How AI transformed credential attacks

The economics of credential theft changed in 2023. What once required skilled operators and weeks of reconnaissance now requires a few prompts and minutes of execution. According to ENISA's 2025 threat report, AI-supported phishing represented more than 80% of observed social-engineering activity. According to CrowdStrike's 2025 Global Threat Report, AI-generated phishing campaigns achieve 54% click-through rates compared to 12% for traditional human-crafted campaigns.

The channel shift matters as much as the volume. AI moved attacks from email to voice and video channels where authentication is still social rather than cryptographic. Voice phishing increased 442% between 2023 and 2024. The $25 million Arup deepfake video call fraud in January 2024 demonstrated that executives can be convinced to authorize transactions through a channel they cannot distinguish from a real meeting.

According to a Gartner survey of 302 cybersecurity leaders in September 2025, 62% had already experienced a deepfake attack in the past 12 months. Gartner projects that by 2026, 30% of enterprises will consider identity verification unreliable in isolation because of deepfakes.

Why deepfakes bypass biometric MFA but not cryptographic keys

Biometric authentication relies on recognizing a physical characteristic of the person: their face, voice, or fingerprint. AI can synthesize all three at scale. According to the Entrust 2026 Identity Fraud Report, deepfakes account for one in five biometric fraud attempts and deepfaked selfie attempts increased 58% in 2025. The authentication method that was supposed to replace passwords is now itself a target.

Cryptographic key authentication does not rely on recognizing a person. It relies on the possession of a specific hardware key or the correct software key on a specific device. A deepfake face cannot present a WWPass Key. A cloned voice cannot generate the cryptographic response a hardware token produces. The authentication is mathematical, not perceptual. AI has no attack surface against it.

Explore WWPass Key

What AI attacks cannot do against WWPass

Every AI-powered attack in the current threat landscape targets either a credential or a human recognition process. WWPass removes both from the authentication chain.

• AI phishing cannot steal a password that does not exist. WWPass stores no passwords. There is no credential database to breach and no login page that accepts a username and password to impersonate.

• AI deepfakes cannot bypass cryptographic verification. The WWPass Key generates a cryptographic response that no AI-generated synthetic media can replicate. Authentication is not a recognition process.

• AI voice cloning cannot authorize access. A cloned voice can deceive a human reviewer. It cannot produce the one-time cryptographic proof that a WWPass Key generates for a specific session.

• AI-generated phishing pages cannot harvest credentials. When users authenticate with a WWPass Key, nothing reusable is entered on any page. A convincing fake login page captures nothing.

Explore how WWPass works

Continuous authentication as the AI-era defence layer

Removing the credential layer addresses the initial access problem. The AI era introduces a second problem: persistent access through compromised sessions. Once an attacker gains access through a stolen token, a session hijack, or a compromised device, credential-based systems have no mechanism to detect anomalous behaviour after the login event.

The structural answer to a structural threat

AI has industrialised credential theft. The volume, sophistication, and cost-effectiveness of attacks will continue to improve. The only defence that does not require continuous upgrading is removing the target.

Passkeys reduced the attack surface by removing the password. They did not remove the username, the vendor cloud dependency, or the biometric verification layer that deepfakes now bypass. WWPass removes all of it. No username in the system. No password to steal. No biometric to synthesize. No vendor cloud to compromise. Authentication based on a cryptographic key that AI cannot replicate, phish, or clone.

Explore why WWPass goes beyond passkeys

Frequently asked questions

Q: Can AI deepfakes bypass WWPass authentication?

A: No. WWPass authentication is cryptographic, not perceptual. It does not rely on recognizing a face, voice, or fingerprint. The WWPass Key generates a one-time cryptographic response for a specific session. A deepfake face, a cloned voice, or a synthetic video cannot produce that response. Biometric authentication can be bypassed by AI-generated synthetic media because it relies on recognizing a physical characteristic. Cryptographic key authentication cannot because it relies on possession of the key itself.

Q: Why is AI-generated phishing particularly dangerous for credential-based systems?

A: According to CrowdStrike's 2025 Global Threat Report, AI-generated phishing achieves 54% click-through rates compared to 12% for traditional campaigns. It is faster, cheaper, more convincing, and now operates across email, voice, and video channels simultaneously. Credential-based systems have to defend against every convincing fake page, every AI voice call, and every deepfake video. WWPass removes the target: no credential is entered on any page, so no convincing fake page can capture anything.

Q: Does WWPass protect against AI-powered account takeover?

A: Yes. Account takeover attacks rely on obtaining credentials through phishing, data breaches, or social engineering, and using them to authenticate as the legitimate user. WWPass stores no credentials and transmits nothing reusable. A credential obtained through an AI-powered attack cannot be used to authenticate through WWPass because no credential exists to obtain.

Q: How does WWPass compare to biometric authentication for AI-era security?

A: Biometric authentication verifies identity by recognizing a physical characteristic — face, voice, or fingerprint. AI can synthesize all three. According to the Entrust 2026 Identity Fraud Report, deepfakes account for one in five biometric fraud attempts. Gartner projects that by 2026, 30% of enterprises will consider identity verification unreliable in isolation because of deepfakes. WWPass does not rely on biometric recognition as the primary authentication factor. The WWPass Key generates a cryptographic response that AI has no mechanism to replicate. An optional PIN or biometric can be added as a second factor, but the primary authentication is always cryptographic.