Phishing Attacks Evolution: From Simple Emails to AI.

[Fixxx]

Phishing is experiencing a rebirth. Where it used to be “handmade spam thrown at the wall”, today it’s a highly automated industry with an ROI many legitimate companies would envy. The goal remains the same: harvest data, but methods have evolved from crude social engineering to complex psycho-technical operations that use AI. Phishing is fishing: the scammer is the angler, the user is the fish. Let’s run through the key stages of this evolution and see where we stand now.

Era of Amateurs: Email Spam and Crude Forgeries ​

Itl started in the 1990s. Early phishing emails were primitive: poor translations, suspicious addresses like [email protected] and panic-inducing “confirm your account” pleas. Effectiveness was low, but the audience was naive. The number of phishing attacks continued to grow: in 2024 it rose 33% compared to 2023 and 72% compared to 2022. Attacks target all sectors, but the most popular targets in 2024 were government institutions (15%), industrial enterprises (10%) and IT companies (9%).

Fact: classic phishing persists not because it’s sophisticated, but because it’s cheap and scalable. Sending a million emails costs pennies and to get 0.1% to bite you don’t need advanced AI.​

Era of Targeting: Social Engineering and Spear Phishing ​

With social networks, phishing became precise. Spear phishing assumes collection of publicly available data about the victim for personalization. An email from a "colleague" or "manager" asking to urgently transfer funds or check an "invoice attachment" became a corporate scourge.

Notable example: in 2020 attackers, posing as partners of an IT company, used a series of phishing emails to gain access to Twitter’s internal tools and executed a high-profile breach of celebrity accounts.​

AI Era: Deepfakes, Perfect Copy and Automation ​

This brings us to the main trend of 2024-2025. AI is not the future of phishing - it’s the present. Its role is to remove barriers to both scale and quality.

• Text generation - Neural models produce flawless emails from a linguistic and stylistic standpoint. No spelling mistakes, no odd phrasing. Messages can be crafted in the specific corporate tone of a real company.
• Voice phishing (vishing) with voice cloning - Some services can clone a voice from a short audio clip. Scammers call finance departments impersonating executives with orders for urgent transfers.
• Deep personalization - AI analyzes a victim’s social posts and generates contextual lures: "Hi! Saw your talk at the conference - great topic! By the way, about that…".

Fact: according to a SlashNext report, with the arrival of ChatGPT at the end of 2022 the number of phishing attacks rose 1,265% in one year. AI made creating convincing content accessible to anyone.​

New Vectors: QR Codes and Beyond ​

Email filters learned to catch links. The scammer's response: QR codes (quishing). A user receives an email supposedly from a delivery service: "To track your package, scan the code". They scan with their phone and land on a phishing page, bypassing corporate protections on the workstation.

How to Defend​

Phishing defense requires a blend of technology and user awareness. Key measures include:

1. Two-factor authentication (2FA) - reduces the risk of account takeover even if passwords are compromised.
2. DMARC, DKIM, SPF - configure these email protocols for your domain to make address spoofing harder.
3. Filters and anti-phishing solutions - modern mail systems use machine learning to detect forgeries.
4. Source verification - carefully check sender addresses, link domains and message content.
5. Cyberculture - cultivate the understanding that digital trust must be earned, not assumed.

Phishing evolves with technology, but its main tool remains human psychology. So defense starts with critical thinking and technical measures follow. Train vigilance: the key question is not "Does this message look legitimate?" but "Was I expecting this message in this context?". Any unexpected request should trigger internal alarm.

Conclusion​

Phishing has shifted from a cottage industry to a technology-driven sector of cybercrime. AI became the great equalizer, giving attackers tools that rival those of state actors. In response, defenses must move from ad hoc patches to systematic security architectures where human attention is the last, not the only, line of defense. Proactive vulnerability scanning, well-tuned mail filters and continuous training distinguish an organization ready for modern threats - and a technically literate individual. Ultimately, the best defense is understanding how the attack works.