AI-powered phishing is slipping past email filters. Here's how to catch it after the click.
Email gateways can't spot every AI-written lure. The catch now happens at the identity and endpoint layer.
Key points
- AI writing tools are helping criminals produce phishing emails, fake messages designed to trick staff into handing over passwords, that read as cleanly as a real colleague's note.
- Traditional email filters, the software that scans inboxes for spam and scams, miss more of these because the usual giveaways (bad grammar, clumsy phrasing) are gone.
- Managed service providers (MSPs), the outside IT firms that run technology for small and mid-sized companies, are being pushed to watch identity and endpoint activity, not just the inbox.
- Signs of a successful phishing attack often show up as odd sign-ins, new inbox rules, or unusual file access minutes to hours after the click.
- Multi-factor authentication (MFA), a second check on top of a password, still blocks most of these takeovers when it's switched on and phishing-resistant.
Phishing used to be easy to laugh at. The typos, the Nigerian prince, the email from "Micosoft Support" asking you to log in via a link that clearly went somewhere hostile. That era's closing. Generative AI has handed criminals a competent copywriter and a tireless researcher for the price of a chatbot subscription. The result is a phishing email that sounds like your CFO on a Tuesday morning, because the attacker fed the model three of her real LinkedIn posts before pressing send.
Email filters are struggling. As BleepingComputer reported, the response from the managed service provider world is to stop treating the inbox as the last line of defence. Our 10 August story on device trust replacing old login signals reached the same conclusion from the credential-theft angle.
Why are AI phishing emails harder to block?
Because the tells are gone. Older filters looked for broken English and known-bad templates. An AI-written lure has neither, and it can be personalised per recipient in seconds.
Attackers now scrape a target's public profile, feed it into a model, and generate an email that references the right project and the right tone. The link inside still leads to a fake login page. The wrapper around it looks entirely normal.
Some campaigns skip the link altogether. They ask the recipient to reply and start a conversation, steering them toward a malicious document or a phone call only later. Filters that grade a single message in isolation have very little to work with.
What should MSPs and IT teams watch instead?
Identity and endpoint signals. Once a filter misses a phish, the next chance to catch it is the moment the stolen password gets used, or the moment the attacker starts poking around inside the account.
The useful signals cluster into a few areas:
| Layer | What to watch for | Why it matters |
|---|---|---|
| Identity | Sign-ins from new countries, impossible travel, MFA fatigue prompts | First sign a password has been stolen |
| New inbox rules that auto-delete or forward messages | Classic attacker move to hide replies from the real user | |
| Endpoint | Unusual PowerShell, new browser extensions, token-stealing malware | Where a click turns into a full takeover |
| Cloud apps | OAuth consent to unfamiliar third-party apps | Grants long-lived access without needing the password again |
None of this is exotic. Microsoft Entra ID, Google Workspace, and most endpoint tools already emit these logs. The gap is usually that nobody's reading them at 2am on a Saturday. Worth keeping in mind: our 19 August report found attackers targeting old sign-in methods that bypass MFA entirely, so the logging gap and the authentication gap tend to show up together.
Would MFA have helped?
Mostly, yes, but not the cheap kind. SMS codes and app push notifications can be phished in real time using attacker-in-the-middle kits that relay the code as the victim types it. Phishing-resistant MFA, meaning passkeys or hardware security keys built on the FIDO2 standard, blocks that trick because the credential is bound to the real website's address.
For small businesses that can't roll out hardware keys tomorrow, number-matching push and conditional access rules (which block sign-ins from unexpected locations or devices) close most of the gap.
What ordinary staff can do
Slow down on anything that creates urgency, especially around payments or password resets. Verify unusual requests through a second channel before acting: a phone call, a walk to someone's desk. If you clicked something and only realised after, tell IT immediately. The first hour is when containment's cheap.
