Phishing emails have been a business risk for years, but artificial intelligence is giving attackers new ways to make scams more convincing and more targeted. Recent Microsoft research shows how AI is being used alongside familiar phishing techniques to impersonate executives, vendors and popular technology brands.
Phishing Has Changed, Not Disappeared
Phishing is nothing new. Fake invoices, password-reset emails, delivery notifications and messages pretending to come from senior members of staff have been used for years.
What is changing is how convincing these attacks can become.
AI can help attackers create more polished messages, tailor content to specific recipients and build a more convincing story around a request. That makes some of the traditional warning signs, such as obvious spelling mistakes or awkward wording, less reliable.
Microsoft recently investigated a campaign involving more than one million emails in which attackers impersonated company executives and attempted to persuade finance teams to approve payments of almost $50,000. The campaign used fake invoices, fabricated email conversations and lookalike domains, with Microsoft finding indicators consistent with generative AI being used to develop parts of the campaign.
The important point is that AI is not replacing traditional phishing techniques. It is making them easier to refine.
How AI Is Making Phishing More Convincing
Attackers do not need to create an entirely new type of cyber attack to benefit from AI.
Instead, AI can help improve techniques that are already effective.
For example, an attacker may be able to create:
- More professional-looking emails that match the tone of a business
- Messages tailored to a particular employee, company or supplier
- Fake email conversations designed to make a payment request look legitimate
- More convincing invoices, signatures and branding
- Large volumes of customised messages without writing each one manually
This is particularly concerning when an attacker is trying to impersonate someone the recipient already trusts.
A message apparently coming from a managing director asking for an urgent payment may look completely different from a traditional phishing email. It might use the right name, company terminology and a realistic invoice, while still directing the recipient to an account controlled by the attacker.
AI Brands Are Becoming Phishing Lures
It is not only traditional business email that is being exploited.
Microsoft has also reported campaigns impersonating popular AI services including ChatGPT, Microsoft Copilot, DeepSeek and Claude. In one example, a ChatGPT-themed phishing campaign sent up to 100,000 emails in a single day, attempting to trick users into updating payment information. Other campaigns have used fake AI software and downloads to deliver malware or steal credentials.
This is a useful reminder that attackers tend to follow whatever technology people are interested in using.
As businesses adopt more AI tools, employees are increasingly likely to receive legitimate emails about AI accounts, subscriptions, updates and new features. That creates another opportunity for attackers to imitate those services.
Why Traditional Phishing Advice Is No Longer Enough
Many employees have been taught to look for spelling mistakes, strange formatting or obviously suspicious wording.
Those checks still have value, but they cannot be the whole defence.
A well-written email is not necessarily a safe email.
A familiar-looking logo does not prove that a message came from a trusted supplier.
Even an email that appears to come from a senior member of staff may not be genuine.
Employees therefore need to think about whether a request makes sense, rather than simply whether an email looks professional.
A sudden request to change bank details, approve an unfamiliar invoice, share sensitive information or purchase something urgently should be verified using a trusted method, particularly where money or sensitive data is involved.
What Can Businesses Do to Reduce the Risk?
There is no single setting that will stop every phishing attempt. Effective protection needs to combine technology, processes and employee awareness.
Strengthen Email Security
Microsoft recommends layered protections including email authentication, spoof protection and Microsoft Defender for Office 365 to help identify and block suspicious messages. Technologies such as SPF, DKIM and DMARC can also help prevent attackers from successfully impersonating your organisation’s own email domain.
Protect User Accounts
Strong authentication remains essential.
Multi-factor authentication can help protect accounts when a password is compromised, while stronger phishing-resistant authentication methods can provide additional protection against credential theft and social engineering.
Give Employees Clear Rules for High-Risk Requests
Employees should know what to do when they receive an unusual request involving payments, confidential information or access to systems.
For example, a finance employee should have a clear process for independently verifying a change of bank details rather than relying on the email itself.
Keep Security Monitoring in Place
Even with good prevention, some malicious emails will get through.
Microsoft’s guidance includes post-delivery protections such as Zero-hour Auto Purge, which can remove malicious messages from mailboxes after they have already been delivered when new threat intelligence identifies them as dangerous.
That highlights an important part of modern cyber security: protection should not stop at the point an email reaches the inbox.
Where Does an MSP Fit In?
This is where phishing becomes more than an employee awareness issue.
A business needs to know whether its Microsoft 365 environment is properly configured, whether suspicious activity is being detected, whether security policies are being enforced and whether someone is actively monitoring what is happening.
A managed IT provider can help with areas such as:
Microsoft 365 security
Reviewing and configuring security controls across Microsoft 365, including email protection, identity and access.
Email authentication
Making sure SPF, DKIM and DMARC are correctly configured to reduce the risk of domain spoofing.
Identity and MFA
Helping businesses implement stronger authentication and reduce the risk of compromised accounts.
Endpoint and security monitoring
Monitoring devices and accounts for suspicious activity and responding when something needs attention.
Employee security awareness
Helping staff understand the latest phishing techniques and what to do when something does not look right.
Ongoing management
Keeping security controls, Microsoft 365 settings and devices properly maintained instead of relying on someone to react after an incident has already happened.
AI Is Changing the Threat. Your Security Needs to Change Too.
AI does not mean that every phishing email will suddenly become impossible to detect. The fundamentals of phishing remain the same: attackers want people to trust a message, click something, provide information or approve an action.
What is changing is the quality, scale and personalisation of some of those attacks.
That means businesses cannot rely on employees simply spotting an email because it contains poor spelling or looks obviously suspicious.
A stronger approach is to combine secure Microsoft 365 configuration, identity protection, email security, monitoring and clear processes for handling high-risk requests.
How Ventrix IT Can Help
At Ventrix IT, we take a proactive approach to managing and securing business IT.
We can help businesses review their Microsoft 365 security, strengthen email and identity protection, manage devices and security controls, and provide ongoing monitoring and support.
The goal is not simply to deal with a phishing incident after it happens. It is to make your IT environment harder to exploit in the first place and ensure there is someone actively responsible for keeping it secure.
Think your business could be doing more to protect against modern phishing attacks? Get in touch with Ventrix IT to discuss how we can help manage and secure your business IT.
