How has AI changed phishing? Artificial intelligence has removed phishing’s three historical weaknesses: the cost of personalisation, language errors and confinement to the email channel. Language models write flawless, personalised messages in any language at scale; cloning a voice takes about 3 seconds of audio (McAfee); and live deepfake video can seat a fake CFO on a conference call – as in the widely reported attack on engineering firm Arup, where an employee authorised transfers of USD 25.6 million after such a call.
According to Mandiant M-Trends 2026, vishing (voice phishing) was the second most common initial access vector in 2025 investigations, and the most common for cloud intrusions. This article organises what attackers can genuinely do today, which layers of defence work, how to also protect your own customers from brand impersonation – and what no defence will stop.
Canonical definition: AI-assisted phishing is social engineering that uses generative artificial intelligence to create personalised messages, clone a voice or likeness, and interact with the victim in real time, in order to extract credentials, payments or access.
Phishing in the AI era – key takeaways:
- Vishing rose 442 % in the second half of 2024 (CrowdStrike), and Mandiant M-Trends 2026 ranks it the second initial access vector of 2025 – the phone and the video call have caught up with email.
- A voice clone needs about 3 seconds of audio for roughly 85 % accuracy (McAfee); every webinar, podcast and recorded call featuring an executive supplies the material.
- The old tells – language errors, an “odd style” – no longer work: LLMs write better than the average sender, and people recognise high-quality deepfakes in fewer than 25 % of cases.
- Effective defence is procedural and technical, not perceptual: phishing-resistant authentication (passkeys/FIDO2), DMARC at an enforcement policy, call-back verification over a trusted channel, and four-eyes payment procedures.
- Brand impersonation hits your customers: look-alike domains, deepfake “CEO” investment adverts and “your bank” smishing destroy trust – the defence is DMARC p=reject, look-alike domain monitoring and a clear communication contract with customers.
- Patronusec runs security awareness sessions and controlled phishing tests built on the scenarios in this article – including voice and deepfake variants – with reporting metrics instead of “hunting the clickers”.
Table of Contents
What can an AI-equipped attacker genuinely do today?
An attacker with publicly available AI tools can personalise messages at industrial scale from LinkedIn profiles and breach data, clone anyone’s voice from a short recording, generate live deepfake video for a call, and run multi-channel campaigns that stitch email, SMS, phone and video conferencing into one coherent script.
| Technique | What AI changed | Scale (source) |
|---|---|---|
| LLM spear phishing | personalisation from public profiles and leaks in seconds; flawless English, Polish, any language; A/B variants at scale | rising volume and quality of targeted campaigns reported by all major email security vendors |
| Vishing and voice cloning | the “boss’s” or a relative’s voice from ~3 s of audio, ~85 % match (McAfee); conversation held live | +442 % in H2 2024 (CrowdStrike); #2 initial access vector 2025, #1 for cloud at 23 % (Mandiant M-Trends 2026) |
| Deepfake video | a fake participant on a live call; a “board meeting” of avatars | the Arup attack: USD 25.6 m after a deepfake video call; deepfake fraud attempts +1,300 % YoY (Pindrop, 2024) |
| BEC 2.0 | supplier impersonation with thread continuity: an LLM sustains the correspondence in the original’s style, so the changed bank account arrives “naturally” | BEC remains among the top loss categories reported to the FBI’s IC3 |
| Quishing (QR codes) | a QR code in a PDF or on a poster bypasses content filters; the landing page is generated per victim | steadily rising QR share in campaigns reported by email gateway vendors |
| Help-desk pretexting | a voice impersonation of an employee to trigger an MFA or password reset | the mechanism behind several headline intrusions of 2023-2025 |
| AiTM sites and kits | fake login pages that proxy the real one (adversary-in-the-middle) capture the password and the MFA code plus the session cookie | standard in phishing-as-a-service kits |
AI did not invent new scams – it removed three constraints from existing ones: the cost of personalisation, the language barrier, and the need to use a channel that can be filtered.
For defence planning, the crucial mental column is multi-channel. The typical successful 2025-2026 attack is not a single email but a sequence: an email that opens the thread → an SMS “finance will call you in a moment” → a call in a cloned voice → a link to an AiTM page or a request to approve in an app. Each channel looks credible on its own, because the others corroborate it.
Why have the traditional warning signs stopped working?
Classic training taught people to spot phishing by language errors, generic salutations and an “odd” sender – AI has eliminated all three. Deepfake research shows people correctly identify high-quality fakes in fewer than 25 % of cases, and automated detectors that reach ~96 % accuracy in the lab lose 45-50 % of it in real-world conditions.
The three pillars of old training and why they eroded:
- “Look for language errors” – an LLM writes more correctly than most senders; language stopped being a barrier for foreign criminal groups.
- “Watch the tone and style” – the model learns a person’s style from a few genuine emails (available after one mailbox in the supply chain is compromised) and sustains the thread indistinguishably.
- “If the email looks odd, verify by phone” – last decade’s advice became this decade’s vector: the phone call is now the attack channel, and a voice does not prove identity.
If a person recognises a high-quality deepfake less than once in four attempts, defence cannot rest on employee perceptiveness – it must rest on procedures that remain effective even when the employee believes the attacker.
This does not make awareness worthless – it changes its goal. Modern training does not teach “spotting the fake by its details” but three behaviours independent of forgery quality: pause at any combination of urgency and secrecy, verify requests for money and access via a different channel than the one they arrived on, and report immediately, including your own click. How to build a programme that teaches this is the second asset of this cluster: a security awareness programme and phishing simulations that work.
Which technical defence layers genuinely work against AI phishing?
Four layers work: phishing-resistant authentication (passkeys/FIDO2), which makes stolen passwords and codes worthless; DMARC+SPF+DKIM email authentication at an enforcement policy, which blocks spoofing of your domain; call-back verification and four-eyes rules for payments and account changes; and filtering and detection – useful, but designed on the assumption that some attacks get through.
| Layer | What it gives you | What it does not | Priority |
|---|---|---|---|
| Passkeys / FIDO2 (phishing-resistant authentication) | a cryptographic credential bound to the domain – an AiTM page can extract neither password nor code; fake login pages stop working | does not stop a help-desk attack (“please reset my MFA”) or a manipulated human authorising a payment | 1 – privileged accounts, finance and executives first |
| DMARC + SPF + DKIM at p=reject | nobody can send mail “from your domain” to servers honouring the policy; since Feb 2024 Google and Yahoo, and since 5 May 2025 Microsoft, require SPF+DKIM+DMARC from senders of 5,000+ messages/day | does not block look-alike domains (your-f1rm.com) or attacks from genuinely compromised supplier mailboxes | 1 – also a deliverability requirement, not just security |
| Call-back verification procedures | every bank account change, urgent transfer and sensitive-data request confirmed via another channel, to a number from your system (not the email signature); four-eyes rule and amount thresholds | requires discipline; works only if unconditional (“the CEO waits too”) | 1 – zero technology cost, highest return |
| Reporting channel and response | a “report” button in the mail client + a number/messenger for vishing; the SOC pulls a campaign from all mailboxes after the first report | value depends on culture: punishing clickers kills reporting | 2 |
| AI-assisted mail gateway, attachment sandboxing, link isolation | removes mass campaigns and much of the targeted volume | cannot see a phone call, an SMS or a video meeting; an arms race with generators | 2 |
| Family and team safe words (against “relative in trouble” and “CEO” vishing) | simple pre-authorisation for conversations about money | must be agreed before “your son” calls from an accident | 3 – also worth advising employees privately |
Passkeys under the FIDO2 standard are phishing-resistant for cryptographic rather than behavioural reasons: the credential is bound to the service’s domain, so a fake login page receives nothing replayable – it is the only layer whose effectiveness does not depend on user vigilance.
External requirements help set priorities: PCI DSS v4.0.1 requires anti-phishing detection and protection mechanisms from 31 Mar 2025 (requirement 5.4.1) and anti-phishing content in training (12.6.3.1); NIS2 lists cyber hygiene and training in Article 21(2)(g); and DORA Article 13(6) mandates ICT security awareness programmes and digital operational resilience training as compulsory modules for staff – and for senior management.
Patronusec Insight: In our project experience, the cheapest and most often missing control is a formal supplier bank-account change procedure: changes accepted only on a written request verified by phone to the number from the contract or the company register – never from the email – with a second pair of eyes above an amount threshold. In the social engineering exercises we run within our phishing tests, the “supplier account change” scenario still has the highest success rate – and it is the one no email technology stops, because the message often comes from the supplier’s genuine, compromised mailbox.
How do you protect your own customers from brand impersonation?
Protecting customers takes four actions: DMARC at an enforcement policy so nobody sends email from your domain; monitoring and taking down look-alike domains and fake profiles; a public communication contract (“we will never ask you to…”) that gives customers a simple decision rule; and a reporting channel with a takedown procedure. A deepfake “CEO” in an investment advert and a “your bank” SMS strike your customers, but the reputational and support costs land on the brand.
Four actions in implementation order:
- DMARC p=reject on every domain – including non-sending ones (parked domains with SPF
-alland a reject policy are spoofers’ favourites). The rui/ruf reports show who is trying; the Google/Yahoo/Microsoft mandates force the foundation anyway, and p=reject is the natural target after a monitoring period. - Look-alike domain and impersonation monitoring – typosquats, homoglyphs, subdomains in others’ zones, fake social profiles and app-store listings; detect → document → report to the registrar/platform (UDRP procedures, abuse forms). This is exactly the data class that threat intelligence examines in financial-sector TLPT engagements – Annex III of the RTS requires analysis of look-alike domains and dark-web listings.
- A communication contract with customers – a short public list: what we never do (we never ask for your password or one-time codes, never ask you to install software, never call demanding an immediate transfer), what our genuine channels look like, where to report suspicions. Communicated cyclically, not once.
- A response procedure for impersonation campaigns – who monitors customer reports, who collects IOCs, who files takedowns, and when and how you warn customers (via your own channel, without links – so the warning does not itself look like phishing).
A public “what we never do” list is the single most effective protection of customers against brand impersonation, because it gives them a decision rule independent of forgery quality – the customer need not judge whether the voice and logo are real, only know that the real company does not ask for this.
In practice, customer protection is a continuous programme, not a project: look-alike registrations arrive in waves around campaigns, and the deepfake source material grows with every public appearance by your executives.
Where does defence end – what will neither technology nor training stop?
Four limits are irreducible: email filters cannot see a phone call, an SMS or a video meeting; deepfake detectors lose 45-50 % of their accuracy in the wild and are losing the race with generators; attacks from genuinely compromised supplier mailboxes pass every email authentication check; and a human under authority and time pressure yields regardless of training hours. Mature defence assumes some attacks succeed – and minimises the consequences.
Design consequences of “some will get through”:
- Resilience over infallibility – the goal of an awareness programme is not zero clicks but fast reporting: the difference between an incident and a disaster is usually the time from click to SOC response, not the click itself.
- Consequence limitation – passkeys make a stolen password worthless; segmentation and least privilege limit the blast radius of a taken-over account; thresholds and a second pair of eyes stop the transfer even after successful manipulation. The same logic we described for AI agents: a system whose worst mistake is reversible stays safe despite a successful attack.
- A rehearsed “after” scenario – a procedure for successful BEC (immediate contact with your bank – recall is sometimes possible in the first hours), for credential leaks, for a brand impersonation campaign; practised, with contacts to hand – analogous to a ransomware playbook.
- Honest communication of limits – an employee promised that “after training you will recognise every attack” stays silent in shame after a slip; an employee told that a good forgery fools everyone reports without hesitation.
A mature anti-phishing programme is not measured by the number of attacks stopped, but by the time from the victim’s first contact with the attack to the organisation’s response – because at today’s forgery quality, assuming every attack will be recognised is a design error.
What mistakes do organisations make most often against AI phishing?
❌ Annual training about “language errors” – it teaches people to spot attacks from a decade ago; content must cover vishing, deepfakes and multi-channel scripts, and the cadence must be continuous (PCI DSS 12.6.3.1 explicitly requires phishing and social engineering content).
❌ Punishing clicks in simulations – it kills the one metric that saves organisations: reporting. An employee punished once will never report a real incident.
❌ Treating SMS/app-code MFA as phishing-resistant – AiTM kits capture codes and sessions in flight; only FIDO2/passkey methods are resistant.
❌ DMARC at p=none for years – a monitoring policy blocks nothing; without a plan to reach quarantine/reject it is a register of attempts, not a control.
❌ Call-back verification to the number in the email – the attacker supplies their own number in the signature; verification only makes sense to a contact from an independent source (your system, the contract, the official site).
❌ No help-desk procedure – a password or MFA reset “by voice” over the phone is the vector of the biggest intrusions of recent years; the help desk needs a hard identity-verification path resistant to pressure and “the board is waiting” escalation.
❌ Protecting only your own mailbox, not your customers – without look-alike monitoring and a communication contract, the first detection line for brand impersonation is your victimised customers.
FAQ – AI phishing
Can a deepfake be spotted with the naked eye?
Less and less. People recognise high-quality deepfakes in fewer than 25 % of cases, and quality improves every quarter. Defence therefore cannot depend on spotting the fake – decisions about money and access must pass through procedures (call-back verification, a second signature) that hold even against a perfect forgery.
Does MFA protect against phishing?
It depends on the type. SMS codes and push approvals are captured by adversary-in-the-middle kits and fatigue attacks. Phishing-resistant methods are passkeys and FIDO2 keys, because the credential is cryptographically bound to the domain – a fake page receives nothing useful. Deploy first to privileged accounts, finance and executives.
What should we do in the first minutes after authorising a transfer to fraudsters?
Immediately: call your own bank to request a recall or freeze (often possible in the first hours), report to the police and your national CERT, preserve the correspondence, check mailboxes for forwarding rules planted by the attacker, force password changes and review sessions.
Does publishing executive recordings increase voice cloning risk?
Yes – but withdrawing from public communication is not realistic and does not solve the problem (3 seconds from any source suffice). The right response is to assume every public voice in the company can be cloned, and to base decision authorisation on procedures rather than voice recognition.
How does quishing differ from ordinary phishing?
Quishing moves the link into a QR code – in a PDF, an email or physical space (a sticker on a parking meter, a poster). The code bypasses filters that analyse links in text, and scanning with a private phone takes the victim outside corporate protection. Defence: QR isolation/analysis at the gateway, and a rule against scanning codes from unsolicited documents.
How does Patronusec help defend against AI phishing?
We run awareness sessions and controlled phishing tests on current, not museum, scenarios: email, voice and QR variants, tailored to roles. We measure reporting and response time above all, and translate results into procedural recommendations (call-back verification, help desk, payments). We provide a fixed price after a free scoping call.
Recommended reading
- A security awareness programme and phishing simulations that work – the cluster’s second asset: NIS2/DORA/ISO/PCI requirements, simulation design without hunting employees, metrics and an annual schedule.
- Ransomware response playbook – the first 72 hours – what happens when phishing works anyway: the response playbook for the most common consequence.
- Testing AI agents – the same consequence-limiting defence logic, applied to AI systems on the defender’s side.
- TLPT under DORA – how to start – how threat intelligence examines look-alike domains, credential leaks and impersonation material in regulatory testing.
- 12-month cybersecurity roadmap – where DMARC, passkeys and the awareness programme sit among annual priorities.
Defending against AI phishing – consultation
Patronusec runs security awareness sessions and controlled phishing tests – email, voice and QR – built on current AI scenarios, with reporting metrics instead of punishment. If you want to see how your organisation responds to a multi-channel attack, book a free call.
Awareness sessions and phishing tests | Penetration testing | vCISO
