AegisAI Perspectives · 017
Threat actors use generative AI to write error-free, personal phishing lures, copy executives and send one template to many organizations, the data shows.
In generative AI phishing, threat actors use language models to write error-free, personal lures and send one template to many organizations. AegisAI's Q3 2026 State of the AI Attack report found phishing rose 49% this quarter1.
AegisAI reads each message for what it asks the reader to do and where its links lead. The FBI warns that criminals use AI-generated text to appear believable to a reader in furtherance of social engineering12. The same report counts the AI-written slice of confirmed phishing: AI Dragnet attacks grew their share 11.6x in one quarter2.
A generative AI phishing campaign runs in six steps, and AI does the work in the first four. Each step below names the header, protocol or request type it touches.
An AI agent collects the target's name and role from public pages and writes them into the greeting and the Subject line. In one lab study, the AI-gathered information was accurate and useful in 88% of cases22.
Criminals use generative AI tools to assist with language translations to limit grammatical or spelling errors14. Both MIME parts of the message, plain text and HTML, then read cleanly.
Chat generators can quickly create official-sounding emails mimicking a company's CEO or other officials17. The From display name is set to match that person.
AI Dragnet attacks blast one AI-written template at as many organizations as possible. The FBI notes that criminals create messages faster, which lets them reach a wider audience with believable content13.
AI Dragnet attacks from hijacked accounts went from 0.2% to 7.7%, 38x more3. Mail sent from a real mailbox on its own domain passes SPF, DKIM and DMARC, which is why DMARC-passing emails can still be phishing.
The lure asks for a login, a reply or a change to payment details, the pattern of business email compromise (BEC). In 2025, businesses reported losses over $30 million to BEC scams involving AI16.
Steps 2 to 4 remove the spelling mistakes and odd phrasing that readers once used to spot a fake. Steps 5 and 6 decide whether the message gets through and what it costs.
AegisAI gives each inbox one agent, and four specialists read every message to reach one explainable verdict10. The phishing prevention page explains how each message is investigated: every link, file and QR code is opened in a sandbox, followed to the end and judged on what it finds there9. Redirect chains are followed hop by hop in an isolated browser, and the chain is recorded in the verdict11.
The request and the link destination still give it away, and so does the template behind the text. The Q3 2026 report scores each confirmed message on stylistic signals common in language-model output, plus hard artifacts such as unfilled template placeholders6.
Check these signals on any message that asks for money, a login or a file:
What AI Dragnet phishing is and why mass AI email is harder to detect covers the template pattern in more detail.
Production mail data and FBI complaint data both show growth, and they count different things. The Q3 2026 report counts confirmed phishing in more than 100 million emails sent to over 1 million mailboxes, from July 1 to September 2, 20265. The FBI's IC3 counts complaints in which victims reported AI-related information15. A lab study counts clicks from people who agreed to take part21.
| What is measured | Figure | Who measured it | Fact |
|---|---|---|---|
| Change in phishing, Q3 2026 | Rose 49% | Q3 2026 State of the AI Attack report | |
| AI Dragnet share of confirmed phishing | 0.5% to 5.8%, 11.6x | Q3 2026 State of the AI Attack report | |
| AI Dragnet attacks from hijacked accounts | 0.2% to 7.7%, 38x | Q3 2026 State of the AI Attack report | |
| Mail behind the report | More than 100 million emails, over 1 million mailboxes | Q3 2026 State of the AI Attack report | |
| Complaints reporting AI-related information, 2025 | More than 22,000 | FBI IC3 2025 annual report | |
| Business losses to BEC scams involving AI, 2025 | Over $30 million | FBI IC3 2025 annual report | |
| Click-through on fully AI-automated phishing, 101 participants | 54%, against 12% for the control group | Research study, arXiv 2412.00586 |
Read the rows by what each source sees. The report sees mail that reached protected mailboxes. The IC3 sees what victims chose to report. For the wider set of figures with their sources, see email threat statistics for 2026 with sources.
One campaign shows every step above in a single message.
Illustrative example, figures are fictional. Harbor Lane Logistics runs 640 mailboxes. On a Tuesday, 212 of them receive the same invoice reminder from a supplier's real mailbox, taken over by an attacker the week before. The message passes sender authentication because it comes from the supplier's own domain. The English is clean and the tone matches the supplier's account manager. The payment link points to a page registered two days earlier. One copy still opens with "Hi [First Name]", a template field that was never filled. The security team searches the subject line and finds the same body at 3 partner firms. They pull all 212 copies and call the supplier on the number in the contract, who confirms the account was hijacked. Two users had clicked, and both reset their passwords within the hour.
Generative AI phishing is phishing whose text a language model writes, edits or translates, and 2026 is the year that share became measurable in production mail. AI Dragnet attacks went from 0.5% to 5.8% of confirmed phishing in one quarter. Those sent from hijacked accounts went from 0.2% to 7.7%.
Primary sources describe the same shift. Verizon's 2026 Data Breach Investigations Report says threat actors use AI to work faster at every stage, from spotting security gaps to writing malware19.
Three vectors travel with AI-written email: cloned voices that back up the message, hidden text aimed at AI assistants, and clean text that removes the old spelling cues. Each one needs its own check.
Deepfakes. The FBI warns that criminals can use AI-generated audio to impersonate well-known, public figures or personal relations to elicit payments24. A call that confirms an email request proves nothing on its own. Call back on a number you already hold.
Prompt injection. An email can carry instructions written for the AI assistant that summarizes the inbox. How prompt injection reaches the AI assistant reading your inbox walks through the mechanism.
AI detection bypass. Generative AI limits grammatical and spelling errors, so any check that leaned on those errors loses its signal. The report's method scores stylistic signals and template artifacts instead.
They show AI-written lures perform as well as expert ones and now appear in reported losses. In the 101-person study, fully AI-automated phishing emails reached a 54% click-through rate, on par with human experts, against 12% for the control group.
A second study found LLM-generated lateral phishing emails as effective as those written by communications professionals23. In 2025, the IC3 received more than 22,000 complaints reporting AI-related information. One documented case is how a Midnight Blizzard-linked actor automated device code phishing with AI.
Judge each message by its request, and confirm every payment or credential request on a second channel. Grammar and tone no longer separate real mail from fake.
How much AI phishing reaches the inbox and how many people click shows where the misses sit.
Track three numbers for 30 days and compare them with the report's quarter.
AI-based phishing is phishing whose text, translation or targeting is produced with generative AI. The FBI says criminals use AI-generated text to appear believable to a reader. AI Dragnet is one form: one AI-written template sent to as many organizations as possible.
Yes. AI Dragnet sends one AI-written template widely and grew 11.6x in share in one quarter. Hijacked-account versions rose from 0.2% to 7.7%. The IC3 describes chat generators that create official-sounding emails mimicking a company's CEO.
They profile targets and remove grammar errors. They copy an executive's voice and send one template to many organizations. In a 101-person study, fully AI-automated emails reached a 54% click-through rate.
Not by spelling alone. Criminals use generative AI to limit grammatical or spelling errors. Teach staff to check what the message asks for and where its link leads. Before any payment change, they call back on a known number.
The Q3 2026 report's classifier scores each confirmed message on stylistic signals common in language-model output. It also looks for hard artifacts such as unfilled template placeholders.
It is based on more than 100 million emails sent to over 1 million mailboxes, from July 1 to September 2, 2026. It found phishing rose 49% in the quarter.
