Phishing 3.0: The Fight Moves to Agent Versus Agent
Agentic AI transforms phishing economics, enabling personalized multi-channel attacks with deepfakes like the $25M Arup deepfake heist.
The article argues phishing has evolved through three stages: from malicious content, to intent-based BEC, to AI-powered multi-channel campaigns where attacker agents autonomously conduct reconnaissance and generate tailored lures. The widely reported Arup case saw a deepfake video call impersonating colleagues convince an employee to approve transfers worth roughly $25 million. An Osterman Research study of 128 security leaders found 88% experienced trust-undermining incidents, while Microsoft 365 EOP and Google Workspace were measured missing hundreds of phishing messages per 100 mailboxes monthly. The author argues defenders must adopt their own agents to match attacker speed.
- Agentic AI removes reconnaissance cost, enabling personalized attacks at scale against all organizations
- Arup employee approved $25M in transfers after deepfake video call with synthetic colleagues
- EOP reportedly missing 293 phishing messages per 100 mailboxes, Google Workspace missing 350
- SOCs average 4,330 alerts daily and investigate only 37% of them
- 48% of security professionals ranked agentic AI as top attack vector for 2026
- Vendors
- IRONSCALESMicrosoftGoogle
- Victims
- Arup
- Countries
- UK
From the original article
7 min read at thehackernews.com
Most email defenses still do the job they did a decade ago. Scan the message, look for something malicious, block it. That worked when the danger sat in the payload, a bad link or an attachment.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.