Modern Phishing Threats: How AI Is Supercharging Social Engineering

Phishing remains the single most common entry point for enterprise breaches, and it has gotten dramatically more dangerous in the generative AI era. The days of misspelled emails from fake princes are over. Today's phishing campaigns are personalized, grammatically perfect, multichannel, and often include synthetic audio or video of executives. Security programs built around old phishing assumptions are failing, and organizations that do not adapt are being compromised at record rates.

The New Phishing Toolkit

Attackers now have unprecedented capabilities. Large language models generate convincing lures in any language at zero marginal cost. Open-source intelligence tools aggregate personal details from LinkedIn, GitHub, press releases, and data breaches to tailor each message. Deepfake audio can spoof a CEO voice for a few dollars. Real-time video deepfakes have been used in multimillion-dollar wire fraud. And phishing-as-a-service platforms lower the bar so that even unsophisticated attackers can run sophisticated campaigns.

Modern phishing campaigns typically include:

• ▸Pretexting research built from scraped professional profiles and company news
• ▸Lookalike domains registered through automated pipelines, often with valid TLS certificates
• ▸Credential proxy kits like EvilProxy or Tycoon that bypass MFA by relaying real-time sessions
• ▸Business email compromise chains that involve multiple compromised accounts in a trusted supply chain
• ▸Multichannel coordination across email, SMS, voice, and collaboration tools like Teams and Slack

Why Traditional Defenses Fall Short

Secure email gateways remain valuable, but they can no longer carry the defense alone. AI-generated content slips past content-based filters because it looks legitimate. Lookalike domains defeat simple blacklists. Session-hijacking kits defeat most forms of MFA. User training helps but is not sufficient when attacks are this convincing.

A Defense-In-Depth Strategy

Effective anti-phishing programs combine technical controls, user empowerment, and incident response capability:

• ▸Phishing-resistant MFA: move from SMS and push notifications to FIDO2 passkeys or hardware security keys that cannot be phished through real-time proxies
• ▸Email authentication: enforce strict DMARC, SPF, and DKIM policies to prevent domain spoofing
• ▸URL rewriting and detonation: inspect links at click time rather than just at delivery time
• ▸Browser isolation: render suspicious sites in a sandbox so credential capture fails even if users click
• ▸Anomaly detection: behavioral analytics that flag unusual login locations, devices, or access patterns
• ▸Just-in-time access: eliminate standing privileges so a compromised account has limited value

Empower Users Without Blaming Them

Users will click. Security programs that treat clicking as a moral failing create fear without reducing risk. Better programs make reporting easy, reward it, and use every reported phish to improve defenses. Simulated phishing should be used as a teaching tool, not a gotcha. Measure reporting rates alongside click rates, because a high report rate often matters more than a low click rate.

Business Email Compromise Specifics

BEC attacks bypass technical controls by exploiting trust. Finance teams receive urgent wire transfer requests that appear to come from executives. Vendors send updated payment instructions that redirect funds to attacker-controlled accounts. Protect against these by:

• ▸Requiring out-of-band verification for any change to payment details
• ▸Setting transaction velocity limits that catch unusual patterns
• ▸Training finance teams specifically on BEC tactics
• ▸Flagging external email clearly in the mail client
• ▸Monitoring for impersonation of executives across channels

Responding to Compromises

When a phishing attack succeeds, speed matters. Revoke tokens, rotate credentials, isolate the affected account, and hunt for lateral movement. Modern identity attacks often involve adding persistent access mechanisms like OAuth app consents or MFA device registration. Incident response playbooks should include searches for these persistence techniques as standard steps.

The Road Ahead

Phishing will keep getting better as generative AI improves. Defense must shift from trying to spot bad messages to architectural controls that make phishing payoff structurally low. That means phishing-resistant authentication everywhere, least privilege as a default, and continuous monitoring for the behaviors that follow a successful phish. Organizations that make these investments will not be immune, but they will be far harder targets than those still relying on the old playbook.