# AI-Generated Phishing and Deepfake Impersonation Campaigns: Fluent, Personalized Lures at Scale

> ZeroFox reports that generative AI now drives phishing target research, message generation, and supporting infrastructure (lookalike sites and spoofed domains that pass SPF/DKIM/DMARC), eliminating grammar errors as a detection signal and making personalized phishing economical at volume. The trend extends beyond email into SEO poisoning, fake job listings, spoofed social profiles, malicious ads, and voice/video deepfake executive impersonation, exemplified by the 2024 Arup case in which a Hong Kong finance employee wired roughly US$25.6 million after a multi-person deepfake video conference.

- **Published:** 2026-10-21T16:47:58Z
- **Last reviewed:** 2026-10-21T16:47:58Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4047
- **ID:** TL-2026-4047
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Overview. On 2026-10-21 ZeroFox (Maddie Bullock) published an analysis arguing that bad grammar is no longer a usable phishing red flag because generative AI has changed every stage of the phishing lifecycle. This is a landscape/trend threat rather than a single CVE or named campaign: no threat actor, malware family, or CVE is attributed in the primary article. ZeroFox identifies four shifts: (1) language is no longer a constraint, since LLMs produce fluent, context-appropriate text in many languages without localization labor; (2) iteration replaced translation, with campaigns refined by testing rather than by hiring native speakers; (3) personalization became economically viable, so hyper-targeted messages built from public profiles are now the default; and (4) volume and quality decoupled, allowing campaign scope and message quality to rise together.

Kill-chain changes. Targeting: AI scrapes public profiles to infer roles, tenure, and writing style at scale. Message generation: AI mimics internal communication styles closely enough that linguistic cues no longer reveal the lure. Infrastructure: AI-generated lookalike websites and spoofed domains go live quickly with functional layouts; ZeroFox observed an impersonation kit go from domain registration to live site in about twelve hours. Distribution: phishing-as-a-service (PhaaS) platforms sell subscriptions, separating kit builders from operators. ZeroFox also cites voice cloning and synthetic video being bundled into phishing kits as impersonation add-ons; a deepfake only has to be realistic enough to influence one decision.

Beyond email. Phishing now arrives through search results (AI-generated content used to build SEO authority for fraudulent pages), social media (spoofed profiles that start conversations before any link is sent), job boards (fake listings that harvest personal data during a fake application process), and ad platforms (malicious ads bidding on branded search terms). ZeroFox documented 170 verified Facebook accounts running more than 67,000 fraudulent investment ads in one European quarter.

Supporting statistics, as cited by ZeroFox and checked against primary sources where possible: KnowBe4's Phishing Threat Trends Report Vol. 5 (2025-03-20; data from 2024-09-15 to 2025-02-14) found 82.6% of phishing emails showed some use of AI and 76.4% of campaigns used polymorphic tactics. ZeroFox says 57.9% of phishing attacks originate from compromised accounts, but KnowBe4's press release describes this as a 57.9% INCREASE in attacks sent from compromised accounts that got past detection; defenders should cite the primary wording. KnowBe4 also reported that 64% of attacks targeted engineering roles, that the most-impersonated brands were Microsoft, DocuSign, Adobe, PayPal, and LinkedIn, and that the most-abused legitimate platforms were DocuSign, PayPal, Microsoft, Google Drive, and Salesforce. The Microsoft Digital Defense Report 2025 (reported 2025-10-16) found AI-automated phishing reached a 54% click-through rate against 12% for non-AI phishing (4.5x), could raise phishing profitability by up to 50x, and listed voice clones and deepfake video among criminal AI uses. Microsoft also noted email bombing increasingly used as a first stage ahead of vishing or Teams-based impersonation. Heiding, Lermen, Kao, Verdun, Schneier and Vishwanath (arXiv 2412.00586; Expert Systems with Applications, 2026) measured a 54% click-through rate for fully AI-automated spear phishing, the same as human experts, against 12% for controls; their tool built accurate target profiles 88% of the time. ZeroFox cites this work for a roughly 95% reduction in attacker cost. Other figures ZeroFox cites: SoSafe 2025 (87% of security professionals saw an AI-driven attack), Gartner 2025 (62% of organizations hit by a deepfake attack in the past year), and McAfee (77% of AI voice-clone victims lost money).

Deepfake executive impersonation: Arup. In early 2024 a finance employee in Arup's Hong Kong office received a message, apparently from the UK-based CFO, about a secret transaction. The employee first suspected phishing, then joined a multi-person video conference in which every other participant (the CFO and colleagues) was a deepfake. Reassured, the employee made 15 transfers totalling HK$200 million (about US$25.6 million) to five Hong Kong bank accounts, and only found the fraud after checking with headquarters. Hong Kong police disclosed the case in February 2024 and Arup confirmed it was the victim in May 2024. Arup global CIO Rob Greig said the number and sophistication of such attacks had been rising sharply.

Authenticated lookalike infrastructure (related ZeroFox research). ZeroFox's 2026-06-25 Signals research (Carlos Alvarez), linked from the primary article, documented 73 correlated domains registered between 2025-07-31 and 2026-06-12. The domains impersonate ZeroFox and peer vendors Corsearch/Incopro, Red Points, MarkScan, and Group-IB, plus generic takedown/DMCA/anti-piracy names. Every domain was built to pass SPF/DKIM/DMARC. Registration was mostly through Dynadot (60 of 73); every domain was hosted on Namecheap shared hosting (162.0.215.16, 68.65.120.149, 68.65.121.172, 68.65.123.243) with jellyfish.systems MX, the SPF record v=spf1 +a +mx +ip4:<host-ip> include:spf.web-hosting.com ~all, a default._domainkey DKIM selector, and DMARC p=none. The operation was email-only: fraudulent takedown notices sent to registrars and hosts, advance-fee account-reinstatement scams (for example zerofox-unlockmeta.com), malware-bearing DMCA or infringement emails aimed at brand and legal teams, and India-localized (.com.in/.co.in) recruiter-impersonation job fraud. Dynadot suspended 57 of the 60 domains reported to it. Separately, FINRA warned of a campaign that began 2026-01-22 in which fictitious FINRA employees emailed broker-dealers from finra.org.cazepost.com with the subject Document for Review followed by the member-firm name, aiming to deliver malware or steal logins. ZeroFox cites this as an example of credible emails using real names and professional context.

Defensive implications. ZeroFox recommends moving detection from message inspection to infrastructure validation: correlate kits, domains, and targeting with known campaigns; treat SPF/DKIM/DMARC passes as proof of domain control, not legitimate ownership; automatically block high-confidence infrastructure matches; watch lookalike-domain registrations before they are weaponized (the cheapest point to intervene); monitor executives' public exposure specifically; and retrain staff on out-of-band verification through an independent channel for payment changes and credential requests, instead of proofreading. BeaconBeagle lookups for the sourced hosting IPs and the seed domain returned no C2 beacon or config matches, which fits the email-only, non-implant nature of this activity.

## MITRE ATT&CK

- T1593.001 Social Media
- T1591.004 Identify Roles
- T1589.003 Employee Names
- T1598.003 Spearphishing Link
- T1588.007 Artificial Intelligence
- T1583.001 Domains
- T1583.008 Malvertising
- T1585.001 Social Media Accounts
- T1586.002 Email Accounts
- T1608.005 Link Target
- T1608.006 SEO Poisoning
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1566.004 Spearphishing Voice
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1534 Internal Spearphishing
- T1684.001 Impersonation
- T1657 Financial Theft

## Sources

- [AI Phishing Attacks: Why Bad Grammar Stopped Being a Red Flag (ZeroFox, Maddie Bullock)](https://www.zerofox.com/blog/ai-phishing-attacks-why-bad-grammar-stopped-being-a-red-flag)
- [Coordinated Impersonation of the Brand Protection Industry (ZeroFox Signals, Carlos Alvarez)](https://www.zerofox.com/blog/coordinated-impersonation-of-the-brand-protection-industry/)
- [New KnowBe4 Report Reveals a Spike in Ransomware Payloads and AI-Powered Polymorphic Phishing Campaigns](https://www.knowbe4.com/press/new-knowbe4-report-reveals-a-spike-in-ransomware-payloads-and-ai-powered-polymorphic-phishing-campaigns)
- [AI makes phishing 4.5x more effective, Microsoft says (Microsoft Digital Defense Report 2025)](https://www.theregister.com/2025/10/16/ai_makes_phishing_45x_more_effective)
- [FINRA Cybersecurity Alert - Ongoing Phishing Campaign Impersonating FINRA Employees](https://www.finra.org/rules-guidance/guidance/cybersecurity-alert-ongoing-phishing-campaign-20260123)
- [British engineering giant Arup revealed as $25 million deepfake scam victim (CNN)](https://edition.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk)
- [Arup deepfake fraud scam victim Hong Kong $25 million CFO (Fortune)](https://fortune.com/europe/2024/05/17/arup-deepfake-fraud-scam-victim-hong-kong-25-million-cfo)
- [AI Incident Database - Report 3622 (Hong Kong deepfake CFO video conference fraud)](https://incidentdatabase.ai/reports/3622)
- [Evaluating Large Language Models' Capability to Launch Fully Automated Spear Phishing Campaigns (Heiding et al., arXiv 2412.00586)](https://arxiv.org/html/2412.00586v1)
- [Evaluating Large Language Models' Ability to Automate Spear Phishing (Schneier academic archive, Expert Systems with Applications)](https://www.schneier.com/academic/archives/2026/06/evaluating-large-language-models-ability-to-automate-spear-phishing.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4047