Video summary
The video demonstrates how Artificial Intelligence has drastically simplified the process of creating sophisticated phishing sites, making it possible for anyone to replicate legitimate websites like Facebook with minimal effort. In the past, constructing such a deceptive page required significant technical skill to design layouts and clean up complex code from scraped sources. However, the presenter shows that by simply uploading a screenshot of a target website into an AI tool, the system can instantly generate the corresponding HTML and CSS code. This generated code is plain text that can be easily saved to a file and opened in any browser, effectively cloning the visual appearance of the original site, including generating simple vector graphics like logos automatically.
Once the visual clone is created, the presenter explains how to modify the underlying code to turn it into a functional data-stealing trap. By making a small adjustment to the form's submission method, the page can be configured to send any login credentials entered by a victim directly to the attacker's server rather than the legitimate service. This setup does not require expensive hosting; instead, the presenter utilizes a low-cost ESP32 chip with built-in Wi-Fi capabilities to act as a local web server or create a captive portal. This allows the attacker to host the phishing site on a portable device that can be carried in a pocket, luring users into entering their information whenever they connect to the nearby network.
The core security lesson emphasized is that clicking a link in an email is generally safe from a technical standpoint, as modern browsers patch vulnerabilities quickly and simply visiting a URL does not grant attackers access to your account. The real danger lies in what happens after you click the link: once you begin typing your username and password into the fake site, that information is immediately compromised. The presenter advises users to always navigate to websites manually by typing the address or using bookmarks rather than clicking links sent via email, especially for sensitive accounts like banking or email. Furthermore, he stresses the importance of using unique passwords for every service; if a phishing attack succeeds on one site due to reused credentials, attackers can use that access to reset passwords and infiltrate other accounts, causing widespread damage.
Read the full video transcript
Hello and welcome to a video from
filmsbychris.com. That's Chris the K,
I'm Chris the K. Today we're going to
talk about AI and phishing scams and how
you can do it, too. It's just so
mind-blowingly easy, and I'm just
pointing this out to make it, you know,
more obvious to you. Doing something
like this in the past was super easy.
The hardest part was making the phishing
site, like designing something that
looks like a real website. Now, you
could go to a website, you know, Google,
Facebook, Microsoft, whatever, and you
can save the HTML to your drive and
modify it. Lots of times there's lots of
other files in there, you got to clean
out the scripts and stuff. But can you
just create a simple HTML that looks
just like the real thing, and then just
point what's being saved, so when
someone goes to log in, it saves that
information to your server? Yeah, and
it's super simple. Let's go ahead and
and look at this. Uh so, I am going to
zoom in on this. Let's go ahead and go
to the web browser here, and let's just
go to facebook.com. This is what the
Facebook website looks like when you go
to it and you're not logged in.
A little complicated, you know, if I
wanted to make this, I could, but then I
have to store the images and stuff. You
know, if you hit F12, that brings up
your developer console, and I actually
already have it clicked. Uh there's a
button right here. When you click this,
it turns it into mobile mode. It thinks
you're on a phone. In fact, you can pick
what type of phone you want to pretend
to be. This is just built into the
browser. This is how it works. It's
development tools, so you can test your
website on different devices. So, you
can take one of these, looks a little
small. If I hit F5 to refresh, it
resizes it properly. Now, I can take a
screenshot of that, which I actually
already have. So, I can come here. Let
me go over here. Here is my screenshot.
Let me move that to here. Let's close
this out. So, this is what uh on the
right side here, this is the screenshot,
what's on the left. Now, I just have to
go I don't need Jet uh Chat GTP or
whatever those other AIs are. I don't
even need a customer. I can just say
create
Let's say recreate. Recreate
You can see I already did this. This
image in HTML and CSS. Of course, it's
going to ask me if I'm a bot, you know,
so I'm proving that I'm not a bot here.
Boom. So, that was that good enough? It
was. Go to AI mode, and now I can just
drag this image into here and click
upload.
Going to give it a few seconds here.
And it's going to generate HTML and CSS.
It's just text. You can open up notepad
and save it to a file. So, this is it
right here. And then it put the CSS in a
separate file. Let me just say
uh place
the CSS and HTML in
to one file.
That way I don't have to copy two
things.
Give it a moment.
There we go. It's not very long. I'm
going to copy that. Then I'm going to go
here. And I'm I'm in an empty directory.
It's just a folder on my computer with
nothing in it. And again, you can just
use notepad. I'm just going to create a
file called index.html. You can call it
anything you want.html.
And I'm going to paste in that text, and
then I'm going to open that.
And it opened up on my other screen
here.
Boom.
This is what it looks like. Let's close
this. Let's go ahead and just make this
full screen. This is what the AI made.
It even made a little logo. You think,
"Well, how did it get an image in
there?" It actually created something
called SVG, which it couldn't do for
like a photo of me or something, but
it's still a little simple like this. It
actually just made little vector lines.
This is it. Now I just have to change
this code. I'll have to go in there and
change one little bit and say, "When
someone clicks log in, save it to my
server."
I can put this on any web server. And
you think, "Oh, what what what if I
don't have a web server?" Any computer
can be a web server. In fact, where did
I put it? I just had just just had it
here for this video.
And right in front of me here. This is
an ESP chip. I talk about these all the
time on my channel. There's many
different varieties of them. They're
three to five or six dollars for one of
these.
These things have built-in Wi-Fi. Some
of them have built-in Bluetooth. And
they can act as an access point. I can
create this. So, you know, when you go
somewhere and they say, "Hey, free
Wi-Fi." I'm not saying connect to those
things, but I can create what's called a
captive portal on this. Or I can just
set it up as a web server. But, when you
connect to this through your Wi-Fi, it
could open up this page. I could save
this page, that file I just had, on
here.
And when you fill out your information,
it saves it on here. I connect to this
to my phone and I can as you're logging
in, I'm saving your information.
That's it. And this has always been the
case. You've always been able to do
this. It's just super easy. I didn't
have to design anything. And minimal
changes. I can change this. In fact, I
don't need a separate computer. I don't
need this. If I have access to your
computer just for a few seconds, you
have your computer unlocked, I can save
this file to your computer, open it up,
you sit back down, you you go, "Oh, I
got to log in to Facebook." on your own
machine, and I can have it save the
information to your machine and get back
later and get or send it anywhere on the
internet. Uh I mean, I don't even need
my own server. I could save it to like a
Google uh a spreadsheet or something
like that. But, I just wanted to point
this out how simple it is these days.
Cuz to do this in the past, I would have
had to design something, right? I would
have had to go in there and figure out,
"Oh, how do I make this the right color
blue? And how do I curve this?" Or I
could pull the real website, which has a
whole bunch of junk in it I would have
to clear through. Again, let's let's
open this up. This is the entire code.
All of this. That's all I need. And then
the part right here where it says, you
know, button, this is a form. I just add
a little thing there that says,
um
uh method uh post action and I give it
the the the URL but the my server and it
will save whatever you type to your URL.
And when it submits it, I can have it
refreshed so that you keep trying and
maybe you'll try a different password
and now I'm collecting passwords you
might have for other sites cuz you think
maybe I changed my password.
So, we need to be vigilant about this. A
lot of people are iffy about clicking on
links in emails. And I've said this
before, the odds of just clicking on a
link in an email and it doing something
malicious to you is highly highly highly
unlikely. There would have to be a flaw
in your web browser, uh which when there
are, those are patched pretty quickly.
They're fixed pretty quickly. The thing
is,
once you get there, what do you do? What
information do you give them? Never
if you click on a link in a website,
never start typing personal information,
especially login information, right? Cuz
that's how they get you. If you click on
a link and it go brings you to Facebook
and this
close that and just go to Facebook and
make sure you're logged in. If you're
already logged in, then clearly it's a
scam. But just clicking on the link
wasn't going to do anything. It's once
you fill out that information. And if
you're one of those people who still
uses passwords for multiple accounts,
which you should have a unique password
for every account, well, now they got
your password. If they have any
information on you, which your
information out there, they they can
start start getting into other websites.
And if it's your email account, they can
probably reset all your passwords. So,
definitely use a separate
um password for different accounts, but
be very leery. I mean, how often do you
log into your email? You're probably
logged in, you're always logged in. So,
if you click on something and it wants
you to log in your email,
I mean, never click on a link in an
email and then start filling out
information.
Uh bank information, Facebook, and any
of any website. Go to that website
manually. Just all you have to do is
click the little plus sign and type in
Facebook and go there. And then you'll
have access to stuff. Anything they send
you in email should send out should show
up as a notification um in your in your
account.
So, yeah, that's that's just I just want
to point out how easy this was. And
again,
$3 chip, copy that text onto here with
some code. And I can carry this around
in my pocket with a little battery, and
everywhere I go, people will connect to
it and and start logging their
information.
Don't do that. That's not a nice thing
to do.
Um it is fun to play jokes on people. I
could take this Facebook thing and and
change it now and start messing with
people with different messages. That's a
funny thing to do, but don't don't start
stealing people's information. Again,
I I know people this happened to
recently, and it's just
don't I mean, not even just going to a
website like this through an email link
or any link. If you want to log into a
website, you should be going to that
website yourself.
Uh but if I go to my credit card
website, you know, Discover card or
MasterCard or Chase card or whatever,
and they've changed the login, I double
and triple-check to make sure I typed in
the wrong thing and I didn't go to the
wrong website. Even if it looks a little
different like like the way this
Facebook thing is, the way the boxes are
curved. If I had here and those boxes
weren't so curved, I'd be like, wait,
does that normally look like that? Did
they change it? Did they update? I start
looking at the URL up there and making
sure I typed in the right thing. Uh it's
just
so easy uh with AI uh these days, which
is great that you can create stuff like
this easily with AI. Uh I constantly ask
AI to recreate stuff. And this isn't
even perfect. Now that I'm looking at
it, it it has the Facebook logo there,
but it doesn't have the meta logo down
at the bottom. Uh did I
Yeah, so here it says meta down at the
bottom with a little logo. It's getting
stretched out now because uh it actually
is a little different. It thinks I'm on
mobile here and I've made it full screen
again, so it's stretching it. So
actually, the the recreation I think
looks better.
Uh but yeah, so it if if the website has
a lot of images and stuff, I might have
to grab those images. That's still not
hard to do. But uh basically, that's why
I went with the mobile login cuz most
people are going to be logging in from
mobile and they're not going to notice
the difference there if they're on the
desktop. Uh but it tends to be simpler
because it's smaller. Uh and even if
there were images, if if there was
normally an image on here, it not being
there would still probably trick people.
We just got to be careful, people.
Again, don't be afraid to click on
links. Uh I know some I know people who
have told me uh like I've sent them
links to videos or something, like, oh,
I don't click on any links that are sent
to me.
That's just stupid, okay? Cuz it's I
mean, it it it's your prerogative. If
you're just playing it extra safe, I'd
rather you be extra safe. If you're
a person who knows so little that you
think clicking on a link is going to
cause an issue like that,
um and and there is uh, you know,
clicking on a link that was sent to you
from a spam thing, there are downsides
to it, right? Uh, because there's
probably tracking information in there.
And at the very least they know that
you've clicked on the link. So, if they
emailed you something, they know, "Well,
they clicked on a link. Let's send them
more spam." So, there there is a
downside to that. But, as far as like
security, getting into your account,
getting your information, clicking on a
link is not going to do that. And again,
unless there's a huge security flaw in a
web browser. And in that case, it's
affecting anybody and any website you go
to you can do it. And those things tend
to get patched pretty quickly. People
are going to argue with me about that in
the comments. Feel free to. I love
comments on my videos. It's super
helpful.
But, you saw how easy it was. I I was
logged into an incognito uh, browser.
So, I wasn't even logged into my Google
account. You can do this without an
account. Just go to Google and ask it to
do something. And HTML and CSS, these
are what web pages are made of. It's
just plain text, so it's super simple
for the AI to create something like
that. And something something like this
isn't very big.
And there you go.
Um,
I'm just trying to make it more obvious
to people.
Don't don't log into a site unless
you're sure that you're at that site.
And never log into a site that you've
clicked on a link to get to. Always go
to the site yourself.
Anyway, I thank you for watching. Please
visit filmsbychris.com. That's Chris
with a K. There's a link in the
description, as always. I hope that you
have a great day.