How AI Makes Phishing and Vishing Attacks More Dangerous

AI has not turned every attacker into an expert. It has made ordinary social engineering cheaper, faster, and easier to personalize. What used to require time, language skill, manual research, or a skilled operator can now be automated or semi-automated across email, voice, SMS, collaboration tools, and video.

AI makes phishing, vishing, and social engineering more dangerous by automating the attacker workflow: collecting target context, generating personalized lures, delivering them across email, voice, SMS, and collaboration tools, adjusting conversations in real time, and using stolen credentials or approvals to access business systems. The main change is lower cost, higher speed, better personalization, and more convincing multi-channel impersonation.

The practical work starts with the attacker workflow: what changes, which controls become more fragile, and what security teams should train, simulate, and measure differently.

First, What AI Does Not Change

The sober version of the AI phishing story is more useful than the dramatic one: AI industrializes social engineering fundamentals.

The underlying levers are familiar. Attackers still rely on trust, authority, urgency, relevance, fear, curiosity, reciprocity, and payoff. They still want the target to click a link, open an attachment, approve an MFA prompt, share a reset link, reveal sensitive information, change payment details, or break a normal process under pressure.

AI also does not guarantee success. A bad pretext is still a bad pretext. A poorly timed message can still be ignored. Strong identity controls, reporting workflows, and well-rehearsed verification processes still matter.

What changes is the attacker's operating model. Phishing has always been partly an economics problem. If personalization is slow and expensive, only the highest-value targets receive careful attention. If personalization becomes cheap, attackers can apply it to a much larger population. If fluent writing, translation, target research, and live conversation become easier, the baseline quality of attacks rises.

That is the real shift. AI does not make social engineering new. It makes credible social engineering easier to produce, repeat, test, and scale.

Traditional Phishing vs. AI-Enabled Phishing

The important shift is scale. Good-enough personalization can now be produced at a speed and cost that used to be uneconomical.

One human-subject study comparing phishing emails found that fully AI-automated spear phishing performed on par with human experts in click-through rate, while requiring far less manual effort. The same study found that AI-gathered target information was accurate and useful in most cases, and that fully automated attacks dramatically reduced the time and cost required to create personalized messages.

Another study on large language models and spear phishing showed how LLMs can support the "collect" and "contact" phases of an attack by turning public information into personalized messages at very low cost. The core implication for security leaders is straightforward: attackers no longer need to reserve personalization for only executives, finance leaders, or privileged administrators.

Detection Cues Decay

For years, awareness training often taught users to look for obvious signs of phishing: misspellings, awkward phrasing, generic greetings, strange formatting, suspicious links, and mismatched sender details.

Those cues still matter, but they are weaker than they used to be.

Generative AI can produce fluent, localized, businesslike writing. It can adapt tone to a department, region, seniority level, or business process. It can produce messages that look less like spam and more like ordinary work.

The same problem applies to deepfakes and voice cloning. Many detection tips focus on artifacts: odd blinking, unnatural cadence, strange lip sync, distorted audio, or unusual facial movement. Those signs can still help, but they are not a durable foundation for security. As synthetic media improves, artifact-based detection becomes a moving target.

Detection still matters, but it should not be the control strategy. If the defense depends on humans or tools reliably spotting synthetic artifacts, it is fragile. Employees do not need to perfectly identify synthetic content. Risky requests need to fail unless they pass a trusted verification process.

The AI Social Engineering Workflow

AI changes phishing and vishing most clearly when you look at the workflow end to end. The attacker is assembling a campaign system, not just writing a better email.

1. Target Research Becomes Automated

Traditional spear phishing required research. An attacker had to identify the target, understand their role, find public context, infer relationships, and decide which pretext might work.

AI reduces that burden. Models can summarize public information, employee profiles, company pages, job postings, vendor relationships, conference talks, social posts, breached context, and recent company events. That material can become a target profile, a role-specific lure, or a believable caller persona.

The marginal cost of personalization drops. Attackers can move from generic phishing toward semi-personalized or hyper-personalized lures across larger groups. A finance employee might receive a vendor-themed request. A marketer might receive a platform-access warning. An IT administrator might receive a helpdesk escalation. An executive assistant might receive a calendar or travel-related pretext.

Defensively, this means organizations should stop treating personalization as a sign of legitimacy. Public context can be weaponized. Training should show employees how normal business context can be used inside a malicious request.

2. Lures Become Personalized and Fluent

AI-generated phishing can be grammatically clean, localized, and written in the style of normal business communication. It can reference a job function, department, region, vendor, project, tool, or process. It can also vary message content quickly, which makes attack campaigns harder to recognize by a single repeated template.

This undermines training that overweights surface quality. "Does this message look badly written?" matters less than "what action is this message asking me to take, and is that action normal for this workflow?"

For CISOs, this is a practical reframing. Employees should learn to identify risky requests, not just ugly messages. A polished request to approve an MFA prompt, share a reset link, change payment details, or log into a supplied portal is still dangerous.

3. Delivery Becomes Multi-Channel

AI-enabled social engineering moves across email, SMS, phone calls, collaboration tools, social platforms, and video. Channel switching can make an attack feel more legitimate because real business often works that way.

An email creates context. A phone call creates pressure. A Teams message adds familiarity. A follow-up link captures credentials. A spoofed caller ID or cloned voice creates the feeling of recognition.

This is especially important because many organizations have stronger controls for email than for voice, chat, or helpdesk workflows. A phone call can bypass email security entirely. A chat message can arrive inside a trusted work environment. A voice interaction can pressure someone to act before they have time to verify.

Security teams should treat channel switching as a risk signal. Email followed by a call, SMS followed by a chat message, or a phone request followed by a link should increase suspicion, not reduce it.

4. Conversations Become Interactive

Traditional phishing is usually static. The message is sent, and the target acts or ignores it.

Voice and chat-based AI change that pattern. A live interaction can change with the target's response. The caller can repeat the request, soften the tone, raise urgency, invoke authority, answer objections, or redirect the conversation when the target hesitates.

Vishing creates a different kind of pressure than email. Voice creates immediacy. It feels interpersonal. It can trigger politeness, deference, time pressure, and a desire to resolve the issue quickly.

Recognition quizzes are not enough. Employees need to rehearse the behavior of slowing down, refusing unsafe shortcuts, ending the call, escalating the request, and verifying through an approved path.

5. The Payoff Targets Identity, Access, or Business Process

AI phishing and vishing are often described as "getting someone to click." That framing is too narrow.

The payoff may be a password, a session token, an MFA approval, an OAuth grant, a password reset link, a helpdesk reset, sensitive data, a payment change, or access to a SaaS system. The target action might happen in a browser, over the phone, inside a chat tool, through a helpdesk workflow, or inside a finance approval process.

Identity and process controls matter because the attack targets the workflow as much as the employee.

Awareness training should therefore connect directly to high-risk workflows: login, MFA, password reset, vendor onboarding, payment changes, data export, privileged access, executive requests, and helpdesk identity proofing.

6. Follow-On Intrusion Uses the Stolen Context

Once an attacker gains access, social and technical compromise reinforce each other.

Internal email threads, tickets, documents, calendars, org charts, CRM records, source repositories, customer records, and vendor details can all make the next social engineering attempt more convincing. A compromised mailbox can support thread hijacking. A SaaS account can expose business relationships. A helpdesk reset can become the entry point for broader identity compromise.

CISOs should not treat phishing as only a user-education problem. Social engineering is part of intrusion prevention. Reducing blast radius through least privilege, logging, SaaS monitoring, segmentation, and identity governance is part of the phishing response.

How AI Makes Vishing More Dangerous

Vishing deserves separate treatment because voice changes both psychology and control design.

A cloned voice can make impersonation more convincing, but the larger risk is pressure. A real-time voice interaction can push an employee to bypass the normal process.

AI makes vishing more dangerous in several ways:

• It can make caller personas more believable.

• It can support voice cloning and synthetic speech.

• It can help attackers adapt scripts to the target's responses.

• It can combine voice with email, SMS, or collaboration tools.

• It can target workflows that are weaker over the phone, such as helpdesk resets, vendor changes, payment approval, and urgent executive requests.

Caller ID and phone numbers are weak trust signals. Voice familiarity is also a weak trust signal when voice cloning is available. A person may sound like an executive, colleague, vendor, or IT support contact and still be unverified.

A useful mental model is to treat voice as another untrusted input. A familiar voice should not be enough. The request still needs to move through an approved verification path.

Common high-risk vishing scenarios include:

• IT support asking for a password reset link or MFA approval.

• An executive asking for urgent payment approval.

• A vendor asking to change bank details.

• A helpdesk caller using public or breached context to pass weak identity checks.

• A recruiter, supplier, or partner using a phone call plus a follow-up email to create legitimacy.

The most exposed organizations are the ones where voice requests can change access, move money, reset accounts, or override normal workflows.

Why Traditional Awareness Training Is Not Enough

Interactive, personalized, multi-channel attacks expose the limits of traditional awareness training. Employees need practice with the verification behaviors that stop risky requests: reporting, callback, escalation, refusal, and safe use of approved workflows.

That does not mean training is useless. Research on cybersecurity training shows that training can improve outcomes. But it also shows an important gap: improving knowledge, attitude, or intention is easier than changing behavior under real working conditions.

One systematic review of cybersecurity training found a broad field with many approaches, including games, presentations, simulations, text, video, and information-based methods. It also found recurring weaknesses: many studies are small, one-time, short-term, or focused on knowledge and intention rather than objective behavior.

A meta-analysis of cybersecurity training found an overall positive effect, but behavior effects were weaker than effects on precursors such as knowledge and intention. The more rigorous behavior-focused evidence was less impressive than the headline training effect.

That distinction matters for CISOs. A user can know the policy and still fail under time pressure. A helpdesk agent can understand social engineering and still be maneuvered by an urgent caller. A finance employee can pass an annual quiz and still be exposed by a realistic multi-channel payment-change request.

Modern attacks are designed to exploit time pressure, authority, ambiguity, and routine business process. Treating every failure as carelessness misses the point.

Simulation and feedback matter because they create practice around the moment of friction. Just-in-time feedback, realistic scenarios, and repeated rehearsal are better aligned with behavior change than annual completion alone. The purpose is not to catch employees out. It is to practice the hesitation, verification, and escalation that should happen before a real incident.

Verification Behaviors CISOs Should Train and Measure

Employees will not always be able to tell real from fake. A stronger program makes risky requests fail unless they pass the right verification process.

CISOs should train and measure behaviors such as:

• Report suspicious requests early. Reporting should be easy, non-punitive, and available across email, chat, and voice-related workflows.

• Use trusted paths, not provided paths. Do not use the link, phone number, QR code, or attachment supplied in the suspicious message. Go through the known portal, directory, or system of record.

• Call back through approved numbers. For voice requests involving credentials, payments, data, or privileged access, end the call and call back using an approved internal directory or vendor record.

• Refuse MFA approval by social pressure. Employees should never approve MFA prompts because someone asks over phone, email, SMS, or chat.

• Verify payment, vendor, and bank-detail changes through workflow. Require dual approval, system-of-record checks, and documented approval trails.

• Follow helpdesk identity-proofing scripts. Helpdesk teams should not rely on voice, caller ID, urgency, or easily discoverable personal details.

• Escalate unusual executive requests. Urgent requests that bypass normal reporting lines or approval systems should be treated as high risk.

• Treat channel switching as a risk signal. Email followed by phone, SMS followed by Teams, or a voice call followed by a link should increase suspicion, not trust.

These behaviors are measurable. A mature program should track reporting, escalation, refusal, verification, safe workflow use, and repeat exposure outcomes. Click rates are useful, but they are not enough.

Controls That Reduce the Blast Radius

Awareness training should not ask employees to be the control. It should teach them how to use the controls.

For AI-enabled phishing and vishing, the most important controls include:

• Phishing-resistant MFA. Put FIDO or PKI-based MFA first for privileged users, finance, executives, helpdesk, developers, and other high-risk roles.

• SSO and centralized logging. Simplify identity control and improve investigation after suspected compromise.

• MFA lockout and alert settings. Detect and respond to unusual MFA attempts and fatigue-style attacks.

• SaaS and OAuth monitoring. Watch for suspicious grants, mailbox rules, impossible travel, new devices, anomalous access, and unusual data export.

• Least privilege. Reduce what one compromised identity can access.

• Payment approval workflows. Require out-of-band verification and dual approval for payment changes.

• Helpdesk process controls. Define identity-proofing scripts, escalation rules, and no-exception workflows for reset requests.

• Incident response and reporting. Make suspicious-message reporting easy and investigate successful phishing quickly.

AI social engineering is a governance issue as much as a training issue. If a phone call can override MFA, the caller is only part of the problem. If a voice request can change bank details, the workflow is exposed. If a helpdesk reset relies on information that can be found online or in a breach, the identity-proofing process needs to change.