Generative AI has ushered in a new era of sophistication for email-borne attacks. Messages that once betrayed themselves through awkward phrasing, generic pretexts, and recycled templates now arrive with impeccable fluency, tailored personalization, and unique content for each recipient. This evolution is eroding the behavioral signals that email filters have relied upon for years. At its Protect 2026 conference, **Proofpoint** showcased compelling examples of this paradigm shift. In one instance, a single threat actor engaged over 30 real estate agents within the same company. Each interaction originated from a different account, concerned a different property, and used distinct wording, yet all culminated in the same request: to join a video meeting. Federal data corroborates this trend. The **FBI's Internet Crime Complaint Center** reported more than 22,000 complaints involving AI in 2025, with associated losses nearing $900 million. Furthermore, **Business Email Compromise (BEC)** complaints totaled 24,768, accounting for approximately $3.05 billion in reported losses, according to their [2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf). ## What AI Changed Historically, email filters were designed to catch attackers who cut corners. Researching targets, crafting convincing messages in foreign languages, impersonating suppliers, and generating enough variations to bypass signatures were time-consuming tasks. This led attackers to reuse templates and infrastructure, leaving discernible patterns that behavioral detection systems learned to identify: new infrastructure, awkward language, unusual timing, and out-of-context requests. Generative AI eliminates these constraints: * **Language:** Produces fluent, localized text in any language, free from typos or translation artifacts. * **Context:** Generates replies that are perfectly aligned with the thread, the recipient's role, and the timing. * **Persona:** Matches writing styles, includes authentic-looking signature blocks, and fabricates entire conversation histories. * **Variation:** Creates a unique message for every recipient in seconds, eliminating any template for filters to match. Consequently, **Proofpoint** argues that behavioral signals are becoming less effective. When AI enables attackers to make every message appear legitimate, the analysis must shift from questioning a message's unusual appearance to scrutinizing its underlying intent. ## Thirty Conversations, One Ask The real estate campaign exemplifies this new reality. Crafting over 30 distinct, plausible property inquiries, each customized to a different listing and agent, is precisely the kind of task generative AI can accomplish in seconds. The initial questions were innocuous: inquiring about property availability, price guides, or viewing opportunities. The sender mailboxes were authentic, and replies seamlessly integrated into existing agent workflows.  In one thread, an inspection inquiry sent at 2:58 a.m. quickly escalated to a meeting invitation just 13 minutes later. This invitation included a branded template and a fabricated claim of requiring the agent's "immediate attention." The join link utilized a genuine google.com redirect, passing reputation checks, while a URL parameter covertly redirected the click to an unrelated malicious site. Since each sender initiated first contact, behavioral filters lacked any historical data for comparison. Moreover, the unique content of each message prevented matching against repeated patterns. The common denominator among these messages was not their appearance, but their malicious objective. **Proofpoint** highlights that AI facilitates running such campaigns against any business that relies on external communications, including clinics, law firms, banks, and insurers. A variant targeting insurance agents, for example, used quote requests, neighbor referrals, and coverage questions to build trust before delivering a spoofed conference invitation with a malicious payload. ## AI-Powered Disruption AI also empowers campaigns focused on disruption rather than financial gain. **Proofpoint** described hostile communications campaigns where hundreds or thousands of senders target the same executives, each message tailored to the recipient's industry. Some messages contained derogatory language, while others featured AI-generated or manipulated images designed to mock the recipient.  These messages lack traditional payloads like malicious links or credential harvesting forms. Individually, any one could be dismissed as an angry correspondent. Detecting them requires analyzing the collective intent across the entire set, combining text and imagery analysis, as the hostility may reside within an AI-generated picture. ## Legitimacy on Demand The same shift is evident in phishing infrastructure. **Proofpoint** showcased a phishing-as-a-service kit that presented a single backend flow behind four distinct disguises: a court access portal, a document-signing request, an identity check, and a finance report library. Each page displayed a verification code, directing the victim to a legitimate sign-in page to paste it. Since the attacker generated the code, entering it authorizes the attacker's session—a technique known as device-code phishing.  The operator can trivially swap these disguises, meaning visual and linguistic fingerprints that defenders might match change from one campaign to the next, while the core objective remains constant. AI's effect on context is most clearly demonstrated in BEC attacks. Consider an email containing a fabricated quoted thread, where an impersonated audit vendor and a target executive seemingly agree on an invoice, a 50 percent loyalty rebate, and a payment date. The attached invoice meticulously itemizes audit phases, hours, and rates. The closing line demands same-day payment to a remittance address that differs from the actual sender's.  Crafting both sides of such an exchange and building a believable invoice once required significant research and hours of manual work. A language model now drafts all of this in seconds, removing the effort that previously limited the scale of such targeted attacks. ## Changing the Analysis: From Behavior to Intent If AI grants attackers control over a message's appearance, the remaining reliable signal is the message's true objective. **Proofpoint's** evolving approach focuses on evaluating this objective: whether it is plausible given the established relationship and conversation, and what specific technique is being employed to achieve it.