AegisAI Perspectives · 026
Traditional phishing gave itself away with typos and generic wording, and AI-generated phishing removes those tells, so detection checks senders and links.
AegisAI's Q3 2026 State of the AI Attack report found phishing rose 49% this quarter1. AI-generated phishing emails differ from traditional phishing because they read fluently and cost far less effort to write. Typos and generic wording stop working as tells. AegisAI reads each email for what it is trying to do, so clean grammar earns no trust on its own.
The FBI's Internet Crime Complaint Center warns that criminals use generative AI to create believable messages faster and reach a wider audience10. The mass-campaign pattern itself is covered in what AI Dragnet phishing is and why it grew.
Check what the email asks for and where it leads, because AI-generated text removes the wording errors older filters and readers relied on. AI-written messages bypass detection methods that rely on keyword matching or known patterns, according to guidance from the University of British Columbia15.
Read the Authentication-Results header for DMARC with SPF and DKIM. Treat a pass as proof of the sending domain only. The report counts 38x more AI Dragnet attacks sent from hijacked accounts, from 0.2% to 7.7%2, and a hijacked account passes its own domain's checks.
Compare the sender with its history: first contact, a new Reply-To address or a changed display name. Genuine emails often refer to previous conversations or recent transactions16.
Name the request in one phrase: a payment change, a sign-in, a device code, a file share. Hold any request that moves money or credentials outside the normal approval path.
Follow every link to its final page. Include redirects and QR codes. The FBI reports criminals embedding AI-powered chatbots in fraudulent websites to prompt victims to click malicious links11.
Treat a gated landing page as evidence. Threat Watch found the Wazza kit puts each visit through a hostname check, a beacon, a signed session token and an anti-bot gate before the lure appears7.
Turn on the platform layer before tuning it. In Microsoft 365, Defender for Office 365 Plan 1 covers phishing and business email compromise as well as zero-day malware17, and Plan 2 adds investigation, hunting, response and phishing simulations.
Report confirmed fraud to the FBI's IC3, the central hub for reporting cyber-enabled crime20.
The numbers show more volume and more mail from real accounts, while the one controlled test shows AI text alone does not out-write a human team. The Q3 2026 State of the AI Attack report found that AI Dragnet's share of all confirmed phishing grew 11.6x in one quarter, from 0.5% to 5.8%3.
| Measure | Figure | Source |
|---|---|---|
| Confirmed phishing, change this quarter | up 49% | Q3 2026 State of the AI Attack report |
| AI Dragnet share of all confirmed phishing | 0.5% to 5.8%, 11.6x | Q3 2026 State of the AI Attack report |
| AI Dragnet attacks sent from hijacked accounts | 0.2% to 7.7%, 38x | Q3 2026 State of the AI Attack report |
| Time to generate one AI phishing email in a controlled test | five minutes, five prompts | IBM X-Force12 |
| Employees who received a phishing email in that test | over 800 | IBM X-Force |
| Authentication result for mail from a hijacked account | passes DMARC, SPF and DKIM for that domain | Q3 2026 State of the AI Attack report |
AegisAI opens each link, file or QR code in a sandbox, follows it to the end and judges what it finds there4. A page hidden behind a gate is read as evidence, and a hidden page is never scored clean. A QR code is decoded to a URL and detonated like any other link.
Follow the request and the link, since the wording of an AI-generated email gives nothing away.
Illustrative example, figures are fictional. A finance clerk at Harbour Lane Logistics receives an email from a supplier contact she has written to for two years. The message is fluent, names last month's invoice and asks her to confirm updated bank details through a shared document. DMARC passes, along with SPF and DKIM, because the supplier's mailbox was taken over. The traditional version of this lure came from a lookalike domain, opened "Dear customer" and misspelled the supplier's name. Here, only two things are wrong. The request moves money outside the normal approval path, and the shared document link opens a bot check, then a sign-in page on a domain the supplier has never used. The clerk holds the payment and calls the supplier on a number from the original contract.
The key differences are wording quality, personal detail, the effort per message and the accounts the mail comes from.
AI phishing emails are harder to detect because the cues filters and people were trained on are gone, and more of the mail comes from real accounts. Keyword and known-pattern filters miss text that has never been seen before. Mail from a hijacked account passes DMARC, with SPF and DKIM, for that account's domain.
The landing pages also hide. Wazza decides, step by step, whether a visitor is worth showing the lure to8, so a scanner that stops at the first page sees nothing. Compromised accounts give reach that a new domain lacks: Threat Watch traced the October 2026 GhostAction wave to more than 30,000 repositories through about 1,900 compromised accounts9. The inbox side of the same problem is measured in how much AI phishing reaches the inbox.
You spot an AI-generated email by its context, since its grammar is usually clean. Ask whether the message refers to a real earlier conversation or transaction, as genuine mail does. Check whether the request matches how this sender normally works. Hover over every link and confirm the final domain before signing in anywhere.
Do not rely on a reader's instinct alone. In the IBM X-Force test, the AI-generated phish was reported as suspicious at a higher rate than the human-written one14.
Seven signs hold up whether a person or a model wrote the email. Check each one before acting.
Gated pages are covered in more depth in how CAPTCHA phishing pages hide from link scanners.
The best documented example comes from IBM X-Force, which generated a phishing email in five minutes from five prompts. The team tested it against a human-written email in a campaign that reached over 800 employees at a global healthcare organization. The AI-generated phish lost to the human one and was reported as suspicious more often.
Track three numbers over the next month and compare them with the report's quarter.
Never open links, attachments or QR codes from a sender you do not expect, and never sign in from a link in the message. The FBI reports fraudulent websites that use AI chatbots to steer victims toward malicious links. Report the message instead of replying.
AI-generated phishing emails read fluently and take minutes to produce. IBM X-Force generated one in five minutes from five prompts. The tell moves from the wording to the sender and the request, then to the link's final page.
Not in the one controlled test available. In IBM X-Force's test, the AI-generated phish lost to the human-written email and was reported as suspicious more often. The measured advantage is speed: five minutes from five prompts.
Often, when they come from a hijacked account. The Q3 2026 report counts 38x more AI Dragnet attacks sent from hijacked accounts, from 0.2% to 7.7%. Authentication proves which domain sent the email and says nothing about its intent.
One measured slice is AI Dragnet. Its share of all confirmed phishing grew from 0.5% to 5.8% in Q3 2026, an 11.6x rise. Overall confirmed phishing rose 49% in the same quarter.
Report it inside your mail platform first, so your security team can pull other copies. Report fraud losses to the FBI's Internet Crime Complaint Center, the central hub for reporting cyber-enabled crime.
