The most convincing phishing email your finance team gets this year won't have a single typo. It will quote a real thread, match the sender's sign-off, and reference a project only your company knows about. That's the whole trick now, and it's getting cheaper by the month.
The pipeline is simple. Public writing (blogs, LinkedIn, conference talks) is the floor. Mail leaked in old breaches is the ceiling. Best case for the attacker: a live compromised mailbox, which hands over full threads, real signatures, current projects, and the back-and-forth rhythm between two people who actually know each other. Feed that to a GPT-class model and you get a clone that imitates coworkers, vendors, execs, your help desk. Drop the lure into an existing reply chain and it inherits the trust of every legit message above it.
Here's the kind of payload that produces, from one walkthrough of this technique:
"Hey, I need you to review this document before the meeting. Let me know once you've opened it."
Read that as a detection problem. No urgency theatrics. No grammar slip. Every signal your users were trained to key on is absent by design.
"Spot the typo" training is now a liability
For twenty years we taught people that bad writing equals phishing. That heuristic now tells them clean writing means safe writing, which is exactly backwards. Awareness guidance still listing "awkward tone" and "generic greetings" as indicators inverts against a model trained on the sender's own corpus. The fake can have better context and cleaner grammar than the real mail sitting next to it in the inbox.
The pivot: stop asking "Does this look fake?" and start asking "Is this request unusual?" Grade people on what they do with bank detail changes, credential resets, MFA enrollments, gift card asks. There won't be a comma splice to catch. Train the decision, not the eyeball.
Controls that survive a perfect clone
One filter for every control you buy or build from here on: does it work when the message content is flawless? If it reads prose, it fails. If it watches behavior or binds to something the attacker can't fake, it holds.
Phishing-resistant MFA. Lookalike domains proxy real login pages, and OTP codes and push approvals relay right through. FIDO2 keys and passkeys bind the credential to the origin, so a proxied page gets nothing replayable. Finance, payroll, execs, IT admins first. Stuck on push? Number matching is the floor, not the goal.
Out-of-band verification as policy, not suggestion. People route around advice when they're busy. Scope it tight and enforce it:
Verify via contact info you already hold, never from the message:
- New or changed bank details, any amount
- Wire/ACH above $5,000 (dual approval above $25,000)
- Password resets, MFA changes, mailbox delegation
for finance and exec staff
- Gift cards. Any amount. Any requester. Including the CEO.
DMARC at p=reject, with honest limits. If you're at p=none, you're monitoring, not defending. But DMARC only stops exact-domain spoofing. It does nothing about lookalike domains or a genuinely compromised partner account. Leadership thinks the DNS record fixed BEC. It didn't.
Behavioral detection over content inspection. Stop paying the detection budget to read prose. Watch what accounts do. This Microsoft 365 Defender query catches external senders impersonating internal display names:
let InternalNames =
IdentityInfo
| where Timestamp > ago(14d)
| summarize by AccountDisplayName;
EmailEvents
| where Timestamp > ago(7d)
| where SenderFromDomain != "yourdomain.com"
| where SenderDisplayName in~ (InternalNames)
| project Timestamp, SenderFromAddress, SenderDisplayName, Subject, RecipientEmailAddress
Add hunts for new inbox forwarding rules, first-time sender/recipient pairs, and reply-to mismatches. None of these fire because of what the email says. They fire because of what the account does. That's the property you want when the writing is perfect.
"But my queue is still commodity junk." Sure, and reply-chain attacks from compromised mailboxes already happen today with zero AI involved. The model just cuts the attacker's time per target. Every control above pays off against the plain BEC hitting you this quarter, so you're closing gaps you're already being billed for.
- Retire typo-spotting. Train request classification: unusual request, verify out-of-band, every time.
- FIDO2 or passkeys on finance, execs, and admins this quarter.
- Get DMARC to p=reject, then tell leadership exactly what it doesn't cover.
- Deploy the display-name query and forwarding-rule hunt this week.
Honest question for the comments: has your org actually drilled out-of-band verification for a bank-detail change, or is it still a paragraph in a policy doc nobody has tested?
Longer writeup if you want the full argument: https://axeploit.com/blog/your-sent-items-folder-is-a-phishing-kit-now
