Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique to each recipient, and the behavioral signals email filters have relied on for years are fading as a result.
Proofpoint shared several examples of the shift at its Protect 2026 conference. In one, a single threat actor contacted more than 30 real estate agents at the same company, each from a different account, about a different property, and in different words, before closing every thread with the same request: join a video meeting.
Federal data points the same way. The FBI's Internet Crime Complaint Center counted more than 22,000 complaints involving AI in 2025, with nearly $900 million in associated losses, and logged 24,768 business email compromise (BEC) complaints with about $3.05 billion in reported losses, according to its 2025 Internet Crime Report.
What AI Changed
Email filters were built for attackers who had to cut corners. Researching a target, writing convincingly in a second language, impersonating a supplier, and producing enough variants to defeat signatures all took time, so attackers reused templates and infrastructure, and that reuse left patterns. Behavioral detection learned to spot them: new infrastructure, awkward language, odd timing, and requests that did not fit the conversation.
Generative AI removes those constraints:
- Language. Fluent, localized text in any language, with no typos or translation artifacts.
- Context. Replies that fit the thread, the recipient’s role, and the timing.
- Persona. Matched writing style, signature blocks, and fully fabricated conversation histories.
- Variation. A unique message for every recipient, generated in seconds, so there is no template to match.
The result, Proofpoint argues, is that behavior has become a weakening signal. When AI lets attackers make every message look normal, the analysis has to change too, from asking whether a message looks unusual to asking what it is trying to do.
Thirty Conversations, One Ask
The real estate campaign shows what that looks like in practice. Writing 30-plus distinct, plausible property enquiries, each tailored to a different listing and a different agent, is exactly the kind of work generative AI now does in seconds. The opening questions were mundane: whether a property was still open for inspection, what the price guide was, whether a viewing was possible that week. The sender mailboxes were real, and replies landed in threads the agents were already answering.
 |
| Figure 1. Different properties, senders, and wording, with the same final ask in every thread. |
In one thread, an inspection enquiry sent at 2:58 a.m. turned into a meeting invitation 13 minutes later, complete with a branded template and a claim that the meeting required the agent’s “immediate attention.” The join link was a genuine google.com redirect, so reputation checks read clean, while a parameter in the URL handed the click to an unrelated site.
Because each sender was making first contact, behavioral filters had no history to compare against, and because every message was different, there was no repeated content to match. What the messages shared was not how they looked but what they were trying to get the recipient to do.
AI makes it easy to run this pattern against any business that depends on hearing from strangers, including clinics taking new patients, firms signing new clients, banks opening accounts, and insurers quoting policies, Proofpoint said. A variant aimed at insurance agents used quote requests, neighbor referrals, and coverage questions to build trust before sending a spoofed conference invitation that delivered the payload.
AI-Powered Disruption
AI has also made it easier to run campaigns that aim to disrupt rather than steal. Proofpoint described hostile communications campaigns in which hundreds or thousands of senders write to the same executives, each on a topic tailored to the target’s industry. Some messages carry derogatory language; others carry AI-generated or manipulated images that mock the recipient.
 |
| Figure 2. Hostile communications campaigns carry no payload. The signal is the pattern. |
These messages have no link to detonate and no credential to harvest, and any one of them could pass for a single angry correspondent. Scoring messages one at a time will not catch them. The analysis has to recognize disruptive intent across the whole set, and read text and imagery together, since the hostility may sit in an AI-generated picture.
Legitimacy on Demand
The same shift applies to phishing infrastructure. One phishing-as-a-service kit Proofpoint highlighted presents a single flow behind four different disguises: a court access portal, a document-signing request, an identity check, and a finance report library. Each page displays a verification code and directs the victim to a legitimate sign-in page to paste it. Because the attacker generated the code, entering it authorizes the attacker’s session, a technique known as device-code phishing.
 |
| Figure 3. Four pretexts in front of one device-code flow. |
Swapping the disguise is trivial for the operator, so the visual and linguistic fingerprints defenders might match change from one campaign to the next while the objective stays fixed.
BEC shows AI’s effect on context most clearly. In another example, a single email contains a quoted thread in which an impersonated audit vendor and an executive at the target appear to agree on an invoice, a 50 percent loyalty rebate, and a payment date. The attached invoice itemizes audit phases, hours, and rates, and the closing line asks for payment that day to a remittance address that differs from the actual sending address.
 |
| Figure 4. A single BEC message with a fabricated thread and invoice. Names and domains are anonymized. |
Writing both sides of that exchange and building a believable invoice once took research and hours of work. A language model drafts all of it in seconds, which removes the effort that used to limit how many targets received this kind of attention.
Changing the Analysis: From Behavior to Intent
If AI lets attackers control how a message looks, the signal that remains is what the message is trying to accomplish. Proofpoint’s approach evaluates that objective, whether it is plausible given the relationship and conversation, and what technique is being used to pursue it. The company announced its Nexus Intent-Based Detection Model in September as part of what it calls the Agentic Collaboration Security system.
A bank-detail change request illustrates the approach. The message comes from a known supplier’s real mailbox, inside a real thread, with a clean reputation, and its language is exactly what AI makes easy to produce. Read for intent, however, five details line up:
- It is the supplier’s first banking change in years.
- The request does not match the invoice-confirmation thread it replies to.
- The deadline is tied to a specific payment run.
- The sender asks to keep the exchange off the thread and deal with one person.
- Verification is closed off in advance with a claim that the finance mailbox is “mid-migration.”
 |
| Figure 5. A bank-detail change request read for intent. |
AI can polish the wording of a request like this. But the intent must match the attacker’s path to success, whether that’s the user clicking a link, entering credentials or joining a meeting. That’s why intent holds up where behavior is a less reliable indicator.
Proofpoint positions intent analysis as a third layer rather than a replacement. Traditional detection, built on rules, signatures, infrastructure reputation, and indicators of compromise, still clears known threats quickly and at scale. Modern detection, built on threat actor intelligence and behavioral baselines, still catches known actors and senders that deviate. Intent reasoning targets the AI-crafted messages that pass both.
 |
| Figure 6. Three layers of detection, each answering a different question. |
Defenders are using AI here too. Because running deep language-model analysis on every message would be too slow for mail flow, the model is split into three tiers that match depth to ambiguity:
- Tier one (flash models) evaluates all mail in under 500 milliseconds using machine learning, threat intelligence, computer vision, and language models.
- Tier two (extended thinking) handles fewer than 1 percent of messages in seconds to minutes, adding sandboxing, topic and tone analysis, and an organizational graph.
- Tier three (deep thinking) handles fewer than 0.01 percent in minutes, adding multi-stage language model analysis, voice and video, and profiles of privileged individuals.
 |
| Figure 7. Multi-tier reasoning: most mail is resolved in milliseconds, and only the most ambiguous reaches deep analysis. |
A message one tier cannot resolve moves to the next, and a malicious verdict can come at any tier. The organizational graph is designed to surface campaigns like the real estate example, where AI-varied requests land across one company but no single mailbox sees more than one.
Investigating at Machine Speed
AI has also compressed attacker timelines. Automated campaigns can generate and adapt hundreds of messages in the time an analyst triages one, so a missed detection is rarely a single email; it is often a campaign that already includes replies, sign-ins, and mailbox changes. Proofpoint argues that investigation has to change as well, from analyst-driven, ticket-by-ticket review to agentic investigation that keeps pace with the attacker.
Its Threat Investigation Agent is designed to run one investigation across email, identity, messaging, browser, and supplier activity, map the blast radius, and feed findings back into detection. Use cases include account takeover, abuse mailbox triage, advanced campaigns, false positive and false negative feedback, and third-party investigative requests.
 |
| Figure 8. A sample account takeover case in the Threat Investigation Agent, with automatic actions, pending approvals, and an event timeline. |
In an example case, an RFP-themed credential-phishing lure led to the takeover of a finance user’s account. The attacker signed in from New York and then Dallas, added a mailbox rule to hide replies, and sent about 100 phishing messages to 42 internal recipients. The agent contained the incident four minutes after the trigger, retrieving 92 outbound messages, deleting the rule, blocking the URL, and restoring the user’s settings.
Four higher-consequence actions, including a credential reset and 14 days of outbound inspection, were held for human approval. The case also lists what the agent could not determine, such as who clicked a link that sat inside a PDF and was never rewritten, and records failed actions, such as quarantine attempts that did not complete.
Defending Against What Attackers Want, Not How They Look
The examples Proofpoint shared point to the same conclusion: generative AI has changed the threat landscape faster than behavior-based analysis can keep up. Attackers can now make every message fluent, plausible, and unique, run campaigns that look like ordinary business, and adapt them at machine speed. The behavioral tells that filters once depended on are disappearing.
A changed threat calls for changed analysis: keeping traditional and modern detection for what they still catch well, adding intent-based reasoning that asks what a message is trying to achieve, scaling that reasoning across tiers so it keeps pace with mail flow, and investigating incidents at the same speed attackers now operate.
Learn more about Proofpoint’s approach to AI, and see a demo, at Proofpoint Nexus.
Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.