AI-Written Phishing Is Outrunning Behavior-Based Email Defenses

For years, a malicious email often gave itself away: awkward phrasing, a generic pretext, a template seen a hundred times before, a sender that had never written before. Generative AI is removing those clues. Lures now arrive fluent, personalized and unique per recipient, and filters built to spot "unusual" messages have less to work with.

The point was made by Proofpoint at its Protect 2026 conference and reported by The Hacker News. We summarize what matters below and what defenders should take from it.

What happened

Proofpoint described several campaigns that show the shift:

One operator, 30+ conversations. A single actor contacted more than 30 real estate agents at the same company, each from a different real mailbox, about a different property, in different words. Every thread ended with the same request: join a video meeting. In one case, an inspection enquiry became a "meeting invitation" 13 minutes later. The link went through a genuine google.com redirect, so reputation checks came back clean.
Device-code phishing as a service. One kit showed four disguises (a court portal, a document-signing request, an identity check and a finance report library) in front of a single flow. The victim copies a code and pastes it into a legitimate sign-in page, which approves the attacker's session.
Fabricated BEC threads. A single email included an entirely invented back-and-forth between an "audit vendor" and an executive, plus a detailed invoice and a remittance address that differed from the sending one. That once took hours of research. A language model produces it in seconds.
Harassment without a payload. Hundreds or thousands of senders write to the same executive with tailored, hostile text or AI-manipulated images. There's no link and no attachment, so the harm only shows in the aggregate.

The wider numbers point the same way. The FBI's IC3 2025 report counted more than 22,000 AI-related complaints (nearly $900 million in losses) and 24,768 BEC complaints (about $3.05 billion).

Why it matters

Behavioral detection depends on attackers cutting corners: reused infrastructure, bad language, odd timing. When every message is written fresh and first contact comes from a real mailbox, there's no history to compare against and no repeated content to match. Proofpoint argues the remaining signal is intent: what the message is trying to make the recipient do (click, enter credentials, pay, join a meeting) and whether that makes sense in context. Proofpoint sells products built on this approach, so read it as a vendor view. The underlying observation is still sound: an AI-polished message can look normal, but its goal can't change.

What to do

Verify payment and banking changes out-of-band. Use a known phone number, not the one in the email. Treat "keep this off the thread" and "our finance mailbox is mid-migration" as red flags.
Train for the ask, not the typos. Teach staff that a flawless, friendly message can still be malicious, and that the request is what to evaluate.
Shut down device-code phishing. Restrict or monitor the OAuth device authorization flow in your identity provider where you don't need it, and alert on unusual device-code sign-ins.
Watch for account-takeover follow-through. New inbox rules that hide replies, sign-ins from unexpected locations and bursts of internal outbound mail are classic post-compromise signs.
Correlate across mailboxes. Campaigns like the real estate one are spread so that no single inbox sees more than one message. Look at patterns across the organization.
Assume some credentials will leak. These campaigns usually end in stolen logins. Our Deep/Dark Web monitoring service watches for your organization's credentials and data showing up in criminal markets and dumps, so you can reset accounts before they're used.

Based on reporting by The Hacker News on Proofpoint's Protect 2026 presentation.