AI phishing attacks: why they are suddenly so convincing
AI phishing attacks are cyberattacks in which criminals use artificial intelligence tools, including large language models, to generate persuasive messages and malicious content that mimic legitimate communications, making it harder for individuals and organizations to distinguish scams from real emails, documents, and applications.
The uncomfortable truth is that attackers are adopting AI faster and more creatively than most defenders. Cybercriminals now disguise malware as artificial intelligence services and abuse open‑source software used in AI development to reach users who believe they are installing helpful tools. Kaspersky’s researchers recorded 92,000 malicious attacks masquerading as AI services in 2026, nearly half impersonating popular chatbots, a sharp signal that this is not a niche experiment but a new default for online crime. The same tools businesses deploy to boost productivity are being mirrored by threat actors to improve their own success rates. If you treat AI as a neutral technology wave instead of an offensive weapon in phishing campaigns, you are already behind.
From fake AI apps to poisoned code: who is at risk
AI phishing attacks are no longer limited to email text; they now hide inside the very tools people use to work and experiment with AI. Attackers distribute fake versions of popular AI applications, tricking users into installing trojans and spyware that can steal internal information or give unauthorized access to systems. This targets both curious consumers and professionals under pressure to “try AI” without waiting for formal approvals. At the same time, AI developers depend heavily on public code repositories, which have become prime terrain for supply chain attacks through compromised packages.
This is already hurting real organizations. A Kaspersky survey found that 31% of enterprises have been affected by supply chain attacks due to the widespread use of open‑source components in corporate development environments. These numbers make one thing clear: the group at risk is not a niche set of AI engineers. Everyday employees, software teams, and anyone downloading “AI helpers” are part of the new attack surface—and most do not realize it until after the breach.
Local LLMs in the shadows: how state groups sharpen phishing
The most worrying shift is not generic phishing text, but state‑sponsored groups quietly building AI factories for cyber‑espionage. Investigators have observed the Kimsuky group running large language models locally and collecting technology to weave AI into their attack operations. They set up local LLM environments using tools such as Ollama, GPT4All, and Msty on infrastructure they control, keeping conversations and stolen data away from outside AI services that could expose them.
This is deliberate capability building, not casual tinkering. Researchers found that the group is continuously preparing to integrate AI into malware development, data analysis, and more advanced attack techniques, rather than limiting themselves to a few AI‑written documents. Their recent phishing emails arrive as ZIP archives carrying malicious LNK files disguised as international event materials, research reports, or meeting requests. Some lures focus on virtual assets and finance, written with polished structure and natural language that mimic real business materials to win the victim’s trust. When such adversaries use AI, they are not chasing novelty—they are increasing the odds you will click.
Why traditional phishing detection is failing
Most corporate defenses still treat phishing as a content problem: scan for suspicious wording, odd grammar, or certain attachment types. AI phishing attacks break that model. Decoy documents created with AI now use natural language, polished structure, and familiar business formats to increase user trust and lure victims into running malicious files. When Kimsuky’s targets open the ZIP archive and execute the LNK shortcut, it silently launches a PowerShell loader that collects extensive system information—from operating system version to boot history and running processes—to guide follow‑on attacks.
Because the text reads like a real colleague’s message, content‑based filters have less to grab onto. According to researchers, defenders must move from content‑based assessment to behavior‑based detection as the baseline for security recommendations. That means watching what happens after a file or link is opened: unexpected PowerShell execution, persistence attempts, or strange external connections are now the real warning signs. If your phishing email detection strategy stops at scanning the inbox, it is blind to where AI‑enabled threats now operate—on the endpoint, post‑click.
Defending against AI‑driven phishing: practical steps now
The answer is not to ban AI, but to assume attackers already use it better than you and then raise your defenses accordingly. Organizations should impose stricter controls over any software entering development systems and clearly separate trusted sources from unverified ones, especially when dealing with AI‑related tools and open‑source packages. Blindly installing “AI assistants” or pulling random libraries is now an operational risk, not a harmless experiment. Security teams should also integrate behavior‑based monitoring: in addition to using indicators of compromise, they need to track the sequence of anomalous activities following LNK execution, including PowerShell runs, persistence attempts, and external communications.
At the same time, defenders should accept that AI is a defensive tool, too. One security vendor is incorporating AI into its Endpoint Detection and Response and Extended Detection and Response products to improve threat detection and response. For enterprises, that means prioritizing platforms that can detect subtle behavioral patterns rather than plain keyword‑based phishing filters. For individuals, the rule is simpler but harsher: treat AI‑branded apps, links, and offers with the same suspicion you would give a strange banking email. If it promises powerful AI with minimal friction, assume someone on the other side is counting on your curiosity.
