Session: AI vs. Your Game: The New Era Of Social Media Attacks - Naveh Ben Dror, Spikerz

[music] [music] Third speaker from the uh marketing marvels track. Um we're going to talk a little bit more about AIE AI versus your game, the new era of social media attacks. So for that, I would like to welcome to the stage Nav Bendro from Spikers. Great. Can everybody hear this? Great. So we're good to go. Um so you probably heard the word AI comes up in the past two days probably like 42,000 times. Um, AI is amazing. LLM is

amazing. It can help you get more reach, can help you get a lot more creative, can help your team just be better, faster, a lot more sophisticated that it used to be a few years ago. But I again, if I if I can bet um nobody talked to you about what AI can do on the negative side of things, right? Um, and AI and we've seen it in the past three to five years has actually changed everything. And we have gaming companies and studios working with us today about something they've never experienced before. What happens when AI is being used by the bad actors? We're going to speak a little bit about that today. But before we get into the very specifics of that, I have a question for you guys. And I have here small spikers as our bodyguard for today. Um, and we

would love to to learn from you guys as well. But if you look at all of these names, brands, logos that all of you are probably familiar with, there are a lot more. By the way, just wanted to put a few of these. What do you think all of these have in common? sports almost. Anybody? Come on, don't be shy. See some heads going around something. Okay, I'll help you. Um, all of these brands unfortunately got hacked in the past year. All of them. And there are so many others like Disney and McDonald's and Ford and [snorts] the biggest brands you've ever seen, right? And you have Riot Games here and Activision Blizzard and Xbox and Valve and ESL and probably every brand you

probably know got hacked in the past year on social alone. But the question is why? What changed? Right? But we're gonna stick to to that in for a second and then I'll answer the the question I just h I just asked. All of these by the way are just in the past few months up to a year. Um and when you look at that everything changed with AI and this the statistics that actually when I wake up in the morning and I look at that I get freaked out every morning. Uh one out of five gaming studio will get hacked. Now we have roughly like 30 40 people here. So you can understand statistics, right? Some of you going to get hacked or some of the guys outside going to get hacked. Doesn't matter whether you're doing everything right or doing everything wrong. You're just out of your hand because you're fighting with stick and stones against superpowers like AI. And one thing we need to cover is that social media is where everything goes

everybody goes to, right? You have a community. You have a game. You're trying to attract new customers or new players. You're trying to communicate with them. You're trying to retain them. You're trying to get them back into your game. Everybody goes to social media. Now, social media has been with us for what 15, 20 years now. But what changed? We started from MySpace, MSN, Tumblr. Now we have Tik Tok moving everything. We have Instagram, right? But everything changed with AI. Things that you needed to do with your 10 fingers or two of them if you have mobile phone, you now can do with 1,000 AI agents at your whim. Can be a voice recording order. You go to chat and ask for it. Just write a quick prompt and you get it. Now these are the easy stuff, right? can do right now when you speak when I'm speaking can go into chatd and ask you to do something but

what happens if you take it one step further what happens if I want to learn anything about your company who works there who's your VP of social who where does he live who's his wife and so on and so on it takes one prompt to do that you know that can go in ask it can you scrape LinkedIn for all the social media managers of some some company everything they can know about it and so on and so And the AI is not is not a bad tool. It's a great tool. It's just being used by the wrong people for the wrong purposes at some at some point. The the the initial or the essential part of that is that it's a lot faster. You can do a lot more in a in a shorter period of time. It's easier and the sophistication of those attacks have gone over the o over the roof and anybody can do it. We are seeing teenagers from across the world that

don't know how to speak English performing astonishing attacks in scale. We've seen attacks of creation of fake websites for for jobs. Uh think about that uh I don't know games beatcareer.com. You can open it up in in a in a whim, create a fake website in one prompt, just send it to everybody with a prompt that says uh uh first name blah blah blah and you create a sophistication around personalization there that you've probably haven't seen before. You probably seen the fishing attacks seven years ago, Nigerian prince, somebody trying to take your money, right? Bad grammar, misspellings, and so on. We don't see that anymore. Oh, you probably seen it over SMS, but probably a lot less than you've seen before. And the new types of attack are of attacks are honestly just different. And I want to show you some some examples. Speak about us in in a second. This is a

fake login page that took me 25 seconds to create. Does it seem weird? Now if I would take one minute I can make it for every social platform. This is lovable by the way or base 44 or any vibe coding tool that you are familiar with. But it's not only that I can create fishing emails for whatever language in one prompt and I can then duplicate it for any other languages per person per his LinkedIn account and I can know everything about him. Let's say I'm just here in PG connect. Somebody can see that because I just posted it on LinkedIn telling me, "Hey, I just saw you at PG Connect. It was a great speech. Thank you for so much for saying this, but you don't need to actually write it anymore. What about creating an account that looks exactly like me or my company or your game?" Honestly, one prompt. You

can go in right now to I won't tell you what which AI tool you can use that for. They don't want to you to do some bad stuff. But it takes you one prompt to do that. What happens if you have a game, you invest so much in its name, invest so much in the community, and somebody opens up a fake Instagram account or fake Facebook page with the name of your studio, name of your game, and then tries to speak with your community saying, "Hey, I'm the help center of the support team. I saw that you had a question about the game. I'm very happy to help." and then they start to communicate with you because they really think that it's you now then multiply that by a thousand. What about fake giveaways? What happens if I now go to your social media, look for everybody that commented on one of your comments or one of your post, then send him a fake image I just created. This is one prompt. Come join the name

of the game and here's 10 free spins. Here's 10 freebies. Whatever. We are seeing millions of examples for gaming companies every single day. What about fishing ads? Nothing stops you from going right now to Facebook, creating a fake ad with your game name, then just send people to some something else, a fishing website, a fake uh a credit card uh um website that looks very similar to your accounts and so on. What about games? I can copy the entire game in one prompt. This is a real example that uh uh this is bingo cache. After you play for like a minute, it ask you for a credit card. This is easy. This is not even sophisticated anymore. You can do all of this in one prompt. You take the game again. Another AI tool I won't tell you

the name of and you do it and you then take the money in the end. You can write to the sunset with probably a lot of cash in your pocket. Uh what about comments attack? Let's say you really invest in your brand. You really care about the game. You really care about your players. But I'm your competitor. And I want people to less use your soliter, your your bingo, your uh slots, your RPG game, whatever this is. And I just send 5,000 bots at you with different comments like, "This game sucks. Don't play it. They stole my money. Uh, I tried playing it. It didn't work. or just trying to send people to other games. Again, we see we just took an example for BG connect. We said check, this is a chitty, right? Give me 50 different examples of comments I can send people for fake bit Bitcoin giveaway. But you can do the same thing with your uh with somebody else's game.

One thing most people don't think about is account security. Social media is your forefront. Everybody can see social media. It's the number one public asset any company has today. Now, if you are Xbox or Riot Games or anybody that have a brand and a social media, if somebody takes a hold of it and does something on your accounts, it's you doing it or this what your players think. So, when Xbox got hacked and they published a fake crypto scam, they stole millions of dollars out of the followers. Now, after this happened, who's the one to blame? Xbox. Because this is Xbox account. Now, all the ones that got defrauded came to Xbox asking for money. What's happening, guys? Where's my Where's my cryptocoin, but it's not really Xbox. Same thing

with Riot Games, but it's everywhere. And one thing we understood is that social media is moving very very very fast. Okay. And if we understand that branding is important, everybody goes to social media for anything to do with your company, your brand, we understand that it's something that is worth protecting and worth uh even just knowing about it in the beginning because nobody probably woke up in the morning and said, "Wow, my social is not protected." Right? Usually people wake up only after something happened. And the idea here is to give you the tools and the understanding that this can happen and there's a there's a way to stop it. Okay? I'm not here only speaking about doomsday scenarios, anything like that. There are things that you can do yourself to prevent those kind of things from happening. And I want to give you one example. I'm going to cover in a second a few um

uh myths, okay, of uh of people we usually speak with in in gaming. Um the three the three verticals uh that that we see is number one or the baseline is is hacking. Okay? Because nobody wakes up again in the morning says, "Oh, I get connected to Instagram with a shared username and password and everybody in my team are using the same one." You understand how terrible this is when when I say it out loud, right? Everybody's sharing the same password. If I click on the wrong thing, the entire uh uh structure of social media falls down on my head. If I'm just an just a simple social media manager clicking the wrong thing, later on we are doing anything to do with the uh protection of the community. meaning we want to make sure everybody in your community in your gaming uh uh studio or your players are safe. And the last part is making sure nobody outside of your accounts is trying to infiltrate or

steal away your uh um players from you. And these are the four myths we usually hear from uh from people. And you probably are going to be familiar with those. So the first one is but we have two factor authentication. We are secured, right? Like Xbox didn't have two factor authentication or Riot Games or or uh Disney or everybody else. 2FA is great. It's critical, but it's definitely not enough. And I'll tell you why. Are you familiar with the small reset button, recent password button on social media? Right? You forgot your password. Just click that. With one click, I can bypass everything. Let's say you have very strong password, password vault, two-factor authentication on your device, on the cloud, everything. In one button, I can bypass everything. Why? Because if you're really honest withelves and you think who has the

phone number associated with your social media accounts, it's somebody from your team. It's either you maybe your social head of social media uh just a senior social media manager is as long I know this person's uh phone number I can then replicate it very easy to do people are going yeah probably need to change that yes you do but again it is important just unfortunately not enough uh we use password manager exactly as I said right now you can bypass it very very fast oh this one I really like uh our team would never fall for a scam like that. Right? [laughter] We are human beings. We do mistakes. It takes one second. I'll give you another example. One of the board members of Twitter got hacked on Twitter. Okay? And he's a very smart person. Um but the idea was he was a little bit tired between flights. He was on a taxi. He

didn't pay enough attention. He gave them the two-factor authentication, the password, everything. It was a simple fishing attack, one that you probably seen a thousand times. It takes one second and he lost it. By the way, it took him more than 3 weeks to get it back, which is a different story. Uh, but the amount of damage happened in that period of time was terrible, especially with a brand that big as uh that specific person. And the last one is our studio is too small. Nobody cares about us yet. You don't get targeted by a person anymore. You don't need to be big to be targeted. I do. I can go into Chetch right now. Tell me everybody that went to PG Connect, all the gaming studios in the world. I get a list of a few thousands of people. I run a few AI agents. Let's go to every one of the studios, get all the people in the team, just starting to target them. I I'm not doing it manually anymore. I don't care

about how small you are. I just want to get into your account. I want to take away players from you. If I'm a black hat affiliator and I'm trying to sell traffic to somebody, I'll take it from somebody that's easy to take. Won't try to uh do something super complicated. We could just go to all of your players. Just steal them. Give it to somebody else willing to pay me money for it. And we see it every day. It's not a doomsday scenario in like five years. Definitely not. We see it every single day today. Now, this are the things that we recommend everybody to do when we finish this call, this talk. You access the the room. We really recommend you to take these actions. By the way, uh we we build um like a 101 tools, things that you can do right now for yourselves. So, you can go uh right here. Elio and myself will help you get a bagu with a Where's the the ducky? The ducky is our

bodyguard, by the way. So, you can get one as well. Um, and this is super important for everybody to do because again, nobody waits for you. They'll just do it when you sleep, when you're with your wife or your husband, when you're taking a shower. Okay? So, having this initial steps will be very, very important for you in order to protect everything you're building and everything you're working. so hard to build. Um, and a little bit about us, we make sure brands are safe, gaming studios are safe on social media in three verticals. One is so that you don't get hacked, who has access, what happens when somebody leaves, making sure that two effect authentication not shared over Slack, uh stuff like that. And everything to do with your brand on social, making sure nobody sends the wrong things, nobody steals your players, basically making sure you can keep on growing without the risks that are associated with today's dangers on social media. Um, we're right

here on the right side, more than happy to speak with you guys and help you. Um and really um wish you guys keep on growing, keep on investing and uh be vigilant in these times. And thank you so much. [applause] Thank you so much. Scared the crap out of me. But uh yeah.
[music]