AI-Written Lures

For twenty years, email security worked on a simple assumption, if a thousand people received the same malicious email, you only needed to catch it once, because the second copy looked exactly like the first.

AI has quietly broken that assumption, and most organizations have not adjusted.

Now an attacker can generate a thousand emails that share one purpose and share nothing else, different subject lines, different sentence structures, different tone, different length, different vocabulary, different emotional hooks, and different pretexts tailored to each individual recipient, and when no two lures look alike, there is nothing to fingerprint, nothing to cluster, and nothing to add to a blocklist.

That is the shift, and it changes what detection has to do.

Important Disclaimer

This article is intended for educational and defensive purposes only. The techniques described here are shared to help security professionals and email administrators understand how modern phishing campaigns operate so they can better protect their organizations.

Do not use these techniques against systems you do not own or do not have explicit written permission to test. Unauthorized testing is illegal in most jurisdictions.

The author assumes no liability for any damages, legal consequences, or other outcomes resulting from the use or misuse of this information. Always obtain proper authorization before conducting any testing, and stay legal, stay ethical, stay responsible.

Why Uniqueness Is the Whole Attack

Traditional phishing detection relies on repetition.

A campaign sends the same lure to ten thousand inboxes, a filter notices the identical subject line, the identical body, the identical link, and it blocks the pattern everywhere, reputation systems learn the sender, the domain, and the payload, and the campaign dies quickly.

Every one of those defenses depends on sameness.

AI removes sameness. It removes it at the text level, where every email is written from scratch, and it removes it at the intent level, where every email is shaped around a specific person and a specific reason they might click.

The result is a campaign that behaves like a thousand separate attacks instead of one, and that is exactly what makes it so hard to stop.

What AI Actually Changes

It is worth being precise here, because AI is not magic, it is a set of very practical improvements to an old playbook.

It Removes the Tell

Older phishing had tells. Awkward grammar, strange phrasing, inconsistent capitalization, and sentences that read like they were translated twice.

Those tells trained a generation of users and filters, and AI removed them, because modern language models write fluent, natural prose in whatever tone you ask for.

It Personalizes at Scale

Personalization used to be expensive. A skilled operator could write twenty tailored emails a day, and a team could write a few hundred.

An AI system can write thousands, each one referencing the recipient's role, their department, their recent activity, and the projects they are known to work on, drawn from public sources like LinkedIn, conference talks, company blogs, and press releases.

It Varies Everything That Can Be Varied

Subject line, greeting, structure, length, call to action, urgency level, formality, and the specific ask, all of it changes per email, which means signature-based detection has nothing stable to match.

It Writes in the Right Language

AI handles localization natively, so an attacker can write flawless German, Japanese, or Portuguese without hiring a speaker of that language, which expands the addressable target pool enormously.

It Adapts to the Reply

Some campaigns now use AI to handle the back and forth, reading the victim's response and generating a reply that fits the conversation, which keeps the thread alive long enough to reach the actual goal.

The Techniques Behind the Lures

Several specific techniques show up in AI-assisted campaigns, and recognizing them helps defenders know what they are dealing with.

Contextual Pretexting

The email references something real. A conference the target attended, a paper they published, a project their team announced, a vendor their company actually uses.

The reference is accurate because it was pulled from public sources, and accuracy is what makes the email feel legitimate.

Thread Hijacking

The attacker gains access to a real mailbox, then replies to an existing thread, so the message arrives inside a conversation the recipient already trusts.

AI makes this more effective because it can read the thread history and match the writing style of the people involved, which means the reply does not feel out of place.

Tone Matching

Different targets respond to different tones. A finance team responds to authority and urgency. A research team responds to curiosity and collaboration. A support team responds to helpfulness.

AI writes in whatever tone the target is most likely to act on.

Multi-Turn Escalation

The first email asks for something small, a confirmation, a clarification, a file they already have. The second email escalates. The third asks for the payment or the credentials.

Because each message is individually innocent, no single email looks like an attack.

Channel Shifting

Once a conversation is established, the attacker moves it to SMS, WhatsApp, or a phone call, where enterprise email controls no longer apply.

AI-generated conversation makes the handoff feel natural, which is exactly why it works.

Why Traditional Filters Struggle

Understanding the failure modes helps explain why this is not just a tuning problem.

Reputation Has Nothing to Bite

If the sender is a compromised legitimate account, reputation is good. If the domain is newly registered but the email is otherwise perfect, reputation only catches one signal out of many.

Content Analysis Finds Nothing Suspicious

There is no malicious attachment, no obvious link to a suspicious domain, and no request for credentials in the first message. The content is clean, because the content is not the payload, the conversation is.

Clustering Requires Similarity

Machine learning models group emails by similarity. If every email is unique in text, structure, and phrasing, the clusters are tiny, and a cluster of one does not look like a campaign.

Link Analysis Is Delayed

The link in the first email often goes to a legitimate service, a document sharing platform, a calendar invite, or a file transfer page. The malicious part happens later, after trust is established, which means link analysis at delivery time sees a benign URL.

Volume Thresholds Miss Slow Campaigns

Many filters flag senders who send hundreds of messages quickly. A patient attacker can spread a campaign over weeks, staying under every threshold while still reaching every target.

Real Scenarios

Scenario 1: The Conference Follow-Up

The Setup

A security researcher speaks at a conference, their name, photo, employer, and talk title are all public, and they list their email address on the conference site.

The Attack

An email arrives two weeks later from someone claiming to be an attendee who enjoyed the talk. It references a specific point from the presentation, asks a plausible technical question, and includes a link to a document that supposedly expands on the topic.

The email is well written, the reference is accurate, and the tone is collegial, because it was generated from the talk abstract and the researcher's public writing style.

The Result

The researcher clicks the link, lands on a page that asks them to sign in with their work account to view the document, and enters their credentials.

The Lesson

Public information plus fluent writing is enough to build trust without any technical trick.

Scenario 2: The Vendor Payment Update

The Setup

A company has a long-running relationship with a supplier, invoices are exchanged monthly, and the finance team knows the routine.

The Attack

An email arrives that appears to be from the supplier's finance contact, it references a real invoice number, a real purchase order, and a real delivery date, and it asks to confirm updated bank details for the next payment.

The wording is slightly different from the supplier's usual style, but not in a way that raises suspicion, because AI matched the tone of previous correspondence.

The Result

The finance team updates the bank details, the next payment goes to an attacker-controlled account, and the real supplier notices an unpaid invoice weeks later.

The Lesson

AI makes business email compromise feel routine, and routine is what gets approved.

Scenario 3: Internal Handoff

The Setup

The attacker gains access to the mailbox of an employee within the company and reads the emails for a few weeks.

The Attack

The attacker replies to a real thread between the employee and a colleague in another department, using the employee's account. The reply asks the colleague to review a document before a meeting.

The document is hosted on a legitimate file sharing service, the link works, the document opens, and the content is plausible, but the document asks the reader to sign in with their corporate credentials to access a protected section.

The Result

The colleague signs in, the credentials are harvested, and the attacker now has access to a second account inside the same organization.

The Lesson

Thread hijacking plus AI-generated tone matching defeats the instinct that says "this looks like my colleague."

Scenario 4: The Slow Campaign

The Setup

An attacker targets a company's engineering leadership, a group of around forty people.

The Attack

Over six weeks, each leader receives one email, each one different, each one referencing something real about their team, their product, or their recent public work. No email looks like a campaign, because there is no campaign, there are forty separate conversations.

The Result

Three of the forty click, two enter credentials on a spoofed sign-in page, and one account is used to move further into the environment.

The Lesson

Patience and personalization beat volume thresholds, and AI makes patience cheap.

How to Defend Against AI-Written Lures

If the attack is defined by uniqueness, the defense has to stop depending on sameness.

1. Stop Trusting Content Alone

Content analysis still matters, but it cannot be the primary control when every email is unique. Shift weight toward identity, behavior, and context.

2. Verify Sender Identity Cryptographically

DMARC enforcement, SPF, and DKIM still matter, and they still stop spoofed domains, they just do not stop compromised accounts or lookalike domains that pass their own authentication. Combine them with lookalike domain detection.

3. Alert on Lookalike Domains

Most AI-assisted campaigns still need a domain that resembles something the target trusts. Detection of visually similar domains, including homoglyph substitutions and character swaps, catches a meaningful share of attempts.

4. Treat First-Time Senders Differently

Most phishing arrives from a sender the recipient has never corresponded with. Flag external first-contact emails, especially when they ask for action, and route them for additional scrutiny or user warning.

5. Detect Reply-to and Link Mismatches

AI emails often keep the visible sender legitimate while routing replies elsewhere. Compare the reply-to, the return path, and the displayed address, and flag mismatches.

6. Watch the Behavioral Signals

An account that suddenly sends different writing, different tone, different hours, or different links is a signal, even if every individual email is clean. Behavioral baselines on internal senders catch compromised accounts that content filters cannot.

7. Reduce the Value of a Click

Assume some users will click. Use phishing-resistant MFA so a stolen password is not enough, restrict what a compromised session can reach, and require step-up authentication for sensitive actions.

8. Verifying Becomes the Norm

Educate your users that verification is not being rude; it is normal behavior. Encourage callback verification for payment changes through a known number, and make it socially acceptable to say "let me confirm this before I act."

9. Train on Judgment, Not Signatures

Old training taught users to look for typos and strange grammar. That advice is now actively harmful because it creates false confidence. Train on context instead, is this expected, is this request unusual, does this person normally ask me for this, and can I verify it independently.

10. Use Positive Reinforcement

Report rates improve when users are thanked for reporting, even when the email turns out to be benign. Punishing false alarms teaches people to stay quiet.

11. Test With Realistic Lures

Simulations should use AI-quality writing, real public information, and plausible pretexts. If your simulations look like 2015 phishing, your metrics are measuring the wrong thing.

12. Layer Detection With Response

Detection will never be perfect against unique lures. Invest in fast containment, session revocation, and account recovery so that a successful click becomes a contained incident rather than a breach.

What Good Metrics Look Like

If every lure is unique, traditional metrics mislead you.

Quick Reference: AI Lure Defense Checklist

The Bottom Line

AI has taken the oldest weakness in email security and removed the only thing that made it manageable, the fact that phishing used to repeat itself.

When every email is unique, blocklists do not scale, clustering does not work, and reputation only catches the careless.

The defense is not better content analysis, it is a shift in what you trust. Verify identity, watch behavior, treat first contact with suspicion, make verification normal, and build for the assumption that some clicks will happen anyway.

The lures will keep getting better, the writing will keep getting cleaner, and the targeting will keep getting sharper. Your controls should not depend on the attacker being lazy.

FAQ Section

What is an AI-written phishing lure?

It is a phishing email generated by a language model, written specifically for one recipient, referencing real details about them, and sharing no stable text pattern with any other email in the same campaign.

Why does AI phishing bypass email filters?

Most filters rely on similarity, reputation, and known patterns. When every email is written from scratch, there is no cluster to detect, no signature to match, and often no malicious link in the first message.

Does DMARC stop AI phishing?

It stops domain spoofing, which is valuable, but it does not stop compromised legitimate accounts or lookalike domains that pass their own authentication.

How can users spot AI phishing?

Not by looking for typos, that advice is outdated. Users should judge context instead, is the request expected, is it unusual for this person, and can it be verified through a separate channel.

What is the single most effective control?

Phishing-resistant multi-factor authentication. It does not stop the email from arriving, but it dramatically reduces what a successful click is worth.

Should simulations use AI-quality lures?

Yes. If your test emails look like 2015 phishing, your click rate is measuring compliance with old habits rather than real susceptibility.