AI-Generated Phishing: The New Detection Signals When Grammar Is No Longer a Tell

Understanding what no longer works is as important as understanding what does. Security teams still training employees on the old signals are producing false confidence, not protection.

Old tells that no longer reliably work:

• Spelling and grammar errors, AI generates grammatically flawless text in any language
• Generic salutations such as 'Dear Customer' or 'Dear User', AI personalizes using LinkedIn, company directories, and breach data
• Suspicious sender domain variations, still present but AI-assisted campaigns increasingly use compromised legitimate accounts
• Mismatched URLs on hover, AI-generated phish more frequently use legitimate redirect services that pass inspection
• Unusual formatting or broken HTML, AI produces clean emails that match the impersonated brand's templates

New tells that actually distinguish AI phishing in 2026:

Process timing exploitation. The email references a specific action the recipient recently performed, a purchase, a password reset, a meeting booking, in a way that creates plausible urgency. Attackers scrape breach data and calendar tools to time sends around real events.

Verification channel bypass. The request explicitly discourages your organization's standard verification process. Phrases like 'due to system issues, please do not use the internal ticketing system' or 'urgent matter, please respond directly' are red flags regardless of email quality.

Contextual specificity without a plausible source. The email references internal project names, systems, or personnel that are not public but appear in leaked documents or data. Demonstrated internal knowledge through an external channel is a red flag independent of how legitimate the email looks.

Urgency on financial or access workflows. AI phishing campaigns disproportionately target wire transfers, vendor payment updates, MFA provisioning requests, and credential resets. Urgency on these specific workflows should trigger mandatory manual verification.

Perfect formality in informal channels. AI-generated text is often too grammatically formal for internal communications. Real inter-colleague email uses abbreviations and informal language. An unsolicited internal email that reads like a business document from an unknown sender warrants a second look.

WormGPT, GhostGPT, and FraudGPT are uncensored language models sold as subscription services on criminal forums and Telegram channels. Unlike commercial LLMs, they have no content policies blocking requests for phishing content, malware code, or impersonation scripts.

WormGPT, the most documented example, was built on the open-source GPT-J-6B model and offered unlimited phishing email generation, business email compromise (BEC) script writing, and malware code generation for approximately $60 per month. The service was shut down by its operator in 2023 but successor products continue under different names at similar price points.

The typical AI phishing workflow: the attacker provides the toolkit with a target name and company, a LinkedIn profile URL, and optionally the text of a real email from the company obtained from breach data or a previous compromise. The toolkit generates a contextually accurate spear-phishing email, a convincing spoofed login page, and in some cases a full BEC script designed for multi-turn social engineering.

The defender implication: the personalization quality of a phishing email is no longer an indicator of a sophisticated actor. A $60 per month subscription makes nation-state-grade personalization available to any attacker. Technical controls, not awareness training alone, are the required defense layer.

Standard spam filters score email content for known phishing patterns. AI-generated phishing produces content with no known patterns, which is why 82% passes delivery. The technical controls that work in 2026 focus on authentication, behavioral baselines, and process anomalies rather than content scoring.

DMARC enforcement at p=reject. DMARC prevents domain spoofing by verifying that the sending mail server is authorized to send on behalf of the claimed domain. Set your DMARC policy to p=reject, not p=none or p=quarantine, and monitor your DMARC aggregate reporting data weekly. Check your domain's current status at dmarcian.com or mxtoolbox.com/dmarc.aspx.

DKIM and SPF hard fail. Configure SPF with -all (hard fail) rather than ~all (soft fail). Ensure DKIM signing is active for all outbound email including transactional tools. These three together close the domain spoofing attack surface but do not address attacks using legitimately registered lookalike domains.

Executive impersonation protection. Configure your email security platform to alert on emails from external senders that match the display name of any executive or board member, a separate signal from authentication checks. Microsoft Defender for Office 365 has this as 'impersonation protection' under anti-phishing policies. Proofpoint and Mimecast have equivalent features.

Click-time URL sandboxing for all inbound links. Rewrite all URLs in inbound email through a sandboxing proxy that checks them at click time, not at delivery time. AI phishing campaigns increasingly use URLs that are clean at delivery and redirect to malicious content afterward. Defender for Office 365 Safe Links and Proofpoint TAP both support click-time sandbox analysis natively.

LLM-detection scoring as an additional signal. Several email security vendors including Abnormal Security and Darktrace now score incoming emails for AI authorship likelihood as one signal in their detection stack. This is not a standalone control, AI detection rates vary, but it adds a probabilistic signal that increases detection precision when combined with behavioral analysis.

Remove 'look for spelling errors' from your phishing awareness content. It creates false confidence in recipients who see a polished email and assume it is safe. Replace it with the five behavioral tells below.

1. Urgency on financial or access workflows. Any unsolicited email requesting a wire transfer, vendor payment update, password reset, MFA enrollment, or access credential change with urgency language is a verification trigger, regardless of how legitimate the email appears. The rule: call the requester using a phone number from your internal directory. Never reply to the email to verify an email.

2. Requests to bypass your normal process. 'Please do not use the ticketing system for this, just email me directly' is a BEC red flag. Legitimate internal requests follow established processes. Instructions to deviate from process are a manipulation signal.

3. Sender-context mismatches. An email demonstrating unusual knowledge of internal context, project names, system names, personnel, from an external domain is anomalous. Legitimate vendors do not typically know your internal project names.

4. Perfect grammar in informal contexts. An email from a colleague's address that reads like a formal business document is worth a verification call. People do not write to teammates the way AI writes.

5. Artificial deadlines under 2 hours. Time pressure of 'respond within 2 hours or the account will be locked' exploits cognitive urgency. Legitimate business processes do not require 2-hour responses to unsolicited emails. Time pressure is a manipulation tactic, take the time to verify through a separate channel.

The most reliable defense against AI phishing is a verification protocol that requires a human channel AI cannot easily replicate at scale. AI generates a perfect email. It cannot impersonate a specific person's voice on a phone call in real time without significant additional infrastructure.

Callback verification for financial requests. Any wire transfer, vendor payment detail change, or unusual financial request above a defined threshold requires a callback to a phone number from your internal directory or a previously verified vendor contact list, never to a number provided in the request itself. This one control stops the majority of BEC financial fraud.

Out-of-band MFA provisioning. Any request to enroll a new MFA device, reset a hardware token, or bypass MFA 'due to technical issues' requires in-person or video verification with IT. MFA provisioning requests are the most common AI phishing target for account takeover.

Shared codeword for high-privilege requests. For organizations where executive impersonation is a confirmed risk, establish a shared verbal codeword between executives and their assistants or finance team for confirming unusual requests outside normal channels. Low-tech and effective, AI cannot replicate a shared secret it does not know.