot be the only check.

Definitions

AI-powered attack

Fill in the Blanks

Complete each line of code by filling in the missing parts.

email ← __.writePhishing(victim) send(email, victim)

voice ← ________(bossSample) call(staff, voice)

FOR EACH ip IN range ____(ip) IF open THEN record(ip)

________ target IN victims msg ← AI.writePhishing(target) send(msg, target)

IF aiEmails _ humanEmails THEN faster ← TRUE

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A tool ← "AI text generator"

B message ← tool.write_email()

C quality ← "full of typos"

D send(message, target)

Question 2

A voice ← real_boss.speak()

B call ← phone(voice, staff)

C IF staff believe voice THEN

D transfer(money)

Question 3

A targets ← list_of_websites

B FOR EACH site IN targets

C human.check(site)

D save(weak_points)

Question 4

A data ← scrape(social_media)

B email ← same_template(data)

C send(email, target)

Question 5

A bot ← AI.phishing_bot()

B left ← 100000

C WHILE left > 0

D human.send(next_target)

E left ← left - 1

Answer Key

Attackers using AI

Section A: Quick Questions

B — The emails read as fluent and personalised, so they are harder to spot

B — A cloned voice of a CEO phones staff and asks for an urgent payment

A — True

A — Tasks like writing messages and finding targets can be done in seconds at scale

A — Verify the request through a separate, trusted channel before acting

Section B: Match the Pairs

AI-written phishing → A scam message written by AI that has no spelling errors, copies a real company's tone and can be personalised to each target

Deepfake voice → AI-generated audio that copies a real person's voice, used to trick staff into sending money or sharing data

Attackers use AI to automate scanning, so thousands of systems can be probed for weaknesses far faster than a human could manage → automated_scan(targets)

Attackers use AI to produce a different, personalised phishing email for each victim at very low cost → generate_phishing(target_name)

if email.has_no_spelling_errors: trust(email) → Assuming a message is safe because it is well written. AI-written phishing is polished and has no obvious errors, so spelling cannot be the only check.

if voice_sounds_like_boss: send_payment() → Trusting a voice without verifying it. Deepfake audio can copy a real person's voice, so sounding right is not proof of identity.

Section C: Definitions

AI-powered attack — An attack where criminals use AI to work faster and fool people more easily, such as realistic phishing emails, deepfake voices and automated scanning for weaknesses.

Section D: Fill in the Blanks

email ← AI.writePhishing(victim)
send(email, victim)

voice ← deepfake(bossSample)
call(staff, voice)

FOR EACH ip IN range
    scan(ip)
    IF open THEN record(ip)

FOR EACH target IN victims
    msg ← AI.writePhishing(target)
    send(msg, target)

IF aiEmails > humanEmails THEN
    faster ← TRUE

Section E: Spot the Error

C — AI-written phishing is usually fluent and polished, so the old warning sign of spelling mistakes is gone. The quality should be fluent with no typos.

A — A deepfake voice is made by AI cloning a short audio clip. The real boss is not speaking, so line 1 should be voice ← AI.clone(audio_clip).

C — Automated scanning uses software to check thousands of sites in a loop without a person. It should be AI.scan(site), not a human checking each one.

B — AI can use scraped personal details to write a tailored, convincing email for each target. A single same template would not be personalised. It should be AI.write(data).

D — Automation lets a bot send huge numbers of messages without a person. A human sending each message would remove the speed advantage. It should be bot.send(next_target).