Loading...
New
See what manual alert triage really costs your security team.
New
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
Loading...
AI phishing uses language models to research targets and write tailored lures, and voice cloning to impersonate trusted people. In a 2024 study by Fred Heiding, Bruce Schneier, and colleagues, fully AI-written spear phishing cost about four cents per email and drew a 54% click rate, matching human experts. Defenders now catch it on infrastructure, identity, and post-click activity.
The typo was the last free phishing detection, and AI took it. A December 2024 FBI warning said generative AI "can correct for human errors that might otherwise serve as warning signs of fraud."
Take one hypothetical report. Two people in your accounts-payable team are on a thread with a long-standing supplier when a new message asks them to update the supplier's bank details before Friday's payment run, with a link to the "corrected invoice" that opens a sign-in page quietly relaying to the real one. The thread is real, because the supplier's mailbox was compromised days earlier, and the reply sounds exactly like the supplier, because the attacker had a language model study the thread and write it. One colleague reports the email. The other stays quiet. None of the giveaways is in the writing. They're in the bank-detail change itself, the sign-in logs, and whatever the quiet colleague did next.
AI phishing is phishing in which a large language model (LLM) or another generative model does part of the attacker's work. It researches the target, writes or translates the message, clones a voice, or varies every copy (polymorphic phishing) so that no two emails in a campaign match a known template.
The goal is the same as ever: a password typed into the wrong page or a payment sent to a new account. AI sits on top of the classic phishing variants your team already knows.
Ask how much phishing is AI-written and you'll hear anything from 0.7% to 82.6%, because each study counts something different. KnowBe4 found that 82.6% of the phishing emails it analyzed between September 2024 and February 2025 "exhibited some use of AI." Hoxhunt counted only emails fully crafted by AI and found 0.7% to 4.7% of 386,000 reported malicious emails that got past filters. Both numbers are right about what they count.
Check which one a figure uses before it reaches your board deck.
AI-generated phishing emails seem real because a model now writes them the way a skilled attacker would, researching the target first and leaving out the typos people were trained to spot. In controlled studies they match human experts. In Hoxhunt's March 2025 simulations, they edged ahead.
It took under two years:
| Study | What was tested | Result |
|---|---|---|
| Heiding et al., 2023 (112 participants) | GPT-4 emails vs. emails written by hand with the V-Triad persuasion model | Hand-written won: 69–79% click rate vs. 30–44% for GPT-4 |
| IBM X-Force, 2023 | AI-written vs. red-team-written lure in a live company test | Humans won "by the narrowest of margins"; more people reported the AI email |
| Heiding et al., 2024 (101 participants) | Fully automated AI spear phishing vs. human experts vs. a generic phishing email | AI 54%, human experts 54%, AI with a human editing 56%, generic email 12% |
| Hoxhunt, March 2025 | Hoxhunt's AI agent vs. its own elite red team | The AI agent drew 24% more failures (2.78% vs. 2.25% of recipients) |
The 2024 result is widely quoted and often misquoted. The 12% that circulates as "the human baseline" came from a generic phishing email, while the human experts scored 54%, exactly what the AI scored. So the news is who can now afford expert persuasion.
In the 2024 Heiding study, a fully automated AI phishing pipeline cost about four cents per email, research included. The authors estimate automation could raise a campaign's profitability up to 50 times for large audiences, and they call their own profitability numbers "likely an overestimate."
Spear phishing used to be rationed. A researched lure cost an attacker hours of work, so it went to the CFO and the domain admin.
At four cents, nobody rations.
Your accounts-payable team now gets the kind of tailored lure that used to be saved for the CFO.
The playbooks themselves are old. Google's Threat Intelligence Group saw attackers getting "productivity gains but not yet developing novel capabilities" in January 2025, and Mandiant's M-Trends 2026 came to a similar conclusion about 2025: "we do not consider 2025 to be the year where breaches were the direct result of AI." Little in these playbooks is new to your team except the polish and the price.
Phishing is moving from email to the phone, according to Mandiant's M-Trends 2026. Mandiant found email phishing fell from 14% of initial infection vectors in 2024 to 6% in 2025, while voice phishing rose to 11%. In cloud compromises, the full report puts voice first, at 23%.
| Channel | What the data shows | Source |
|---|---|---|
| Voice, all intrusions | 11% of initial infection vectors in 2025 | Mandiant M-Trends 2026 |
| Voice, cloud compromises | 23% of initial infection vectors, the top vector | Mandiant M-Trends 2026 |
| Microsoft Teams | Weekly confirmed malicious cross-tenant vishing volume up 502% | Microsoft Digital Defense Report 2026 |
| SMS (smishing) and voice | Median click rate 40% higher than email, in phishing simulations | Verizon DBIR 2026 |
| QR codes (quishing) | More than 145 million QR phishing attacks, July 2025 to June 2026 | Microsoft Digital Defense Report 2026 |
| Down from 14% to 6% of initial infection vectors | Mandiant M-Trends 2026 |
The same bank-detail request can just as easily arrive as a phone call in the supplier's voice. Voice is where AI changes the economics most, because a cloned voice drops the accent and the hesitation that used to give a caller away. Microsoft's 2026 Digital Defense Report found 93% of the Teams vishing attackers it tracked kept a target on the line for 20 seconds or more at least once, the point where Microsoft says a caller can start a social engineering script.
Your help desk sits right on that path. CISA's advisory on Scattered Spider describes attackers posing as employees to get staff to "reset the employee's password, and transfer the employee's MFA to a device they control." An email gateway and an annual training module guard the channel attackers are leaving.
AI phishing detection works on two things a model can't rewrite: what the attacker had to set up to send the message, and what the targeted account did next. When Microsoft Threat Intelligence caught a phishing campaign in August 2025 that likely used LLM-generated code to hide its payload, Microsoft Defender for Office 365 stopped it using "signals across infrastructure, behavior, and message context that remain largely unaffected by an attacker's use of AI."
Pre-delivery AI phishing signals belong to your email security stack. They hold up because they come from mail infrastructure and the sender relationship, which no amount of better writing changes.
| Signal | Why AI can't hide it |
|---|---|
| SPF, DKIM, or DMARC failure; first-time sender to this recipient | Authentication results come from mail infrastructure |
| Lookalike or newly registered domain; reply-to that differs from the sender | A domain needs registering and aging, and a model can't skip that |
| Multi-hop redirects, CAPTCHA-gated landing pages, SVG or HTML attachments | Tricks built to evade scanners form a pattern of their own |
| Payment or credential request inside a hijacked vendor thread | The ask is unusual for the relationship, however fluent the wording |
Post-click AI phishing signals live in your identity provider, mailbox audit logs, and EDR. Reaching them means pivoting across consoles, which makes them easy to skip.
| Signal | What gives it away |
|---|---|
| Risky sign-in, unfamiliar session properties, impossible travel | Tied to the attacker's network and device |
| Session token replayed from new infrastructure | Stolen sessions surface in identity logs when reused |
| New inbox rule that forwards, deletes, or hides mail | Attackers hide replies, and the rule lands in the audit log |
| New OAuth app consent, or an MFA method added or changed | Persistence leaves a configuration change behind |
| The same lure sent internally from the compromised mailbox | Internal fan-out shows up in mail flow |
Any one of these can be innocent. A real supplier switches domains; a salesperson signs in from an airport. The supplier email already trips one signal from the first table, a payment request inside a hijacked vendor thread. If the quiet colleague entered a password, a sign-in from somewhere new makes two. Treat a report as phishing when two or three of these signals line up on the same message and the same account.
A SOC investigating AI phishing reports has one question to answer for each: did this message compromise an account or a device? Calling the supplier email malicious is the quick part. The outcome turns on whether the quiet colleague opened that invoice link, entered a password, and whether their account now shows a session signing in from somewhere new.
Scope, Correlate, and Contain are where a phish becomes a breach. They run on the after-the-click signals above, spread across separate consoles, and many playbooks stop before them.
The queue those steps run against is mostly noise. Good training makes it bigger. In a randomized controlled trial of Microsoft's phishing triage agent published in late 2025, only 11.88% of a random sample of user-reported emails from live operations were malicious. Large enterprises, the authors note, can have "hundreds or thousands of submissions per week." You want people reporting, and every report is one more ticket.
Simbian's AI SOC Agent investigates every user-reported or gateway-flagged phish. It parses the email natively, checks its observables against threat intelligence, and correlates them with your EDR and identity logs to answer "did this lead to a compromise?" On the supplier email, that means checking whether the quiet colleague's account shows a sign-in from somewhere new. When the answer is yes, the Agent identifies patient zero and maps lateral movement before your analyst opens the case. On phishing investigations, Simbian measures a 90% reduction in mean time to respond. You choose which containment actions, such as isolating a host or disabling an account, wait for an analyst's approval.
Partly: standard MFA stops a stolen password, but an adversary-in-the-middle (AiTM) phishing page relays your login in real time and keeps the session token that comes back. If the quiet colleague signed in through that invoice page, MFA didn't stop the attacker, who now holds a live session.
In April 2026, Microsoft tracked a Claude-themed lure sent to targets in more than 2,000 organizations. Its final stage was "consistent with adversary-in-the-middle (AiTM) tactics designed to intercept authentication tokens." By the count in Microsoft's 2025 Digital Defense Report, MFA still blocks over 99% of unauthorized access attempts, so keep it. A relayed session gets through anyway, because your identity provider sees the user's own login.
The structural fix is phishing-resistant MFA. FIDO2 security keys and passkeys bind the credential to the real site's domain, so a lookalike page gets nothing it can replay. CISA notes FIDO/WebAuthn is "not susceptible to push bombing or SIM swap." And if a session has already been stolen, a password reset alone may not end it. Revoke the user's sessions and refresh tokens too.
You stop deepfake phishing with process controls, such as a callback on a known number or a second approver, that move the decision off whether a face or voice seems real. Deepfakes are built to win that call, so give the people they target a rule to follow instead of a judgment to make.
In January 2024, a finance employee in Arup's Hong Kong office joined a video call with what looked like the CFO and colleagues, then made 15 transfers totalling HK$200 million (about US$25.6 million) to five accounts. The employee had first suspected phishing. The video call removed the doubt.
Two attempts that failed the same year show where the control belongs. A LastPass employee got WhatsApp audio impersonating the CEO and reported it because it came "outside of normal business communication channels" with "forced urgency." At WPP, attackers staged a Teams meeting that used a voice clone of a senior executive while impersonating CEO Mark Read in the chat, and the company credited "the vigilance of our people."
The losses add up. Across all fraud types, the FBI's 2025 Internet Crime Report (April 2026) counted more than 22,000 complaints reporting AI-related information, with adjusted losses above $893 million.
A callback on the supplier's known number would have ended that bank-detail request before Friday's payment run. No SOC tool, ours included, stops an employee who wires money during a convincing call. A callback rule that people actually follow does.
The AI phishing statistics that hold up name their source, their year, and what they counted. Plenty of others are real numbers with the wrong source, year, or definition attached. The 54% study, for one, keeps getting credited to IBM.
| Statistic | Primary source | Often misquoted as |
|---|---|---|
| AI spear phishing: 54% click rate, equal to human experts; generic email 12% | Heiding, Schneier et al., November 2024 (101 participants) | "AI is 4.5x more effective than humans," credited to IBM |
| 82.6% of phishing emails showed "some use of AI" | KnowBe4, March 2025 | "82.6% of phishing is AI-generated" |
| 1,265% rise in malicious phishing messages since Q4 2022 | SlashNext, October 2023 | A recent KnowBe4 figure |
| Vishing up 442% | CrowdStrike 2025 Global Threat Report, H1 to H2 2024 | A 2025 increase |
| Business email compromise (BEC) losses of $3.05 billion in 2025, up from $2.77 billion in 2024 | FBI IC3 2025 Internet Crime Report | Larger totals that measure something else |
| Phishing was the top initial vector (16%), at $4.8 million per breach | IBM Cost of a Data Breach 2025 | Usually quoted correctly |
| 16% of breaches involved attackers using AI, most often for phishing (37%) | IBM Cost of a Data Breach 2025 | Usually quoted correctly |
| Email phishing fell to 6% of initial infection vectors | Mandiant M-Trends 2026 | Usually quoted correctly |
Q: Why are AI-powered phishing emails more difficult to detect? AI-powered phishing emails are more difficult to detect because AI removes the typos, stock phrasing, and reused templates that people and filters relied on. It can also tailor each lure with public details about the target. Detection has to move to sender infrastructure, link destinations, and what the account does after the click.
Q: How do you identify AI-generated phishing emails? You identify AI-generated phishing emails by their infrastructure and their request, because fluent AI copy reads like a careful colleague. Check whether the sender authenticates, whether the domain is new or a lookalike, where the link really goes, and whether the request fits your normal process for payments and passwords.
Q: Can AI detect phishing emails? Yes, AI can detect phishing emails by their intent. In the 2024 Heiding study, Claude 3.5 Sonnet "scored well above 90%" at detecting the intent of phishing emails, with low false-positive rates. Give the model sender infrastructure and post-click identity data as well, since the text is the part attackers now polish best.
Q: What percentage of phishing emails are AI-generated? Estimates run from under 5% to 82.6% because studies count different things. Hoxhunt found under 5% of reported phishing that got past filters was fully AI-crafted, while 82.6% of the emails KnowBe4 analyzed between September 2024 and February 2025 showed some use of AI. A third measure, Hoxhunt's reported emails with signs of AI assistance, hit 56% in December 2025.
Q: How do you stop AI-generated phishing attacks at work? To stop AI-generated phishing attacks at work, put your controls on identity and process. Use phishing-resistant MFA such as passkeys, and require out-of-band checks for payments and MFA resets. Then watch identity and mailbox logs for post-click activity, and investigate every reported phish until you know whether it led to a compromise.
Q: Is security awareness training still worth it against AI phishing? Yes, if you train people to report suspicious messages fast. Verizon's 2025 DBIR found recently trained users report simulated phishing at about 21% against a 5% base rate, while the effect on clicks was small. An early report buys your SOC the time it needs to contain a click.
Q: What should you do if you clicked an AI phishing link? Report it to your security team at once, even if nothing seemed to happen. If you entered credentials, the team should reset the password and also revoke your sessions and refresh tokens, because a stolen session can survive a reset. Then check for new mailbox forwarding rules, new MFA methods, and new app consents.
Pull last month's reported-phish queue and, for each true positive, ask the question the supplier case turns on: did anyone click, and what did their account do in the next hour?
If answering it takes your team longer than the attacker spent writing the lure, Book a Demo and watch Simbian's AI SOC Agent work the same investigation on a live phishing alert.
