AI-powered phishing campaigns escalate in 2025
Cybercriminals are increasingly using AI tools to generate personalized phishing emails and deepfake audio-video impersonations in 2025. According to a Kaspersky study, 49% of organizations experienced phishing attacks in the past year, with one reported incident involving a deepfake attack that resulted in a $25.6 million transfer.
What happened
Cybercriminals are using AI tools to generate highly personalized phishing emails at scale, leveraging publicly available information from social media, job boards, and company websites to tailor messages to individual roles, interests, and communication styles.
AI-generated deepfake audio and video are being used to impersonate executives in phishing attacks. One reported case involved attackers using deepfakes to impersonate multiple staff members during a video conference, convincing an employee to transfer approximately $25.6 million.
AI enables cybercriminals to bypass traditional email filtering systems by analyzing and mimicking legitimate email patterns, while machine learning algorithms test and refine phishing campaigns in real-time.
Reported impact
According to a Kaspersky study, 49% of organizations surveyed reported experiencing phishing attacks in the last 12 months, with 49% also reporting an increase in overall cyberattacks.
Half of respondents (50%) in the Kaspersky study anticipate significant growth in phishing attacks. Experienced employees are falling victim to these advanced attacks due to their level of realism and personalization.
Index analysis
The use of AI to personalize phishing at scale represents a significant shift from mass phishing, as AI can generate tailored emails that mimic legitimate communications including accurate references to recent company events.
Deepfake technology has introduced a new dimension to phishing attacks, with the capability to create convincing audio and video impersonations of executives, making detection increasingly difficult.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.