Week 8: Threats from the Inside: How Attackers Use AI

Dates: Mar 1-5  ·  Reading: Handout 7: AI-Powered Attacks

This week flips perspective: we study how attackers use AI so we can detect and defend against it (never to carry it out). Monday: why attackers love AI, and the major AI-powered attacks - phishing, deepfakes, credential stuffing, reconnaissance, and adaptive malware - each paired with its defense. Wednesday: real case studies, how to detect AI phishing, and a layered defensive strategy. Lab 7 released this week. Exam 2 (Weeks 5-8) is during Week 9.

📄 Read Handout 7 (PDF)

Learning Objectives

• Explain how attackers use machine learning and AI
• Describe AI-powered phishing, deepfakes, and credential stuffing
• Understand AI-driven reconnaissance and adaptive malware
• Relate each attacker AI technique to a defensive countermeasure

Lecture Slides

⬇ Monday: How Attackers Use AI (PPTX) ⬇ Wednesday: Cases & Defense (PPTX)

Two full 75-minute decks, CSU-branded, with attack-scaling, attack-lifecycle, phishing-feature, and defense-map figures, defensive Colab code, activities, and detailed speaker notes on every slide.

Monday Session

Why AI is a force multiplier for attackers (scale, speed, personalization, adaptivity). Attacks that fool people - AI phishing, deepfakes/voice fraud, and credential stuffing - and attacks that fool machines - automated reconnaissance and adaptive malware. Each technique is paired with a concrete defense, most of which you already learned (MFA, ML filters, anomaly detection).

Wednesday Session

Real case studies of AI-powered campaigns (BEC, deepfake fraud, credential stuffing, AI-assisted recon/malware), then the hands-on defense: detecting AI phishing by turning emails into features and training a classifier, reading its false positives/negatives, and assembling a layered defense across people, process, and technology.

Lab

Lab 7: Adversarial Email Generation (for Defense). A sandboxed, purely educational lab: briefly see how a template generator scales obviously-fake phishing (to study the patterns), then turn emails into features and build a detector (~96% accuracy). Nothing is ever sent; no real targets.

⬇ Lab 7 starter notebook (.ipynb)

Download, then open in Google Colab (File → Upload notebook). Submit your completed notebook in Canvas.

Quiz / This Week

Quiz 7. Attacker use of AI; phishing, deepfakes, credential stuffing, reconnaissance, adaptive malware; and the matching defenses.

In-Class Activity

Evade the Filter: Adversarial Email Generation — CTFd capture-the-flag challenge (Colab + browser). Graded, 20 points.

⬇ Activity slides (PPTX) 📄 Student worksheet (PDF)

🚩 CTF challenge starter (.ipynb)

Graded in-class activity with a worksheet. Full rotation on the Activities page.

---

← All lecture notes  ·  Assessments unlock on the Quizzes and Labs pages when the instructor releases them.