# Hybrid Threats > [!abstract] What this note is > Attacks that combine a human operator, AI-generated content, and legitimate infrastructure. They are harder to detect than purely technical attacks, because no single piece of them is malicious. Part of [[AI Security for Users]]. ## Why they beat detection A technical attack leaves an artifact: a poisoned page, a malicious package, a forged sender. Filters are built to find artifacts, and they judge **one message, one file, one request at a time**. A hybrid attack has no bad artifact. Real infrastructure delivers a well-written message from an address that passes every check, and a person answers if you reply. What makes it hostile is the **pattern over time**, and pattern is the one thing per-message filtering cannot see. ## The shapes worth knowing **Reply-chain hijacking.** Someone gains access to a real correspondent's mailbox and answers inside a thread you already started. The history is genuine, the address is genuine, authentication passes, and a language model can match the person's usual phrasing. This is the hardest one to catch, and it is how much invoice and payment-detail fraud arrives. **Laundering through trusted services.** The message comes as a document share, a calendar invite, an e-signature request, or a mainstream mail platform's newsletter. The sending infrastructure really does belong to a company you trust, so reputation checks pass. A human sets it up; a model writes the copy. **Outreach as reconnaissance.** Unsolicited commercial email is legal, so nothing blocks it, and every send is a probe: does the address bounce, was it opened, is this person still in that role, what software do they run. The answers feed better-targeted approaches later, sometimes from a different party who bought the list. A flood of low-quality outreach is not only annoying; it is a sign that your details are circulating in sales databases, and those are the same databases a social-engineering campaign starts from. **Multi-channel, low and slow.** An email, then a professional-network message, then a text, then a call from a plausible local number. Each channel sees one harmless contact. Nothing correlates them, so no system ever sees the campaign. **Dual-payload messages.** One email that reads as ordinary business to the person and carries instructions aimed at the person's AI assistant. Neither layer looks wrong alone. See [[Prompt Injection]]. **The plausible inbound lead.** For anyone who sells services: a project enquiry with a brief attached, or a link to a specification document. The pretext fits the work exactly, and a real person replies to questions. ## What actually helps Since the message won't give you the tell, the defences sit outside the message: 1. **Verify out of band for anything that moves money or access.** A phone call you place, to a number you already had. This is the only defence against a hijacked thread, and it has to apply *inside* conversations you started. 2. **Keep a record, so correlation is possible.** A short log of unexpected contacts, across channels, turns five unrelated nuisances into one visible campaign. 3. **Separate the published address from the working one.** The address on your website will end up in sales databases. Publish an alias that forwards, keep the account you actually work in unpublished, and put a relay number in front of your real phone. 4. **Don't unsubscribe from senders you don't recognise.** It confirms a live, attentive human. Filter them into a label instead. 5. **Opt out of the data brokers** that assemble business-contact lists. It is tedious and it works for a while. 6. **Assume the "brief" is hostile until opened safely.** Preview documents in a browser viewer rather than a desktop application, and never let an assistant act on a document's contents without reading it yourself. 7. **Treat the volume as a signal.** A sudden rise in outreach means your details have been freshly harvested, which is the right moment to tighten the rest. > [!warning] The asymmetry > AI lowers the cost of the human-shaped parts of an attack: the research, the fluent writing, the patience to keep a conversation going. It does not lower the cost of defending, because defence still depends on procedures people follow. **That gap is the whole story of hybrid threats.** ## Related - [[AI Security for Users]] — the section overview - [[AI-Powered Scams]] — impersonation by voice and video - [[Prompt Injection]] — the machine-facing half of a dual-payload message - [[AI Data Exposure]] — how the details get out there in the first place