The new era of AI-powered cybercrime

Hacking has been on the rise around the world. In 2025, the FBI’s Internet Crime Complaint Center received over 1 million complaints of cybercrime, a record high in the US. Hackers are always getting more creative, and now they have a new tool at their disposal: AI. Interested in more tech in the news? Email us your question at [email protected] mailto:[email protected]. Support public media with NPR+ and enjoy perks for over 25 podcasts like this one. It includes perks like bonus episodes, early access, archive access, curated playlists and sponsor-free listening. Learn more at plus.npr.org http://plus.npr.org. See pcm.adswizz.com https://pcm.adswizz.com for information about our collection and use of personal data for sponsorship and to manage your podcast sponsorship preferences. NPR Privacy Policy https://www.npr.org/about-npr/179878450/privacy-policy

• 0:00Speaker 00

  This message comes from Google Workspace with Gemini, one subscription that does it all. Personalized AI and premium business versions of Gmail, Google Docs, Drive and more. Try it free for 14 days at goo.gle/workspacewithgemini.

• 0:18Speaker 01

  You're listening to Short Wave from NPR.

• 0:23Speaker 02

  Hey, Short Waveers. Regina Barber here.

• 0:25Speaker 01

  And Emily Kwong. And in today's episode of our Tech Camp series, we're talking about hackers, AKA cybercriminals. Cybercrime is on the rise around the world, including in the US. The FBI's Internet Crime Complaint Center received over 1 million complaints of cybercrime in 2025. That is a record high.

• 0:44Speaker 02

  Wow.

• 0:45Speaker 01

  And listen, hackers are always trying to get more creative. But these days, there are so many different ways a cybercriminal can trick you into handing over your password or transferring money or giving them something that they want. And one way is by pretending to be somebody that you can trust. A perfect example of this is in the movie Ocean's Eight.

• 1:06Speaker 02

  Yeah, I remember this. Rihanna, she plays this hacker and she figures out that somebody at the Metropolitan Museum of Art loves like a specific kind of dog.

• 1:14Speaker 01

  Wheaton terriers.

• 1:15Speaker 02

  Yeah. And she sends them an email with this like adoption poster, like flashing, there's colors.

• 1:20Speaker 01

  Yeah.

• 1:21Speaker 02

  And this is so that her and her team can gain access to the Met's security system. Poor thing.

• 1:27Speaker 01

  He has hard eyes for the terriers and he totally clicks on the flyer.

• 1:32Speaker 01

  This scene, by the way, Ryan Callumber loves it. He's the chief strategy officer at Proofpoint, a major cybersecurity company.

• 1:39Speaker 03

  She actually does it perfectly. She understands what kind of content he would interact with and be likely to respond to, and she fishes him. Shout out to Rihanna on this one. Great cybercriminal example there.

• 1:50Speaker 02

  I mean, Rihanna can do anything, really.

• 1:52Speaker 01

  Musician, entrepreneur, hacker.

• 1:54Speaker 02

  Yeah, she's a master hacker.

• 1:55Speaker 01

  Mm-hmm.

• 1:55Speaker 02

  And I guess that's why we need cybersecurity people like Ryan.

• 1:58Speaker 01

  To stand up to them. Yeah.

• 2:00Speaker 02

  Yeah.

• 2:00Speaker 01

  And his field is getting more complicated because of clever attacks like these and, in part, because of AI.

• 2:08Speaker 03

  Because why wouldn't you? It's easier, it's faster, and it's actually harder to detect in a lot of cases.

• 2:14Speaker 01

  For cybercriminals who know what they're doing, AI is a tool that can help them write trickier emails, find more bugs in software and automate parts of their attacks. And it's creating a lot more work for the people defending your networks.

• 2:27Speaker 02

  So today on the show, the future of cybersecurity, how AI is transforming tech and what can be done to stop hackers in their tracks. I'm Regina Barber.

• 2:38Speaker 01

  And I'm Emily Kwong.

• 2:39Speaker 02

  And you're listening to Short Wave, the science podcast from NPR.

• 2:48Speaker 04

  Stay tuned for the following announcements and messages from our sponsors.

• 2:52Speaker 00

  This message comes from Edward Jones. Where they believe rich is more than caring about the latest and greatest, it's also about taking care of what gives your life meaning. That's why your dedicated financial advisor meets you where you are with personalized financial strategies that help protect what matters so you can preserve your progress while creating a path forward. The key to being rich is knowing what counts. Let's find your rich together. Edward Jones. Member SIPC.

• 3:23Speaker 05

  This message comes from Planet Visionaries, the podcast celebrating the people creating practical, hopeful solutions for the planet's urgent conservation challenges. Hosted by legendary climber and advocate Alex Honnold, each episode goes beyond the headlines to show what's actually working and who's making it happen. In partnership with the Rolex Perpetual Planet Initiative, this is Planet Visionaries. Listen or watch wherever you get your podcasts.

• 3:48Speaker 00

  This message comes from Google Workspace with Gemini, one subscription that does it all. Personalized AI and premium business versions of Gmail, Google Docs, Drive and more. Try it free for 14 days at goo.gle/workspacewithgemini.

• 4:07Speaker 02

  All right, Em, I'm super excited for this episode. And I'm also very unsure of where to start because it feels like these attacks can come from anywhere.

• 4:14Speaker 01

  Yeah, so much of daily life is connected to the internet. And that is why, my friend, cybersecurity is so important. So I want to start with one of the key principles in cybersecurity. It is called the cybersecurity triad, or CIA.

• 4:28Speaker 03

  Not that CIA, a different CIA, of course.

• 4:31Speaker 01

  This is Ryan at Proofpoint, who we met earlier, the one who really likes that Ocean's Eight scene. And he explained to me that this CIA stands for confidentiality, integrity and availability. That is the cybersecurity north star.

• 4:44Speaker 02

  So can you give me an example of CIA in action?

• 4:48Speaker 01

  Yeah, OK, I'll give you an example. So say your health records are stored digitally on a shared computer system, right? These records should be available to you, to your medical team, maybe someone at your insurance company. But to stay within that closed circle, they better be encrypted.

• 5:03Speaker 02

  OK, so that's the confidentiality part.

• 5:05Speaker 01

  Mm-hmm. Now, the integrity part means no one should be able to corrupt or edit your health records, you know, to change something about your medication, et cetera. And availability is just about being able to access your data at all.

• 5:18Speaker 03

  In a ransomware attack, your health care information is not available to you, not available to your doctor, to your nurse, to anybody else involved in your care, which has happened in so, so, so many famous cases. Hollywood Presbyterian, actually where my father was born, was the first noteworthy one.

• 5:35Speaker 01

  So back in 2016, this hospital was locked out of their system for two weeks and ended up paying the hackers in Bitcoin to regain access.

• 5:45Speaker 02

  That is so long.

• 5:46Speaker 01

  Yeah. And 10 years later, this perfect triad is becoming more difficult to maintain. Here's Ryan again.

• 5:53Speaker 03

  It's easier to do cybercrime than it's ever been before because the resources to educate yourself or even do it for you are freely available to anybody on the internet.

• 6:06Speaker 02

  Oof, that's so scary. But let's like put a face to the name. Like, who are these cybercriminals these days? I have this mental image of somebody like in a hoodie, in a garage. But I imagine like cybercrime is more sophisticated now.

• 6:20Speaker 01

  It is, for sure. Picture loosely organized networks all over the world, stealing money, information, targeting individuals, yes. But we're also seeing attacks on major companies and supply chains. There is a lot of money to be made there. And sometimes, Gina, these cybercriminals will partner with governments. Hackers doing the bidding of governments are called nation-state actors. There's a lot of this in North Korea, Iran, China, and the Russian Federation.

• 6:48Speaker 02

  Right, this makes me think of the Russian hacking group that interfered with the 2016 election.

• 6:53Speaker 01

  Yeah, and that group, now known as Fancy Bear, was an actual unit of Russian military intelligence. Nation-state actors are always trying to get better and harder to detect. But I want to focus this episode really on cybercriminals and what we know about how they're using AI.

• 7:07Speaker 02

  So can you say more about that? How is AI making attacks better?

• 7:11Speaker 01

  Yeah. So one of the reasons a lot of people use AI is for language, right? And AI breaks the language barrier. Those emails from someone claiming to be a Nigerian prince, written haphazardly in Google Translate, are a thing of the past. Now Ryan says he's seen tidal waves of malicious emails in almost perfect Japanese.

• 7:31Speaker 02

  Wow.

• 7:32Speaker 01

  Then there's the fact that AI makes attacks harder to spot. Think hyper-personalized emails, deep fake voice calls, deep fake video calls.

• 7:40Speaker 02

  Yeah.

• 7:41Speaker 01

  Lastly, there are certain AI models that can find vulnerabilities in computer code itself.

• 7:46Speaker 02

  Yeah, I remember all of our like cybersecurity training lessons here at NPR. And AI was being used to like trick us. So can AI be used for good?

• 7:56Speaker 01

  Like with the vulnerability detection work?

• 7:58Speaker 02

  Yeah.

• 7:59Speaker 01

  Yes, but if bad actors get their hands on those same vulnerability detecting models, that's bad. That worries cybersecurity folks like Ryan. So that's why there's a lot of chatter about this new model from the company Anthropic called Claude Mythos that is really good at discovering computer code vulnerabilities. It helps defenders, but it could also help attackers.

• 8:21Speaker 03

  It helps both sides if they make use of it properly. It makes us faster, it makes our adversaries faster. And the question was, who was going to win that race?

• 8:30Speaker 01

  In June, President Trump signed an executive order about this. The administration wants to require developers to submit certain AI models for government review 30 days before going public with them. All of this is to mitigate the cybersecurity threats posed by AI.

• 8:45Speaker 02

  Wait, so this seems like a change of stance for the president. Wasn't the Trump administration not going to regulate AI?

• 8:53Speaker 01

  It did seem that way.

• 8:54Speaker 02

  OK.

• 8:54Speaker 01

  Yeah. But their argument now is these tools could be dangerous in the hands of cybercriminals and other bad actors. I will say, though, the same is true on the other side. AI can help the good guys, too. It can help cybersecurity experts like Ryan find holes in code and patch them.

• 9:12Speaker 02

  Wow. So AI is having almost a civil war within itself, like good AI fighting bad AI, and then it turns into good AI.

• 9:20Speaker 01

  At the direction of humans, yeah.

• 9:21Speaker 02

  Yeah.

• 9:22Speaker 01

  Yeah, yeah, yeah. And one of the things Ryan wants to do is train our email agents, like Microsoft Copilot or Google Gemini, to stand their ground against this other malicious AI.

• 9:32Speaker 02

  Mm-hmm.

• 9:32Speaker 03

  If you can just convince the AI to do something, then some of that same human risk has now become AI risk. And if our AI agents are just as gullible as us, that's a big problem.

• 9:43Speaker 02

  Wow, I hadn't even thought of that.

• 9:45Speaker 01

  Yeah, I feel like this whole episode, I'm just watching your eyes get wider and wider and wider.

• 9:49Speaker 02

  Yeah.

• 9:50Speaker 01

  But no, at the end of the day, governments and companies and cybersecurity experts are responsible for this. They have a lot of work to do to deal with these problems. And in the meantime, training can help prepare us individuals for this future.

• 10:04Speaker 03

  What I would love is if, for once, the defenders are able to move faster than the attackers.

• 10:11Speaker 01

  But we need to mobilize the defender workforce, not enough people like Ryan do this work. According to the ISC2 2024 Cybersecurity Workforce Study, there are over 500,000 unfilled cybersecurity positions in the US.

• 10:25Speaker 02

  Yeah, I remember when I was teaching at Western Washington University, there was just a huge push for people to go into this field.

• 10:31Speaker 01

  Oh, really?

• 10:31Speaker 02

  Yeah. So someone also trying to make that push is Charlene Cooper. She's the director of cyber.org and focuses on K through 12 cybersecurity education. Charlene's got a 16-year-old son and has learned this technology, for all its upsides and downsides, right alongside him.

• 10:47Speaker 06

  There was a misconception he had about...

• 10:51Speaker 06

  People that were online and it was like, well, this person says they're from here, here and here. And I'm like, but how do you know that for sure?

• 10:57Speaker 01

  I live by the old X-Files rule, trust no one. Right? Like, I tell my kid to always verify and just like, don't talk to strangers. I've made her more scared of the world, but you know what? She is skeptical of the internet. Yeah, that makes sense. Because honestly, a lot of Charlene's work lately is focused on training caregivers and teachers to be comfortable talking to their kids about their digital hygiene.

• 11:20Speaker 06

  Asking questions like, what do you like to do online? What types of sites are you going to?

• 11:27Speaker 01

  And especially if your child is engaging in chatting people on websites, on online video games. Roblox. Teach your kid to not give away any personal information.

• 11:36Speaker 06

  Their name, their school name, their age, where they live.

• 11:39Speaker 01

  Oh, stranger danger. They need to know that. Yeah, stranger danger will save you. And for kids who want to level up their cybersecurity education even further, they can go to camp. So I'm going to introduce you to Ashley Poterodski. She's the vice president for research and economic development at Dakota State University. And there, she co-founded an entire organization devoted to teaching the next generation cybersecurity. It's called Cyb Her. And at Cyb Her, they offer a residential cybersecurity summer camp for students who want to learn how to do things like crack a password.

• 12:11Speaker 07

  Not because we're trying to create little hackers, but we're trying to get them to understand how easy it is for a bad actor to crack a password.

• 12:19Speaker 01

  And then she has campers make their own password as a test.

• 12:23Speaker 07

  And then the algorithm that we're using to crack the password says it's going to take 200 years with current computing power. Then they know they made a good password.

• 12:31Speaker 01

  Oh, that's so cool. It's like being graded right away, too. You're such a student. I know. And that's good. That's the right attitude. I mean, all the experts I spoke to kept saying cybersecurity is not an all-tech field. It's really a critical thinking field. It's about problem solving. So if AI is making it easier to commit cyber crimes, let's make it easier for young people to get involved and fight back. Here's Ashley.

• 12:56Speaker 07

  So growing up, people always said, are you good at math and science? Maybe you should look at a career in STEM. I think we need to flip that. I think we need to ask kids, are you curious? Do you like technology? Do you want a high-paying job? And if they can say yes to those three, then that's something that they should pursue for STEM and cyber.

• 13:16Speaker 01

  Emily Kwong, thank you so much for bringing another illuminating story. You're welcome, Gina. There are a ton of resources we've included with this episode from Cyb Her and cyber.org. Check out the link in our show notes. If you liked this episode, check out the rest of our series on our tech future. We're airing episodes every Monday through August. We know the future's scary, but we can get through it together. I'm excited about the future. This episode was produced by Hannah Chin. It was edited by our showrunner, Rebecca Ramirez, and fact-checked by Tyler Jones. Special thanks also to Jenna McLaughlin, NPR cybersecurity correspondent, who reports on this stuff around the clock. Robert Rodriguez was the audio engineer. I'm Regina Barber. And I'm Emily Kwong. Thank you for listening to Short Wave from NPR.

• 14:04Speaker 00

  Stay tuned for the following announcements and messages from our sponsors.

• 14:08Speaker 04

  This message comes from EasyCater. Making it easy for organizations to order food for meetings and events from favorite restaurants, set up meal programs for their employees, and manage food spend all in one place. At easycater.com.

• 14:22Speaker 08

  This week on Consider This, an investigation into widespread complaints about sales tactics at mall skincare kiosks led NPR to a company in California.

• 14:31Speaker 09

  Am I being recorded? Yeah. OK, delete that, and we're not interviewing. If you need anything, you can contact our legal department.

• 14:37Speaker 08

  We investigate a group that supplies mall skincare stores that left customers with thousands of dollars in bills. Listen now on Consider This from NPR.