Old-school phishing emails have become very familiar.
Bad grammar, fake bank warnings, odd attachments, and demands to act now or lose access to something important. For years, most security advice boiled down to teaching people how to spot those obvious red flags before doing something they would regret.
That version of phishing still exists in volume, but it now sits alongside scams that look far more convincing. Modern phishing attacks increasingly resemble normal business communication because they are built on the same tools, platforms, and workflows people already trust every day.
AI-generated content is accelerating this trend by enabling attackers to produce more convincing emails, cloned voices, fake video calls, and highly personalized scams at scale.
The result is a phishing industry that now stretches far beyond inboxes.
IBM’s 2026 Cost of a Data Breach Report found phishing was the most common initial attack vector among studied breaches, accounting for 15% of attacks, with an average breach cost of $4.9 million.
Workplaces operate in an environment laden with messages, from team chats to shared documents, and employees are expected to respond quickly across all of them. Attackers have adapted accordingly, building scams that blend far more naturally into the pace and appearance of ordinary working life.
Spear phishing and business email compromise
Classic email phishing still works well, particularly when attackers narrow their focus.
Spear phishing attacks, for example, have become far more tailored than the generic scams that used to clog inboxes.
Instead of sending identical messages to thousands of random users, attackers now spend time gathering information about specific employees, teams, suppliers, or executives before making contact.
A phishing email referencing a real invoice, an ongoing project, or an actual coworker is far more likely to slip past someone who is already busy and expects dozens of legitimate requests throughout the day.
Business email compromise (BEC) scams often follow the same pattern. Rather than relying on malware, attackers simply impersonate trusted contacts or take over genuine accounts for long enough to insert fake bank details or urgent payment requests into existing conversations without immediately attracting attention.
In many cases, there is no malware involved at all, just a message that is believable enough for someone to follow the instructions without questioning them.
Whaling takes the same approach further by targeting executives or senior decision makers directly. Rather than blasting thousands of generic emails, attackers focus on a handful of high-value targets where a single successful compromise could expose sensitive systems or authorize large financial transfers.
What are the different types of phishing attacks?
Phishing has also spread into places many users still do not associate with cybercrime.
Smishing attacks use text messages instead of emails and often impersonate delivery firms, banks, or government agencies. Fake package notifications, unpaid parking fines, and suspicious account warnings are all commonly used to pressure victims into clicking malicious links without a second thought.
QR-code scams, known as quishing, have also become more common in recent years. A malicious code printed on a fake parking notice, delivery slip, invoice, or office poster can send victims to credential-harvesting sites without ever showing a suspicious-looking URL first. By the time someone realizes where the link leads, they may already have entered passwords or payment details.
SEO poisoning is another variety of phishing that may use a fake login page for a bank, payroll platform, cloud service, or cryptocurrency exchange that only needs to look convincing for a few seconds to succeed. Users searching for familiar services can easily end up on cloned sites without immediately realizing they clicked the wrong result.
Clone phishing uses emails that feel familiar, like genuine-looking document notifications, invoices, password resets, and software alerts. They alter the links or attachments while leaving the rest largely intact.
During a busy workday, when people are skimming dozens of messages at speed, those changes can be easy to miss.
The rise of vishing and deepfake scams
Voice phishing, or vishing, has become far more convincing thanks to advances in AI-generated audio.
A few years ago, most phone scams still sounded exactly like phone scams. The caller would stumble through a script, mispronounce names, or deliver lines with all the emotional realism of a parking meter.
That is changing as cheap voice-generation tools become easier to access and increasingly believable, altering the psychology of the attack considerably.
An employee receiving a phone call from someone who sounds like their manager may be far less likely to stop and verify instructions, particularly if the request appears urgent or financially sensitive. Criminals have already used cloned voices to impersonate executives requesting payments and family members claiming to be injured or arrested.
Deepfake video scams create even stranger situations.
Early in 2024, fraudsters used AI-generated versions of senior executives during a video conference call to persuade an employee at engineering firm Arup to transfer roughly $25 million. Nobody hacked their way through a firewall or deployed malware. The employee believed they were sitting in an ordinary meeting with familiar company leadership.
Security teams spent years teaching employees not to trust suspicious emails. Very few organizations prepared workers for fake Zoom calls involving apparently recognizable executives or trusted colleagues.
The Cybersecurity and Infrastructure Security Agency (CISA) has warned that Scattered Spider actors use techniques including push bombing, SIM swapping, and help desk impersonation to obtain credentials or account access. The aim is to persuade the people around security technology to reset multi-factor authentication (MFA), approve a login, or treat the attacker as a legitimate employee locked out of an account.
In that sense, the reach of phishing has grown, and it has become a way of turning support processes, identity checks, and recovery workflows into attack paths.
MFA fatigue and authentication attacks
Attackers are adapting to the widespread adoption of MFA.
Fatigue attacks bombard users with repeated authentication prompts until someone eventually accepts one out of frustration, confusion, or distraction. Other phishing kits perform authentication token interception in real time, allowing attackers to bypass certain MFA protections while maintaining the appearance of legitimate logins.
For many attackers, getting hold of legitimate logins is now more useful than dropping malware onto a device. A stolen password or active session can open the door to email accounts, collaboration tools, cloud platforms, and internal systems without creating the sort of obvious disruption normally associated with malicious software.
Once inside, attackers can often move around quietly because the activity looks much like ordinary day-to-day work. That makes phishing particularly difficult to defend against because the attack often appears to be normal user activity after the initial compromise.
Why phishing still works
Despite years of awareness training and expensive security tooling, phishing remains effective because it targets people rather than software vulnerabilities. Most organizations have become reasonably good at blocking known malware, filtering suspicious attachments, and detecting unusual network activity. But humans are much harder to secure consistently.
Many successful phishing attacks do not rely on technical exploits at all. They succeed because someone is tired, distracted, multitasking, or under pressure to respond quickly.
AI-generated content simply makes the deception more convincing and easier to scale. More organizations are responding by tightening how access works across their networks and internal systems. Security teams are placing greater emphasis on additional verification for sensitive actions, limiting how much access individual accounts receive, and watching more closely for unusual behavior after login.
The thinking behind those measures is straightforward: Phishing attacks are becoming difficult to distinguish from ordinary communication, so companies are assuming that some scams will eventually work.
An attempt no longer needs to look obviously fake to succeed. In many cases, the scams only need to look normal long enough for someone to trust them.
How ThreatLocker helps you plan for the click
Modern phishing does not announce itself. A user may approve a login, follow a convincing link, hand over credentials, or trust a fake support request. At that point, an attacker may have several paths to continue the compromise.
ThreatLocker helps organizations reduce the blast radius of successful phishing by enforcing a Zero Trust deny-by-default approach across endpoints and access.
- Zero Trust Cloud Access helps neutralize phishing and token theft, ensuring that access can only happen from an approved, cataloged device.
- Zero Trust Network Access protects within the perimeter, with robust policy management capabilities that ensure users and devices can access only what they genuinely need.
- Allowlisting stops untrusted executables, scripts, and tools from running, even if a user has been fooled into downloading them.
- Ringfencing™ limits what approved applications are allowed to access, helping prevent trusted tools from being abused.
Phishing is designed to exploit trust. ThreatLocker capabilities are built under the assumption that trust has already been exploited. Nothing should run or connect unless it has been explicitly allowed.
Even if a phishing attempt is successful, an attacker must not find anything of value at the end of the line.
FAQs
How is AI changing phishing attacks?
AI allows attackers to create convincing messages and impersonations faster and at greater scale. It reduces traditional warning signs such as poor grammar while helping attackers personalize scams using information about employees, executives, vendors, or ongoing business activity.
What are the most common types of phishing attacks?
Phishing can occur through email, text messages, phone calls, QR codes, fake websites, and video calls. Common types include:
- Spear phishing: A targeted phishing attack tailored to a specific person or organization
- Business email compromise: Impersonating or compromising a trusted business account
- Smishing: Phishing conducted through texting or SMS
- Quishing: Using malicious QR codes to direct victims to fake websites
- Vishing: Phishing conducted through phone calls or voice messages
- Clone phishing: Copying a legitimate message and replacing links or attachments with fake ones
- Whaling: Spear phishing that specifically targets executives and high-value individuals
Can phishing bypass MFA?
Yes. Some phishing techniques target the authentication process itself. MFA fatigue attacks attempt to convince users to approve fraudulent login requests, while adversary-in-the-middle techniques can intercept authentication tokens associated with some MFA implementations.
How do Zero Trust controls help mitigate phishing attacks?
Zero Trust relies on a default-deny approach which blocks unknown software from running, prevents abuse of trusted software software, blocks unknown devices, and relies on continuous verification instead of implicit trust. These controls greatly decrease the effectiveness of a successful phishing attack.
