Phishing has long been a primary source for security breaches — a major issue that, despite years of security awareness training, remains a top cybersecurity concern today.
But thanks to refinements of tactics alongside malign repurposing of AI technologies, the longstanding social engineering technique continues to evolve, and cybercriminals are finding new ways to try to trick users into clicking on bad links. The game’s (essentially) the same; it just got more fierce.
Attackers no longer just copy logos and spoof domains; they hijack legitimate email threads, embed malicious links in ongoing conversations, and even use compromised business emails to make their phishing attempts look more authentic.
AI technologies enable phishing campaigns to be deployed more quickly and easily than ever before, while facilitating perfect spelling and grammar along with a range of manipulation tactics, such as implied urgency or exploiting information already shared online to increase relevance.
CSO polled experts to pick out key tactical changes cybercriminals are employing to evolve their phishing techniques — and how these techniques help make phishing more targeted and effective. CISOs and cyber teams would be wise to incorporate this knowledge, and test scenarios where possible, in their training programs.
They’re getting clever with generative AI
Attackers are increasingly using generative AI to mimic writing styles, avoid traditional phishing red flags, and even personalize fraudulent emails based on publicly available data.
“Gen AI is now being used to write more ‘compelling’ and lucrative phishing emails,” says Kevin Curran, IEEE senior member and professor of cybersecurity at the UK’s Ulster University. “With one of its key features being the ability to generate responses in real-time based on a user’s input, it is now being deployed in scam situations where people are tricked into thinking they are communicating with an actual person.”
For example, WormGPT has the power of a large language model (LLM) behind it, enabling emails to be sent without the mistakes so long associated with phishing scams.
GhostGPT — another cybercrime-orientated AI chatbot — has been used to create polished spearphishing emails, including fake DocuSign requests, with near-perfect mimicry of legitimate brand communications.
Recently, LLMs have also been used to auto-generate fake landing pages.
“Generative AI is most frequently used to quickly generate thousands of unique, native-language lures,” says Allan Liska, a threat intelligence analyst at Recorded Future. “In this way, the sophisticated tech is exploited to create huge volumes of scam emails that seem legitimate, because the language appears more authentic and less suspicious.”
Liska adds: “It can make phishing emails harder to detect and CSOs may want to look at educating employees and building resilience by safely simulating these types of attacks.”
They’re luring with voice and video
Bad actors are also exploiting AI’s ability to clone voices and likenesses from audio and video clips or images found online.
Combined with tools that mimic caller ID, cybercriminals can fool targets by calling them and purporting to be a family member, friend, or work colleague seeking urgent assistance. Such calls can convincingly impersonate a trusted person’s voice and mannerisms.
“These technologies are already being widely used by attackers — coupled with cybercriminals becoming better educated and more comfortable with using AI, we can expect to see more innovative uses of AI to power cyberattacks in the near future,” says Niall McConachie, regional director for UK & Ireland at authentication vendor Yubico.
AI is also allowing cybercriminals to create increasingly sophisticated voice and video deepfakes that can facilitate phishing attempts. For example, the Hong Kong subsidiary of engineering firm Arup was defrauded of $25.6 million after a finance worker was tricked into transferring forms following a video conference call starring a deepfaked “chief finance officer.”
They’re resurrecting fake ‘threads’ and reply chains
“Zombie” email threads — chains resurrected by cybercriminals after hijacking a victim’s inbox — are nothing new, but they are likely to become increasingly believable with the support of generative AI.
“Previously, these types of emails would be more recognizable as the tone of voice or context would seem ‘off’ in comparison to an authentic email from the sender they’re imitating,” says Lucy Finlay, director of secure behaviour and analytics at security awareness firm ThinkCyber Security. “Gen AI would make it much easier to skim the previous chain and generate the phishing email using the right tone of voice, making it a much more believable lure.”
They’re running ClickFix attacks to dupe the PowerShell naive
ClickFix attacks involve send emails with links to malicious websites, which when visited, prompt the victim to open to the Run Dialogue box, and copy-paste in a line of SQL to execute on their machine, often under the guise of fixing the problem that the original email was based on.
“In the past six months, the new so-called ClickFix social engineering technique has been increasingly used by threat actors as part of their phishing campaigns,” says Hannah Baumgaertner, head of research at threat intel vendor Silobreaker.
The technique involves various lures to convince a user to paste a PowerShell script into the Run command, resulting in a malware infection. Malware observed being delivered using this technique includes Lumma Stealer, StealC, NetSupport, and others.
While the technique itself is relatively new, the lures themselves are quite commonplace, including phishing emails about invoices, documents to be signed, or fake CAPTCHAs.
They’re impersonating trusted brands more convincingly
Brand impersonation continues to be a favored method to trick users into opening a malicious file or entering their details on a phishing site. Threat actors typically impersonate major brands, including document sharing platforms such as Microsoft’s OneDrive and SharePoint, and, increasingly frequently, DocuSign.
Attackers exploit employees’ inherent trust in commonly used applications by spoofing their branding before tricking recipients into entering credentials or approving fraudulent document requests.
For example, email security firm Abnormal Security reports an ongoing phishing campaign that targets organizations that rely on federated authentication systems, using spoofed Microsoft Active Directory Federation Services (ADFS) login pages to harvest credentials and bypass multi-factor authentication.
“In this campaign, attackers exploit the trusted environment and familiar design of ADFS sign-in pages to trick users into submitting their credentials and second-factor authentication details,” says Piotr Wojtyla, head of threat intelligence at Abnormal Security. “The success of these attacks is driven by highly convincing phishing techniques, including spoofed sender addresses, legitimate branding, and URL obfuscation.”
Victims are often deceived into viewing, downloading, or signing fake documents, such as invoices, and are prompted to enter personal information, which is then stolen by the attackers.
Richard LaTulip, field CISO at Recorded Future, adds: “These types of attacks are evolving with more sophisticated domain impersonations, including lookalike domains and homoglyph attacks that evade traditional email filters.”
They’re abusing trusted services
Another significant phishing evolution involves abusing trusted services and content delivery platforms.
Attackers are increasingly using legitimate document-signing and file-hosting services to distribute phishing lures. They first upload malicious content to a reputable provider, then craft phishing emails or messages that reference these trusted services and content delivery platforms.
“Since these services host the attacker’s content, vigilant users who check URLs before clicking may still be misled, as the links appear to belong to legitimate and well-known platforms,” warns Greg Linares, principal threat intelligence analyst at managed detection and response vendor Huntress. “By leveraging these trusted providers, attackers ensure that victims unknowingly download malicious files while also bypassing allowlist and reputation-based security systems that would otherwise block their phishing attempts.”
They’re cuing up QR codes
An increasing number of cybercriminals are leveraging the popularity of QR codes to carry out QR code-based phishing attacks.
The rise of “quishing” (QR code phishing) is a direct response to improved email security. Attackers know that traditional phishing links get flagged by filters, so they’ve shifted to pushing malicious QR codes, as a way to bypass email security filters.
Attackers can embed malicious QR codes in emails and disguise them as multi-factor authentication (MFA) prompts, delivery notifications, or corporate login requests. These codes can often lead to credential-harvesting sites that closely mimic legitimate portals.
“With QR codes becoming more and more common for marketing, authentication, and business transactions, users are more likely to trust them,” says Abnormal Security’s Wojtyla. “We found that 17% of all attacks that bypass native spam filters now use QR codes, with credential phishing making up 89% of these cases.”
Richard Bullock, head of cybersecurity at managed services firm razorblue, adds, “We’ve also seen QR codes being used in ‘multi-stage phishing’, where the first scan directs users to what looks like a legitimate page, but after a delay — or after verifying a user’s device type — they get redirected to a credential-harvesting site. Since mobile devices often lack the same security oversight as corporate desktops, this method is proving highly effective.”
Chester Wisniewski, director and global field CISO at cybersecurity vendor Sophos, predicted that quishing may only be a temporary trend as security services get wise to the trick, potentially forcing cybercriminals to switch up their tactics.
“Many email services were not inspecting QR codes that were embedded in PDF or Office documents, but now that they are the efficacy of this method to bypass URI filtering should have diminished its effectiveness,” Wisniewski tells CSO. “We have also started seeing abuse of SVG [Scalable Vector Graphics] files, another oft-neglected format, so SVG could be the new QR if there is a shift.”
Attackers have also been seen using QR codes sneakily crafted in ASCII in phishing emails.
They’re leaning on images to bypass security filters
Image-based phishing is becoming more complex. For example, fraudsters are crafting images to look like a text-based emails to improve their apparent authenticity, while still bypassing conventional email filters.
Recorded Future’s LaTulip comments: “This type of attack is an evolution of the more traditional, text-based phishing and is the criminals’ response to advances in email security filters. Embedded images are used to bypass the email filters, with the image used to disguise malicious content or links.”
Following these images will lead unsuspecting employees to either credential-harvesting or exploit-loaded websites.
“Criminals may also continually edit and adapt images by changing colors or size,” LaTulip says. “This is often done to keep an image fresh, so that it increases its chances of avoiding detection.”
They’re using Russian fronts
KnowBe4 reports a surge in phishing campaigns leveraging Russian (.ru) top-level domains from December 2024 to January 2025.
The KnowBe4 Threat Research team noted a 98% rise in these phishing campaigns, which are primarily aimed at credential harvesting.
Some Russian .ru domains are run by so-called “bullet-proof” hosting providers, outfits known to keep malicious domains running and ignore abuse reports against sites run by their cybercriminal customers.
They’re supercharging intel gathering
On the dark web and hacker forums, AI-assisted toolsets have become increasingly common.
“These tools can scrape social media posts and even identify a user’s exact geolocation through images and posts — an increasingly prevalent tactic,” Huntress’ Linares says.
Other intelligence-gathering tools focus on organizations rather than individuals. These can scrape LinkedIn, recruitment sites, DNS records, web hosting services, and third-party service providers to uncover valuable insights about a company’s infrastructure, software stacks, internal tools, employees, office locations, and other potential targets for social engineering or cyberattacks.
Sophisticated attackers are also repurposing legitimate marketing tools and platforms to identify prime opportunities for SEO hijacking and phishing attacks, maximizing the reach and effectiveness of scams.
They’re professionalizing with PhaaS
Phishing-as-a-service (PhaaS) kits are expected to account for half (50%) of credential theft attacks in 2025, up from 30% in 2024, according to cybersecurity vendor Barracuda.
Barracuda predicts these platforms are evolving to include features that allow cybercriminals to steal multi-factor authentication (MFA) codes and employ more advanced evasion techniques, such as the use of QR-based payloads.
PhaaS platforms offer a subscription-based suite of tools and services, including dashboards and stolen credential storage, that facilitate phishing attacks. These cybercrime-enabling toolkits are sold through Telegram, dark web forums, and underground marketplaces. Subscriptions cost from $350 per month, according to cyber threat management firm Adarma.
The most widely-used such platform — Tycoon 2FA — blamed by Barracuda for 89% of observed PhaaS incidents harnesses encrypted scripts and invisible Unicode characters to evade detection, steal credentials, and exfiltrate data via Telegram.
Built for adversary-in-the-middle attacks, Sneaky 2FA abuses Microsoft 365’s ‘autograb’ feature to pre-populate fake login pages, filtering out non-targets and bypassing 2FA, as explained in a recent technical blog post by Barracuda.