A device-code phishing kit used four pretexts—court access, document signing, identity checks and a finance-report library—behind one device-code flow.
The same flow sat behind all four disguises.
Proofpoint shared this example alongside cases illustrating how malicious emails are changing in the age of generative AI.
According to data presented by security company Proofpoint at the Protect 2026 conference, messages that once gave away perpetrators due to poor translations, spelling errors or repetitive text are now giving way to flawlessly written texts. At the same time, official FBI data for 2025 records huge financial losses and tens of thousands of complaints related to the use of artificial intelligence and fraud in corporate emails.
How artificial intelligence changed data
Older security filters relied on specific signs to identify dangerous messages, such as strange language, unusual sending times, or the use of identical text to multiple recipients. Artificial intelligence has eliminated these limitations.
Attackers can now automatically generate natural speech in any language, tailor content based on the recipient’s role, and create completely different messages for each target in just seconds. As a result, the appearance of an email is no longer a reliable indicator of threat identification.
READ ALSO
Bronze Sandcastle targets organizations in Asia and Africa and records keystrokes
Real examples of attacks
In one case identified by Proofpoint, an attacker contacted more than 30 real estate agents from the same company, using a different account, a different property, and completely different wording in each message. But all of the conversations ended with the same request: for the recipient to participate in an online meeting.
Also, scammers' tools can hide a series of fraudulent processes behind a simple login or verification process.
Defense against new threats
Because the messages appear perfectly normal in appearance, experts say defenses need to change their approach. Instead of just checking whether a message looks unusual, security systems should now consider what the sender's true intent is and what exactly they're trying to achieve.
Proofpoint has developed multi-layered analysis systems that examine messages at various speeds and depths, combining email analysis, identity, messaging, and online activity to identify potential threats.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
