Artificially Intelligent Scammers Flood Inboxes with Personalized Phishing Emails
A recent wave of highly targeted phishing emails has left security experts sounding alarms about the escalating threat posed by AI-assisted cyber attacks. In a staggering display of automation, an unidentified threat actor sent over one million personalized emails to unsuspecting victims in just three days, exploiting vulnerabilities that would have been impossible to breach manually.
These emails, which were expertly crafted with convincing details and branding, targeted account payable departments at various companies across industries such as IT, consumer goods, and real estate. What sets this campaign apart from others is its sheer scale: the threat actor was able to personalize each email to specific employees, incorporating their names and positions in a way that would have required an enormous amount of manual effort just a few years ago.
The emails themselves were designed to mimic legitimate invoices from ServiceNow, a cloud services company. They included detailed line items and dollar amounts that appeared genuine, and even featured forged email “threads” between executives at the victim’s company and the president of ServiceNow. The attackers went as far as identifying CEOs, CFOs, and presidents at target organizations and incorporating their names into the emails’ signatures – a task that would be a simple one for an AI-powered chatbot.
The use of AI in this campaign has raised serious concerns about the ease with which cybercriminals can now perpetrate mass phishing attacks. Merium Khalid, director of AI and automation at Barracuda Networks, notes that gathering information about a victim organization can now take mere minutes, thanks to AI’s ability to rapidly process publicly available data on the internet. This means that attackers can build multiple processes for different parts of their campaigns, including information gathering, content generation, and template creation.
Experts warn that this is not an isolated incident, but rather a sign of things to come. “AI makes attacks faster, cheaper, more personalized, and easier to scale,” says Joshua Bartolomie, vice president at Doppel. While new AI-native threats like adversarial agents and prompt injection are emerging, phishing, impersonation, and fraud have already proven to be highly effective tactics that can now be amplified by AI.
So what does this mean for the average user? It’s essential to remain vigilant when dealing with emails, even those that appear to come from legitimate sources. Before clicking on any links or downloading attachments, verify the authenticity of the message and the sender. Don’t fall prey to the assumption that an email is genuine simply because it includes your name or title – attackers can easily obtain this information through public records. By staying informed and taking a critical approach to digital communication, you can stay one step ahead of these AI-assisted scammers.
Source: Dark Reading — 2026-09-11