AI-Powered Phishing: How to Detect What No Longer Looks Different

For years, one of the most repeated pieces of advice against phishing was simple: look for spelling errors, clunky writing, or a tone that doesn't sound natural. That advice, while it still has some residual value, has lost much of its practical usefulness. Generative AI can produce grammatically perfect phishing emails, with a convincing professional tone, personalized with specific information about the target — exactly the signals that used to help identify a fraudulent attempt.

We already explored in our guide on artificial intelligence and cybersecurity the general landscape of how AI is powering both attacks and defenses. This guide goes deeper into specifically how that translates into modern phishing's quality and scale.

Writing indistinguishable from legitimate human communication, eliminating the most commonly cited indicator in traditional awareness training — you can no longer rely on "if it's poorly written, it's suspicious" as a general rule.

Personalization at a scale previously impossible, where AI can automatically generate emails incorporating specific public information about the target — their role, their company, projects mentioned on professional social media — turning what used to require extensive manual research into an automated process applicable to thousands of targets simultaneously.

Ability to generate multiple variants of the same attack, hindering detection based on repeated patterns traditional email filters use to identify mass phishing campaigns — each AI-generated variant can be subtly different from the others.

Improved translation and cultural adaptation, where attacks previously geographically limited by language barriers can now adapt with native fluency to specific markets, including the Colombian context, without the clumsy translation tells that used to help identify campaigns originating from other countries.

If writing quality and personalization are no longer reliable indicators, defense has to shift toward signals AI can't as easily fake — as we detail in our guide on how to spot a phishing email, verifying the sender's real address and any link's real destination remains effective, precisely because those technical signals don't depend on the message's writing quality.

The sender's real email address, not the display name, remains verifiable regardless of how well-written the message is.

Any link's real destination, verifiable by hovering over it before clicking, still reveals impersonation attempts no matter how convincing the email text is.

Requests that break established processes, like asking for bank detail changes without following the usual verification protocol, remain a warning sign independent of writing quality.

Artificial urgency combined with sensitive requests, a psychological pattern AI can't eliminate without sacrificing the attack's own effectiveness.

Traditional training focused on "look for writing errors" needs to be actively updated to emphasize technical and process verification over subjective perception of message quality. Phishing simulations should also incorporate AI-generated examples, reflecting the real quality employees will likely face, not outdated examples with obvious errors that no longer represent the real threat.

AI made phishing cheaper in the region: error-free emails in each country's Spanish, naming the real supplier or project, in seconds and by the thousands (CiberLATAM). Kaspersky lists hyper-personalised phishing and deepfakes among the main threats to Latin American companies in 2026. What works is measuring and training: test your team with the phishing simulator, check your email authentication with the DMARC, SPF and DKIM checker and see our security awareness programme.