Generative AI is changing the way malicious emails appear, making traditional detection methods more challenging as attackers create messages that are fluent, personalized, and unique for each recipient. According to cybersecurity company Proofpoint, threat actors are increasingly using artificial intelligence to remove common warning signs that security systems have relied on for years, including poor language quality, repeated templates, generic messages, and unusual communication patterns. The company highlighted these developments during its Protect 2026 conference, explaining that security teams need to move beyond analyzing only whether an email appears suspicious and focus more on understanding the intent behind a message.
Proofpoint shared examples showing how AI can help attackers create highly customized campaigns at scale. In one case, a threat actor contacted more than 30 real estate agents within the same organization using different accounts, property details, and writing styles. Each conversation appeared unique, but the final objective was similar: encouraging recipients to join a video meeting. The messages used realistic questions about property availability, inspections, and pricing, making them appear like normal business communication. According to Proofpoint, this type of campaign demonstrates how generative AI allows attackers to create convincing interactions that avoid traditional detection methods because individual messages may not contain obvious indicators of malicious activity. The company noted that older email security approaches were developed around attacker limitations. Previously, cybercriminals often reused templates, relied on similar infrastructure, made language mistakes, or produced large numbers of identical messages because creating customized content required significant time and effort. These repeated patterns created useful signals for behavioral detection systems. Generative AI has reduced those limitations by enabling attackers to produce localized language, realistic conversation responses, matching writing styles, and different versions of messages within seconds. As a result, security teams are increasingly required to evaluate what a message is attempting to achieve rather than only examining whether the communication looks unusual.
Proofpoint also highlighted that AI powered campaigns are expanding beyond traditional phishing attempts. The company described examples of disruptive communication campaigns where large numbers of AI generated messages target executives with customized content, including manipulated images and hostile material. Since these messages may not contain malicious links or direct credential theft attempts, analyzing individual emails alone may not reveal the broader campaign. Security teams need to identify patterns across multiple communications and examine text and visual content together to understand the overall objective. The impact of AI is also visible in phishing infrastructure and business email compromise attempts. Proofpoint described phishing kits that can present different themes, including court access portals, document signing requests, identity verification pages, and financial report platforms, while maintaining the same underlying objective. Attackers can quickly change the appearance and wording of campaigns, making traditional indicators less reliable. In business email compromise cases, AI can generate realistic conversations between impersonated suppliers and executives, including invoice discussions, payment details, and supporting documents that previously required extensive research and manual preparation. To address these challenges, Proofpoint is focusing on intent based detection through its Nexus Intent Based Detection Model as part of its Agentic Collaboration Security approach. The company explained that intent analysis examines whether a request matches the expected relationship, communication history, and business context. A payment change request from a familiar supplier, for example, may appear normal based on sender reputation and language quality, but additional details such as unusual timing, unexpected banking updates, or requests to avoid normal verification procedures can indicate potential risk.
Proofpoint said modern defense strategies will require multiple layers of detection. Traditional security methods based on rules, signatures, reputation checks, and indicators of compromise remain effective for known threats, while behavioral analysis continues to identify suspicious activity from known actors. However, AI generated threats require additional reasoning capabilities that examine intent and context. The company described a tiered approach where faster AI models analyze large volumes of messages, while deeper analysis is applied to fewer complex cases requiring additional investigation. The company also emphasized that artificial intelligence is accelerating both attacks and investigations. Automated campaigns can generate and adapt messages faster than human analysts can manually review them, requiring security teams to adopt faster investigation methods. Proofpoint’s Threat Investigation Agent is designed to analyze activity across email, identity systems, messaging platforms, browsers, and supplier interactions to identify campaign scope and assist response teams. The company stated that the changing threat environment requires organizations to focus on what attackers are trying to accomplish rather than only how their messages appear.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
