- Kaspersky warns AI is used to craft convincing emails, generate deepfakes, and more
- The number of clicks on phishing links grows quarter-on-quarter
- Users warned to stay alert to be safe from attacks
Generative Artificial Intelligence (GenAI) is making phishing attacks smarter, harder to detect, and more widespread, new research from Kaspersky has warned.
Its findings claim in the second quarter 2025, its products detected and blocked more than 142 million clicks on phishing links, representing a 3.3% increase over the first quarter.
While it can mean that there were more phishing attacks over the summer, it can also mean that the volume remained the same – but the actual attacks grew more convincing.
Generating deepfakes
“AI has elevated phishing into a highly personalized threat. Large language models enable attackers to craft convincing emails, messages and websites that mimic legitimate sources, eliminating grammatical errors that once exposed scams,” the researchers said.
“AI-driven bots on social media and messaging apps impersonate real users, engaging victims in prolonged conversations to build trust. These bots often fuel romantic or investment scams, luring victims into fake opportunities with AI-generated audio messages or deepfake videos.”
The researchers also said that GenAI isn’t just being used to eliminate spelling and grammar errors – arguably the biggest red flags in phishing emails.
It is also used to create realistic audio and video deepfake impersonations of trusted individuals, including colleagues, celebrities, and bank officials.
These deepfakes are then used to promote fake giveaways, or steal sensitive information such as multi-factor authentication (MFA) codes, passwords, and similar.
“AI-powered tools analyze public data from social media or corporate websites to launch targeted attacks, such as HR-themed emails or fake calls referencing personal details,” Kaspersky added.
How to stay safe
As the risk of phishing grows, staying vigilant online remains the best way to be safe.
Users should always be skeptical of unsolicited incoming messages, especially those that demand urgent action or threaten with a disaster.
These are, and will continue to be, the biggest red flag in phishing attacks.