AegisAI Perspectives · 025
Stop AI-generated phishing campaigns by judging what each email asks for and where its links lead, then enforce both DMARC and phishing-resistant sign-in.
Stop mass AI-generated phishing campaigns by judging who sent each email, what it asks for and where its links lead, since the wording keeps changing. The FBI logged more than 22,000 complaints reporting AI-related information in 202517. AegisAI applies this by opening each link, file or QR code in a sandbox and following it to the end23. Pair it with DMARC at p=reject12 and phishing-resistant authentication for high-value email and approval workflows20.
Close the sender identity gaps first, then make the mailbox and the people judge what each message asks for.
Publish an SPF record that ends in hard fail (-all), so receivers can reject mail from unauthorized sources6. Do it for every domain you own, including domains that send no mail3.
Sign outbound mail with DKIM and publish a DMARC record, the domain-level policy defined in RFC 748911. Move the p tag to reject once legitimate senders pass, so receivers refuse failing mail during the SMTP transaction.
In Google Workspace, add the SPF record when you point the MX records at Google7. Without SPF, mail your users send can land in recipients' spam.
In Microsoft 365, turn on impersonation protection in the anti-phishing policy. The default policy leaves it off.
Set the quarantine policy to act on combinations of signals, and use warnings or step-up validation for a single anomaly21.
Require phishing-resistant authentication for high-value email and approval workflows.
Add an out-of-band check to the payment approval policy: a short call to a number you already had19. A message that no filter flagged can still be fraudulent.
Run Microsoft Secure Score monthly to confirm these settings stay on.
AegisAI opens every link, file and QR code in a sandbox, follows it to the end and judges what it finds there, as the page on how every link is followed and every page read sets out. QR codes are decoded to a URL and detonated like any other link. A gate in front of a page counts as evidence, and a hidden page is never scored clean.
The signals that tie variants together are the parts each email needs to work: its sending domain, borrowed name, link destination and request.
| Signal | What to set or read | Fact |
|---|---|---|
| Sending domain authentication | SPF hard fail (-all), DKIM, DMARC p=reject | , |
| Borrowed display name | Impersonation protection in the anti-phishing policy | |
| Link, file or QR destination | Follow each one to its final page in a sandbox | , |
| Gated or hidden page | Treat the gate as evidence | |
| The request (payment, credentials, approval) | Out-of-band call to a known number, phishing-resistant sign-in | , |
| Several signals at once | Quarantine or block, and warn on a single signal |
A campaign of rewritten emails still collapses into one case once you read the destination and the request.
Illustrative example, figures are fictional. A 1,500 mailbox company receives 600 invoice emails in 3 hours. No two share a subject line or an opening sentence. They come from 4 newly registered domains that pass their own SPF and DKIM checks, and 410 of them borrow the finance director's display name. Every link ends at the same sign-in page behind a CAPTCHA.
A wording filter has no known template to match. Impersonation protection flags the 410 borrowed names. Following each link to the end lands on one credential page, so all 600 group into one campaign. The quarantine policy acts on the combination and removes 590, and the 10 that carry one signal get a warning. One employee calls the finance director on a known number and stops a $48,000 transfer request.
Adaptive AI phishing writes each message fresh, so no two emails in a campaign share a template. A traditional campaign sends one lure to many inboxes, and a filter that has seen it once can match the rest. The FBI's IC3 counted 191,561 phishing and spoofing complaints in 202515, and reported losses across all crime types reached $20.877 billion, a 26% rise from 2024.
The attacker side is covered in how generative AI phishing makes threat actors' emails more convincing. For the mass version, read what AI Dragnet phishing is and why mass AI email attacks became harder to detect.
Legacy filters match what they have seen before, and an email written once has no earlier copy to match. Microsoft describes the protection built into every cloud mailbox as preventing broad, volume-based, known attacks1. Defender for Office 365 Plan 1 adds protection from zero-day malware and phishing, and from business email compromise.
The cost shows in business email compromise, where IC3 lists $3,046,598,558 in losses for 202516. The gateway side of this is covered in why a secure email gateway still misses phishing.
Detect them by checking the sender first, then the link destination, then the request. The wording is the part the model rewrites, so it carries the least weight.
Check the sender against DMARC first, because a domain owner's policy covers mail that uses its own domain11. A lookalike domain the attacker registered falls outside that policy, so impersonation protection has to catch the borrowed name4.
Then follow each link to the page it ends on, including pages hidden behind redirects and gates. The detail is in what happens when the attacker hides the payload. Last, weigh the request. Act hard only when several signals combine21.
Use four layered defense controls against adaptive phishing attacks, one for each part of the email that cannot change.
The full Microsoft 365 and Google Workspace settings list is in the practical guide to hardening both platforms against AI-generated phishing.
The metrics that prove AI phishing defenses work each tie to one setting and come from a report you already receive. Take a baseline in week one and compare it in week four.
A number that does not move after its setting changes means the setting is off or scoped wrong.
Track three numbers over the month, one per layer.
Yes, when detection reads what each email needs to work. Authenticate senders with DMARC on top of SPF and DKIM, follow every link to its final page, and check requests for money or credentials out of band. Rewording leaves the sender and the link destination unchanged.
It stops mail that fails DMARC for your own domain once the policy is p=reject. DMARC expresses domain-level policy for the domain owner, so a lookalike domain the attacker registered passes its own checks. Read why DMARC-passing emails can still be phishing.
No. A message that no filter flagged can still be fraudulent, so the check has to sit in the process. Make any change to payment details or approvals wait for a call to a number you already had.
Turn on impersonation protection in the anti-phishing policy. The default policy does not turn it on, so it has to be configured. Then check that the SPF record ends in hard fail (-all).
No. Reserve quarantine and blocking for combinations of signals, and use warnings or step-up validation for a single anomaly.
Read DMARC aggregate reports as they arrive, daily or more often. Run Microsoft Secure Score monthly. Check again after every new domain, since unused domains need the same authentication records.
