AI Phishing in 2026: What's Changed, and What’s Next in 2027

Key takeaways

• In early 2025, AI-supported campaigns already made up more than 80% of observed social engineering activity worldwide, according to ENISA.
• AI phishing attacks in 2026 are faster, more personalized, and harder to distinguish from genuine messages.
• Predictions suggest that by 2027, AI agents will run entire campaigns, with deepfake phishing techniques becoming more embedded in everyday fraud.
• Spotting typos and obvious hooks no longer works. Instead, we need to verify sender identity, gather threat intelligence, and respond quickly.

What is AI phishing?

AI phishing is a form of cyberattack that uses generative AI to research targets and impersonate trusted people or organizations across email, chat, voice, and video.

Here's what a 'typical' AI phishing attack looks like in practice:

Mel, a finance manager, receives an email from her CEO, Simon, asking her to authorize an urgent payment to a new vendor before EOD. She hesitates because the amount is larger than usual, but a minute later her phone rings: it's Simon. His voice is warm and friendly, if not a little rushed.

"Mel, did you get my email? Yes, push that through; it's time-sensitive."

She has no reason to doubt it's him, so she approves the payment. But the email was AI-generated to match the tone of Simon’s LinkedIn posts, the call was a cloned voice based on Simon’s appearance on a business podcast last week, and the account for the ‘new vendor’ actually belonged to the attacker. Mel transfers the payment – and the money is gone before anyone realizes the real Simon never sent the original email.

AI phishing removes all the classic warning signs of phishing, such as awkward grammar and generic greetings, and lets scammers personalize tailored attacks at scale.

How an AI phishing attack works:

1. Research: A scammer uses AI to scrape LinkedIn, company websites, press releases, and breach data. In one Harvard-led study, an automated tool built accurate target profiles in 88% of cases.
2. Generate: Language models write fluent, on-brand messages in any language, matching the tone and context of the desired communication.
3. Personalize: Each message names real colleagues, projects, or suppliers.
4. Send and adapt: Lures that underperform are rewritten and resent automatically, improving the performance of the attack over time.

Traditional phishing vs AI phishing

AI tools don’t make phishing smarter than a skilled human attacker; they just make it more convincing and much cheaper. Here’s how the two compare:

Traditional phishing

• Grammar: often full of errors.
• Personalisation: generic openers like “Dear customer.”
• Time to build: about 16 hours to write a targeted email by hand.
• Click rate: 12% for generic phishing emails in a Harvard-led study.
• Channels: mostly email.
• Variation: one template sent to everyone.
• Red flags: typos, unknown senders, odd domains.

AI phishing

• Grammar: essentially flawless, in any language.
• Personalisation: names real colleagues, projects and suppliers.
• Time to build: five minutes with ChatGPT in a 2023 IBM experiment.
• Click rate: 54% for fully AI-automated spear phishing, the same rate human experts achieved.
• Channels: email, Teams or Slack, SMS, voice and video.
• Variation: every message is different, tailored to each target.
• Red flags that still work: an unusual request, urgency, or pressure to switch channels.

AI phishing statistics

A selection of recent statistics illustrates the true scale of the threat of AI phishing in 2026:

• More than 80% of social engineering activity was reportedly AI-supported by early 2025, according to the ENISA Threat Landscape 2025.
• 22,364 complaints and about $893M in losses due to AI-related crime were reported to the FBI in 2025, according to the IC3 Internet Crime Report.
• Business email compromise losses reached $3.05B in 2025. That's up 10% from 2024 (FBI IC3 report). The same summary shows phishing losses rising from $70M to $215.8M.
• 62% of breaches involve a human element. Phishing was the initial access vector in 16% of breaches, and social engineering in 6% (Verizon 2026 DBIR).
• 73% of leaders surveyed were either affected by cyber-enabled fraud in 2025, or knew someone who was. CEOs now rank fraud and phishing above ransomware as their top concern, and 87% reported rising AI-related vulnerabilities (WEF Global Cybersecurity Outlook 2026).
• 43%: share of UK businesses that identified a breach or attack in the past 12 months (UK Cyber Security Breaches Survey 2025/26).

What's actually changed in 2026?

Phishing used to be a numbers game you could train people to win. In 2026, AI has made it faster, more personal, and nearly indistinguishable from a real person. The giveaway is no longer bad grammar; it's the context of the request – that's exactly what makes it so hard to spot.

Change #1: Faster

Attack prep drops from hours to minutes

• Research, writing, translation, and sending now run as one automated pipeline.
• Lures tied to the news, a holiday, or a vendor's breach can go live within hours.

Polymorphic campaigns

• Each recipient gets a different subject line, body, and sender name, so filters find no repeated pattern to match.
• Variants that underperform are rewritten mid-campaign.

Callback phishing

• The email contains no link and no attachment, only a phone number. The attack continues on the call.
• Voice and text are the weak spots. In Verizon's phishing simulations, the median success rate for mobile-centric vectors was 40% higher than for email (Verizon 2026 DBIR).
• Microsoft described one attack that combined email bombing, voice phishing, and Teams impersonation to pose as IT support and gain remote access.

Change #2: More personalized

AI spear phishing at scale

• Profiles are built from public data: role, manager, current projects, suppliers and invoice cycles.
• Spear phishing used to be reserved for executives because it was slow and expensive. Harvard researchers found that automating the whole process cut the cost of phishing by more than 95% while matching or beating human success rates. It is now cheap enough to aim at every employee.

Native-sounding lures in any language

• AI-generated phishing emails now arrive in fluent French, German, Spanish, or dozens of other languages – including correct use of regional idioms.
• Writing in a less common language no longer gives a company any protection.

Lures that look like routine work

• The main 2026 themes were fake offers, impersonated financial services, invoices, and HR notices.
• The giveaway is now the context of the request, not the grammar.

Change #3: Harder to tell fake from real

Deepfake phishing on video calls

• A face and voice can be cloned from public footage, then impersonated live on a video call.
• Seeing a colleague on screen is no longer proof that the colleague is real.

Voice cloning and vishing

• A cloned voice of a manager calls to "confirm" the request made in an earlier email. Our guide to AI vishing covers how these calls work.

Multi-channel attacks

• An email followed by a matching Teams or Slack message makes the request feel verified.

QR codes and trusted infrastructure

• QR codes move the attack onto personal phones, outside company controls.
• Compromised real accounts and legitimate cloud services pass authentication checks.

Real-world cases and warnings

Here are some real-world cases of AI phishing in practice:

• The fake CEO: In February 2026, Paolo Molesini, then chairman of Fideuram, Intesa Sanpaolo’s private banking arm, received a WhatsApp message that appeared to come from Intesa CEO Carlo Messina. A phone call followed using an AI-cloned voice of a senior lawyer. About €95M was transferred, mostly to accounts in China and Hong Kong. Roughly €53M was later recovered, according to sources cited by Reuters.
• INTERPOL’s warnings: In March 2026, INTERPOL’s Global Financial Fraud Threat Assessment warned that AI and cheap digital tools have brought about “the industrialization of fraud.” On 19 October, it launched a public campaign on deepfake scams (“Wait. Validate. Don’t take the bait.”) and urged businesses to use multi-step verification for financial transfers.
• QR-code spear phishing: In January 2026, an FBI FLASH alert described the North Korean group Kimsuky using QR codes in spear phishing against think tanks, universities, and government entities. The FBI did not attribute these campaigns to AI, but they show how QR codes slip past URL inspection and sandboxing.
• Phishing-as-a-service goes AI: EvilTokens, an AI-augmented phishing-as-a-service platform, automates business email compromise. According to incident reports collected by the OECD AI Incidents Monitor, it has let criminals compromise hundreds of Microsoft accounts a day since early 2026.
• The case that proved deepfake phishing works: In 2024, an employee at Arup's Hong Kong office joined a video call where every other participant was a deepfake. They made 15 transfers totaling about $25.6M (CNN).

AI phishing predictions for 2027

So, that’s an overview of AI phishing in 2026 – but what could this threat look like in 2027 and beyond, and what should we do about it?

Agentic phishing campaigns

• AI agents will research, send, reply, and escalate with no human operator.
• Gartner predicts AI agents will halve the time needed to exploit account exposures by 2027.
• Autonomous campaigns already work. In November 2025, Anthropic reported that attackers used AI for an estimated 80% to 90% of the tactical work in an espionage campaign against about 30 organizations. That was hacking, not phishing, and the AI's errors limited its success, but the playbook transfers.
• Hidden instructions in emails will also target the copilots that summarize inboxes and act on them.

Conversational phishing & thread hijacking

• Attackers will answer "Is this really you?" convincingly. Phishing becomes a back-and-forth thread, not a single email.
• Compromised accounts will reply inside genuine email threads, borrowing trust that has already been built up.

Real-time deepfakes in everyday fraud

• Live impersonation will spread from multimillion-dollar heists to routine supplier payments and payroll changes.
• Deloitte estimates generative AI could push US fraud losses to $40B by 2027, up from $12.3B in 2023, or 32% growth a year. That figure covers all AI-enabled fraud, not phishing alone.
• Gartner expects the targets to widen: by 2028, 40% of social engineering attacks will aim at the wider workforce as well as executives.

Regulatory pressure

• NIS2 and DORA push organizations to show they can detect and respond to specific threats, not only that they have trained staff on general awareness topics.

Speaking of NIS2, have you seen our free guide to NIS2 compliance?

How to spot AI phishing, and what to do if someone clicks

Warning signs:

• An unexpected request involving money, credentials, data, or access.
• Urgency or secrecy ("keep this between us").
• Pressure to switch channels, such as "call this number" or "move to WhatsApp".
• Changed bank details or a new payment process.

Training should teach these signals rather than typo-spotting. Phishing simulations that mirror AI-era lures, including voice and QR codes, are the practical way to build that habit.

If someone clicks:

• Report it immediately, with no blame.
• Reset the password, revoke active sessions, and check MFA and mailbox forwarding rules.
• Remove the same email from every inbox.
• Pause any payment and confirm it on a phone number you already know.

How defense has to change

Filters built to catch bad grammar, known senders, and repeated templates were designed for a different kind of attack. Defending against AI phishing means shifting five habits:

• Judge what an email is asking for, not only where it came from.
• Verify identity on a separate channel by default.
• Respond at machine speed by removing a threat from every inbox at once.
• Warn people in the moment, inside the email itself.
• Keep warnings rare enough that people still take them seriously.

Where Slash fits in

Slash is an AI-powered email threat detection and response tool that puts these security habits into practice and helps keep AI phishing attacks at bay.

Here's how:

• It works alongside Google Workspace and Microsoft 365 filters and catches the AI-written attacks they might miss.
• Semantic analysis reads the intent behind well-written, personalized emails.
• Albert (Riot's AI-powered cybersecurity coach) checks suspected impersonation with the real sender over Slack, Teams, or Google Chat.
• A confirmed threat is removed from every mailbox in one action.

For a closer look at the approach, read our Slash email security overview. And to find out more about how Slash can help you and your team, chat to one of our experts today.

FAQ

1. What is AI phishing? Phishing that uses generative AI to research targets, write messages, and impersonate people at scale.
2. Is AI phishing more effective? Compared with generic phishing, yes: AI-automated spear phishing earned about 54% clicks against 12%. Compared with skilled human spear phishers, click rates are similar, but AI is far cheaper and faster.
3. Can employees still spot it? Not from the language alone. The request itself, urgency, and channel switching are the signals.
4. How do you verify a deepfake call? Hang up and call back on a known number, or confirm on another channel. Agree on strict processes for approving payments.
5. What if an employee clicks? Report it, reset the password, revoke sessions, and remove the email from all inboxes.
6. What's the biggest threat in 2027? Forecasts point to agentic, conversational campaigns combined with real-time deepfakes.