AI makes phishing 4.5x more effective, Microsoft says

"People receiving an AI phishing email are 4.5 times more likely to click on the malicious link or file, according to Microsoft. In its annual Digital Defense Report, Redmond says these AI-automated emails achieved 54 percent click-through rates last year compared to 12 percent for non-AI phishes. Not only does AI increase phishers' chances of getting clicks, but it also potentially increases phishing profitability by up to 50 times, the report claims."

"As we've seen in previous attacks, AI enables criminals to craft more targeted phishing emails, written in the victims' local language, and using more believable lures - and now, it appears that these efforts are paying dividends. "This massive return on investment will incentivize cyber threat actors who aren't yet using AI to add it to their toolbox in the future," Redmond wrote in the 2025 report, calling this increase in scale and efficiency of attacks "the most significant change in phishing over the last year.""

"As most readers likely suspect, digital crime didn't decrease during this time frame, and miscreants increased the efficiency and effectiveness of their attacks thanks to an AI boost. In addition to automating phishing emails, AI makes it easier and faster for criminals to scan for vulnerabilities and exploit them at scale, conduct reconnaissance and target individuals and organizations for social engineering attacks, and even create malware."

AI-automated phishing emails achieved a 54% click-through rate last year versus 12% for non-AI phishing, making recipients 4.5 times more likely to click malicious links or files. AI can boost phishing profitability by up to 50 times. AI enables highly targeted messages in victims' local languages with more believable lures and automates vulnerability scanning, large-scale exploitation, reconnaissance, social engineering targeting, and malware creation. Attackers gain new capabilities such as voice cloning and deepfake video, and new attack surfaces like large language models can be exploited. Nation-state actors are incorporating AI into influence operations.

Read at Theregister