What Is AI Phishing?
AI phishing is social engineering in which attackers use generative AI to write, personalize, and automate deceptive messages across email, text, voice, and video. The request inside the lure is the one conventional phishing has always made: hand over credentials, approve a payment, read out a multifactor authentication (MFA) code, or run a download.
Generative AI removes the labor that used to cap the attack, so one operator can send error-free, individually tailored lures to thousands of recipients, or clone a known executive's voice, for a fraction of the old effort.
How AI phishing works
The attacker still picks the target and the objective; the model does the research, writing, and building in between. State-backed actors have used Gemini to profile high-value targets (opens in new tab) and to translate into and out of local languages, while human operators retain control (opens in new tab) of objectives, targeting, and deployment.
The lure also needs somewhere to land, and attackers now use AI to build that too, as the types below show. After first contact, large language models carry the conversation: chatbots embedded in fraudulent sites prompt victims to click (opens in new tab) malicious links, and voice chatbots pre-screen victims at industrial volume (opens in new tab) as a filter for human operators.
A March 2025 case in Singapore shows the chain end to end. A scammer posing as the CFO (opens in new tab) contacted a finance director on WhatsApp about a regional restructuring, a purported lawyer stressed confidentiality and had the director sign an NDA, and the director then joined a Zoom call where the chief executive and others were deepfakes.
A transfer of more than USD499,000 followed, and the scheme surfaced only when the scammer asked for another USD1.4 million.
Why AI phishing is hard to stop
AI-written messages and cloned faces or voices weaken the cues that employees and filters rely on to spot phishing.
- Text cues. Generative AI produces lures without the translation, spelling, and grammar mistakes (opens in new tab) that often reveal phishing, so employees have fewer errors to catch. AI is also reducing the reliability (opens in new tab) of familiar detection cues while it raises the volume, personalization, and credibility of social engineering.
- Pattern-based controls. Emails adapted to every target can render signature detection obsolete (opens in new tab), and classifiers trained only on conventional phishing perform worse (opens in new tab) on LLM-rephrased mail (see AI-generated phishing detection). In a credential campaign Microsoft blocked, AI-obfuscated code (opens in new tab) hidden in an SVG file drew a Security Copilot verdict: "not something a human would typically write from scratch".
- Familiar faces and voices. Deepfakes and cloned voices add a problem training never addressed: a familiar face or voice is itself the lure. Detection tools exist, but they tend to be domain specific and difficult to test.
Types of AI phishing
AI phishing variants are named for the channel or attack step the model takes over.
- AI-written email and spear phishing. Large language models draft personalized, native-language lures at campaign scale. EvilTokens, a phishing-as-a-service platform that emerged in February 2026, includes AI features for tailoring lures (opens in new tab) and analyzing compromised inboxes.
- Voice-clone vishing. A cloned voice turns a call or voicemail from a known executive into the lure. Attackers have sent AI-generated voice messages (opens in new tab) impersonating senior US officials since at least 2023.
- Deepfake video meetings. North Korea's BlueNoroff group lured victims into fake Zoom meetings (opens in new tab) featuring AI-generated avatars and stolen video of real people. The attackers replaced the meeting link in a Calendly invite with a typo-squatted Zoom URL, and a ClickFix prompt claiming the Zoom SDK needed updating delivered the payload.
- AI-built phishing sites. AI website builders turn text prompts into working replicas of sign-in pages (opens in new tab).
- Conversational phishing. The dialogue is the payload. Underground call-center platforms use a model to suggest persuasive replies to operators in real time, and inbound AI voice responders handle a victim's first questions before a human takes over.
- Agentic phishing. This variant has the least evidence. Threat actors show early signs (opens in new tab) of moving toward agentic AI, but reliability and operational constraints have kept large-scale use from emerging.
How to defend against AI phishing
Layer phishing-resistant authentication, out-of-band verification, and safe reporting.
- Phishing-resistant MFA. Use FIDO/WebAuthn authentication (opens in new tab), the only widely available phishing-resistant MFA. Avoid SMS, voice, and video as authentication factors and rely on certificates and physical security keys (opens in new tab) that resist voice and video impersonation.
- Out-of-band verification for money and credentials. Confirm payment changes through a known telephone number (opens in new tab), never one supplied inside the request. For live calls and video, run identity verification with liveness testing (opens in new tab) during the conversation itself.
- DMARC at reject. Set DMARC to reject (opens in new tab) alongside SPF and DKIM so receiving servers refuse spoofed executive mail that fails authentication.
- Deepfake-aware training and multi-channel simulation. Deliver deepfake training through simulated phishing, voice exercises, and video impersonation exercises. Keep reporting safe, because users who fear reprisals will not report mistakes promptly, if at all (opens in new tab).
- Lookalike-domain detection and takedown. Detect newly registered lookalike domains early. When one goes live, identify the registrar and IP owner (opens in new tab), send abuse reports to their abuse contacts, and keep screenshots and other evidence.
How Doppel helps
Doppel is the Agentic Social Engineering Defense (SED) platform that unifies Digital Risk Protection (DRP), Human Risk Management (HRM), and Email Security. The platform detects and dismantles an AI-built sign-in page outside the perimeter, then uses that lure to test employees inside it.
Point tools split the cloned site, the inbox lure, and the training program into separate views. Doppel's agentic AI correlates domains, social profiles, ads, phone numbers, and email infrastructure into one campaign view in the Doppel Threat Graph, prioritizes the campaign, and executes takedowns at scale, so security analysts focus on the complex escalations that need human judgment.
Every dismantled campaign strengthens the next defense. One-click threat-to-simulation conversion turns a live AI-generated lure into a Simulation campaign across email, voice, SMS, Microsoft Teams, and Zoom, and Security Awareness Training routes follow-up content by each employee's risk profile. Shrinking how long a lure stays live and how many people respond makes your brand too costly to attack.
Request a demo to see how the platform traces an AI-built phishing campaign from the lure to the infrastructure behind it, then dismantles it.
Frequently asked questions about AI phishing
What is AI phishing?
AI phishing is a social engineering attack in which criminals use generative AI to craft and deliver convincing lures. Large language models produce native-level grammar in the target's own language, voice-cloning tools reproduce a specific person's speech, and AI website builders generate working copies of sign-in pages. The objective matches older phishing: stolen credentials, a fraudulent payment, a one-time authentication code, or malware execution. What changes is how believable each message is and how many people one operator can reach.
What is AI phishing in cybersecurity?
In cybersecurity, AI phishing uses the same delivery vectors as conventional phishing, with more convincing lures that cost less to produce. Authorities characterize it by what AI changes: messages tailored to specific recipients (opens in new tab) with proper grammar and spelling, voice and video cloning that impersonates trusted people, and audio and video manipulation (opens in new tab) inside AI-enabled spear phishing in NIST's draft Cyber AI Profile. Adversaries' acquisition of generative AI tools (opens in new tab) for scripting and social engineering is catalogued as T1588.007 in MITRE ATT&CK.
AI phishing vs. deepfake phishing: what is the difference?
Deepfake phishing is a subset of AI phishing defined by the medium. AI phishing covers any attack in which generative AI writes, personalizes, or delivers the lure, including plain-text emails that carry no synthetic media at all. Deepfake phishing uses AI-generated voice or video to impersonate a specific trusted person, such as a cloned chief financial officer on a phone call or a fabricated executive in a video meeting. Every deepfake phish is AI phishing; the reverse does not hold.
What is an example of AI phishing?
In 2025, threat actors used Vercel's v0 AI website builder to generate sign-in page replicas for multiple brands from text prompts. For Okta, it was the first observed use (opens in new tab) of generative AI to create phishing infrastructure instead of only lure text. Producing a working phishing site now takes a text prompt rather than front-end skill.