← Cybersecurity
Cybersecurity
The New Face of Phishing: AI-Generated Attacks Are Terrifyingly Good
✍ ManhithaMay 28, 20256 min read
🎣
For years, the advice was simple: look for spelling mistakes and awkward phrasing in suspicious emails. That advice is now dangerously outdated. AI can write phishing emails indistinguishable from legitimate corporate communications — and it can personalize them at scale.
What AI-powered phishing looks like
Modern spear-phishing attacks use publicly available data (your LinkedIn, your company's website, press releases) to craft emails that reference real projects, real colleagues, and real context. A phishing email today might address you by name, mention your manager, reference a real meeting, and ask you to click a link with entirely plausible framing. Security researchers have documented cases where GPT-4 was used to generate thousands of unique, personalized phishing emails per hour.
Voice cloning: the phone call you can't trust
In 2024, a finance employee at a multinational company was tricked into transferring $25 million after a video call with what appeared to be the company's CFO — but was a deepfake generated from publicly available footage. Voice cloning tools can now reproduce someone's voice from as little as 30 seconds of audio found on YouTube or podcasts.
The new rules of skepticism
Since you can no longer rely on linguistic quality as a signal, shift your attention to: urgency and pressure (real organizations rarely demand immediate action), the channel (did this arrive via an unexpected path?), and the request itself (would my company actually ask for this by email?). When in doubt, verify via a separate, known-good channel — call the person directly using a number you already have.
Technical defenses
Organizations should implement DMARC, DKIM, and SPF email authentication to make domain spoofing harder. Hardware security keys (like YubiKeys) for MFA are phishing-resistant in ways that SMS and authenticator apps are not — even if you click a phishing link and enter your code, a hardware key won't work on a fake domain.
The economics of phishing at scale
Phishing is industrialised. Cybercriminal marketplaces sell "phishing kits" — complete packages including spoofed websites, email templates, and backend infrastructure — for as little as $50. A moderately skilled criminal can launch a campaign targeting thousands of users with minimal technical knowledge or investment.
The economics are compelling for attackers: even a 0.1% success rate across 100,000 emails yields 100 compromised accounts. Depending on the target, each account might provide access to banking credentials, corporate systems, or personal data worth hundreds to thousands of dollars on criminal markets.
Spear phishing: when attacks get personal
Spear phishing is targeted phishing — crafted specifically for one person or organisation. Where mass phishing is a net, spear phishing is a harpoon. An attacker researching their target on LinkedIn, the company website, and social media can construct an email that references real colleagues, ongoing projects, and plausible business contexts.
AI dramatically lowers the cost of this personalisation. What once required a skilled social engineer spending hours on research can now be automated: scrape the target's online presence, feed it to a language model, generate a believable email. The quality is indistinguishable from a human-written message, and the attack can be scaled across hundreds of personalised targets simultaneously.
Business Email Compromise: the most expensive variant
Business Email Compromise (BEC) is a specific form of spear phishing where attackers impersonate executives, suppliers, or IT departments to trick employees into transferring money or handing over credentials. The FBI estimated global losses from BEC at over $50 billion between 2013 and 2023 — making it the single most financially damaging cybercrime category.
The classic BEC scenario: an attacker monitors email traffic (often after an initial breach), identifies a pending large payment to a supplier, and emails the finance team impersonating either the supplier or a company executive — requesting the payment be sent to a "new bank account." By the time the fraud is discovered, the money has moved through multiple accounts and is effectively unrecoverable.
How to actually protect yourself and your organisation
The most effective technical defence against phishing is FIDO2 hardware authentication — security keys that are cryptographically bound to the legitimate domain. Even if an employee enters their credentials on a convincing phishing site, the hardware key will not authenticate, because it verifies the domain before responding.
For organisations, mandatory security awareness training that includes simulated phishing exercises significantly reduces click rates over time. More importantly, establishing clear verbal or out-of-band verification procedures for any payment changes or unusual credential requests removes the human vulnerability that phishing exploits. No legitimate request to transfer significant money should ever be executed based on email alone.