Generative AI has rebuilt phishing into attacks that arrive fluent in many languages, personalized from a target's own public data, and carried across the channels a workforce uses every day. The same campaign now runs by email, voice, text, chat, and video at a speed and scale manual teams cannot match.
MFA protects credentials, but one convincing message or call can still push an employee to hand them over or approve a fraudulent payment before anyone verifies the request. The language mistakes and inbox filters most teams still rely on now miss more of these attacks, and the once-a-year training employees sat through never rehearsed a cloned-voice call.
AI phishing is no longer a lone email. It is a single campaign that crosses those channels and lands on a person, which means detection and defense have to operate at the campaign level too.
Key takeaways
- AI phishing compresses the five stages of the social engineering attack chain (reconnaissance, weaponization, delivery, persuasion, and execution) into one automated, multi-channel workflow that scales faster than manual campaigns.
- Message content is no longer a reliable signal: AI-written lures read as clean, native email, so detection has to shift to the external infrastructure and account behavior behind the campaign.
- Out-of-band verification and phishing-resistant MFA hold even when a lure is flawless, because they do not depend on an employee spotting the fake.
- Durable defense pairs infrastructure disruption with a human-risk program that rehearses employees against the live attacks in circulation, then measures behavior change rather than module completion.
How AI phishing attacks work
An AI phishing attack moves through the five stages of the social engineering attack chain: reconnaissance, weaponization, delivery, persuasion, and execution. Generative AI compresses and sharpens every stage, so work that once took a skilled operator days can run as an automated sequence in minutes.
Stage 1: Reconnaissance uses public data to profile targets and map their relationships
AI-powered reconnaissance profiles targets at scale, pulling job titles, active projects, and professional relationships into a working model of who a victim trusts and how they communicate. Attackers feed public sources like LinkedIn profiles, recorded talks, and leaked email threads into that model until it can mimic a real business process. State-sponsored groups already run this at scale: Iranian government-backed actor APT42 used AI for phishing campaigns and reconnaissance against policy and defense experts.
Stage 2: Weaponization turns profiles into tailored lures and lookalike infrastructure
The profile becomes raw material. An LLM turns a target's recent activity into a lure that references real projects and real relationships, while a short audio sample from an earnings call or podcast becomes an interactive voice clone. The point is scale without repetition: AI can generate multiple versions of one message from a single prompt, each close in meaning but different enough to slip past simple signature matching.
Attackers build the surrounding infrastructure the same way, refining lookalike domains through adversarial generation until they are nearly indistinguishable from the real ones.
Stage 3: Delivery brings the lure across every channel at once
Delivery no longer means the inbox. The same campaign runs as email phishing, smishing, quishing, vishing with cloned voices, and deepfake video meetings, often in coordinated sequence across the channels employees trust most, including collaboration tools like Slack and Teams.
Nation-state actors have pushed this further, delivering device code phishing including through Teams and other meeting or messaging invitations, which makes the request harder for an employee to flag as fraudulent.
Stage 4: Persuasion pairs a familiar name, voice, or face with authority and urgency
In one deepfake video call, an employee joined what looked like a routine meeting with the CFO and several colleagues, all generated by AI, and authorized transfers worth roughly $25 million. Persuasion works by turning a familiar identity cue into authority and urgency before verification can happen.
AI-generated follow-ups let attackers sustain that pressure over time. A delayed request can wait until trust is established, and framing a transaction as confidential keeps colleagues out of the loop while the attacker continues for days.
Stage 5: Execution converts misplaced trust into credentials, access, or fraudulent payments
Misplaced trust becomes stolen credentials or a fraudulent payment. In a documented Unit 42 incident, after several failed phishing attempts, an attacker called IT support impersonating an executive and citing travel issues, a pretext convincing enough to prompt an MFA reset. With fresh credentials the attacker began enumerating permissions and file paths through the Microsoft Graph API, though conditional access ultimately blocked the escalation.
Adversary-in-the-middle kits close the same gap without a reset: they proxy the login, capture the authenticated session cookie, and replay it. Attackers can still intercept common legacy MFA flows that rely on a user relaying or approving a value, such as SMS codes and authenticator-app push approvals.
How to detect AI phishing attacks
The language mistakes and known-bad signatures detection once matched have faded, and LLM-generated emails now read as clean, native writing. The scale of the shift is measurable: AI-automated phishing emails reached 54% click-through rates against 12% for standard phishing, a 4.5x increase. That figure compares AI-automated phishing directly to standard phishing rather than to all email threats.
Because content is no longer a reliable signal, detection has to shift to the actor behind the message and the campaign's behavior. Infrastructure signals, account behavior, cross-channel events, and employee reports have to roll into one campaign view.
Ground detection in the external infrastructure behind the lure
Detection has to start with the infrastructure attackers build before they send. That footprint is the hardest part of a campaign to fake: newly registered domains carry no historical reputation, so catching them means correlating passive DNS and certificate data early in a domain's lifecycle, before it earns trust. Teams can extend this from single domains to full campaigns with graph analysis, pivoting from seed indicators across shared hosting and certificates to surface new phishing domains the moment they appear.
Score sender and account behavior as the primary signal
A compromised account can pass every authentication check while behaving nothing like its owner. That gap is the signal. Volumetric baselines flag a sudden sending spike against an account's long-running history, and login geography, device fingerprinting, and new forwarding rules combine into a high-confidence account takeover verdict that content alone rarely produces.
Correlate events across channels into a single campaign
Single-channel detection misses the campaign, because AI-enabled attackers operate everywhere at once. A new inbox rule or a lone call to the help desk looks minor in isolation; correlated into one campaign, it exposes the multi-stage attack that stays hidden from an analyst watching a single channel. Email tools still hold most of the reviewable data, which is exactly why the blind spots sit off-email.
Turn the workforce into a fast reporting sensor
Awareness advice that stops at "don't click" has already lost. Employee reports catch attacks that technical content analysis misses, and speed is what makes them valuable: a human sensor network shrinks the response window when the first report arrives fast, not when the most reports arrive. CISA and its partners now say plainly that telling users to avoid clicking is not enough, which makes structured reporting and the controls behind it the necessary complement to training.
How to defend against AI phishing attacks
Detection narrows the response window; defense reduces what a convincing lure can accomplish once it reaches a person. The durable moves start with the human layer.
Route high-stakes requests through out-of-band verification
Route high-stakes requests through a channel the requester doesn't control, because that control holds even when the message itself is flawless. An attacker who has compromised an account also controls its communication channel, so verification has to move to a separate, pre-established one.
For deepfake-enabled requests, FinCEN guidance pairs multifactor authentication with live verification checks and treats any attempt to change communication methods mid-verification as a red flag. Require callbacks to previously established numbers, never numbers supplied in the request itself.
Back this with phishing-resistant MFA. FIDO2 keeps credentials cryptographically bound to the site's domain, so the authentication ceremony fails even when a perfect lure sends a user to a fake login page.
Modernize security awareness training for the lures employees actually face
Retire annual, email-only, spot-the-typo modules and teach verification reflexes across the channels employees actually face. Annual training alone can't build the reflexes people need against live, multi-channel impersonation.
Modern training mirrors the real attack pattern, where a phishing email sets the story, a text adds urgency, and a deepfake voice call closes the trap. It also trains by role: a finance analyst facing business email compromise (BEC) and a developer facing credential theft need distinct role-based training for each scenario.
Rehearse against live attacks with multi-channel and deepfake simulations
Extend drills to voice, text, chat, and video, and base them on the attacks currently in circulation. Multi-channel simulation exposes the behavioral gaps email-only testing consistently misses. Help desk teams need these drills most: attackers used help desk voice phishing to talk employees out of their single sign-on credentials across 2025 retail, insurance, and airline intrusions.
Manage human risk continuously, by role and by individual
Score each person's exposure, route the highest-risk people the most practice, and measure behavior change over time instead of module completion. Click rate is a weak standalone signal: federal awareness programs report that measuring behavior change is hard and that benchmarking guidance is lacking, so a movement in the number often says more about the test than the workforce. Enterprises that combine GenAI with an integrated platform architecture in behavior programs can cut employee-driven incidents by 40% by 2026, which is what continuous, individualized risk management is built to deliver.
How Doppel defends enterprises against AI phishing attacks
Doppel is the AI-native Social Engineering Defense platform that unifies Digital Risk Protection and Human Risk Management against AI phishing campaigns. It detects and dismantles the phishing infrastructure behind a campaign: the lookalike domains, spoofed pages, cloned-voice signals, and malicious profiles that carry the attack across email, web, social, and messaging.
The Doppel Threat Graph correlates those scattered signals into campaign-level takedowns rather than one-off alerts. Its agentic AI prioritizes and executes those takedowns at scale, so analysts focus on the complex escalations that need human judgment while the platform dismantles domains, pages, profiles, and messaging assets faster than the actor can rebuild them.
Doppel's response matches attackers' multi-channel operations. In its financial-services threat brief, email had emerged by April 2026 as a leading source of attacker activity against financial services and fintech brands, alongside social and messaging, as campaigns expanded across channels.
The same closed loop turns the attacks the platform detects into workforce rehearsal. Doppel converts a detected threat directly into an employee simulation, so the lures in circulation today are what employees practice against tomorrow, on the same channels attackers use. That includes adaptive voice-agent calls built from a short audio sample and deepfake video scenarios in Microsoft Teams and Zoom. Risk modeling scores exposure and supports targeted remediation by individual risk and performance, so a security team can see exactly where its human risk is concentrated and prove the program is reducing it.
Defend detection and the workforce as one system
Security leaders should stop trusting a message, a call, or a face because it looks and sounds right, and stop measuring defense by completed modules or a single click rate. AI phishing is one campaign that crosses every channel and lands on a person.
Teams pull ahead when detection feeds both infrastructure disruption and workforce resilience, and when they measure success by how much human risk they remove until the enterprise becomes too costly to attack. The strongest defense dismantles the infrastructure behind the campaign and turns it into practice that hardens the workforce against the same attacks.
Request a Demo to see how the platform runs detection and human resilience as one loop.
Frequently asked questions about AI phishing
How is AI phishing different from traditional phishing?
Traditional phishing relies on volume and generic lures that often carry the language mistakes employees are trained to spot. AI phishing personalizes each lure from a target's own public data, writes in clean and native language, and runs the same campaign across email, voice, text, chat, and video at once. The result is higher engagement and far fewer of the tells that content-based filters and awareness training depend on.
Can AI phishing bypass MFA?
Yes. Adversary-in-the-middle kits proxy a real login, capture the authenticated session cookie, and replay it, sidestepping MFA methods that rely on a user relaying or approving a value, such as SMS codes and push approvals. Phishing-resistant MFA built on FIDO2 resists this because the credential is cryptographically bound to the legitimate domain and fails on a lookalike site.
How do you detect AI-generated phishing?
Because AI-written content reads as legitimate, detection shifts from message text to the actor and infrastructure behind it. Teams watch for newly registered domains, shared hosting and certificate patterns, and deviations from an account's normal sending and login behavior, then correlate signals across channels into a single campaign view. Fast employee reporting adds a human sensor layer that catches what technical analysis misses.
What is the best defense against AI phishing?
There is no single control. The most durable defense pairs out-of-band verification and phishing-resistant MFA with continuous, multi-channel training tied to the attacks currently in circulation, layered on top of infrastructure takedown that removes lookalike domains and pages before they reach employees. Measuring behavior change by role, rather than annual module completion, keeps the program honest.