AI-Generated Phishing: Why Every Employee Is Now a High-Value Target
Sarah Chen
Head of Security Research · July 10, 2026
For years, phishing detection relied on a simple heuristic: look for awkward language, generic greetings, and improbable scenarios. That heuristic is now useless. Research published this month shows that frontier LLMs, combined with publicly available OSINT data from LinkedIn, GitHub, and corporate websites, can produce personalised spear-phishing emails indistinguishable from genuine colleague communications — in bulk, in seconds, in any language. The average cost to generate a convincing, context-aware phishing campaign has dropped by over 95% since 2023. Every employee is now a high-value target, and your mobile app is frequently the final step the attacker is pushing the victim toward.
Why AI-generated phishing is categorically different
Traditional phishing works on volume. AI-generated spear-phishing works on precision. An LLM can ingest a target's recent GitHub commits, their LinkedIn job history, their company's public roadmap, and a leaked email thread, then produce a message that references real projects, real colleagues, and real deadlines. There is no generic greeting to flag and no improbable scenario to dismiss.
The same infrastructure that writes the message can generate a tailored lure: a fake security alert, a fabricated invoice, or a spoofed app-update prompt that looks exactly like the one your users trust. The message quality is no longer the weak link. The weak link is the action the message drives the victim toward inside an app.
How your app becomes the attack surface
Modern phishing campaigns rarely stop at credential theft. They push the victim into an action inside a legitimate-looking app, where the real damage is done.
- Deep-link abuse: crafted URLs open your app directly to a payment or approval screen, bypassing the browser warning layer
- OAuth phishing: a fake authorisation prompt that looks identical to your app's sign-in captures tokens silently
- Credential stuffing entry points: login flows with no rate limiting or anomaly detection absorb AI-generated credential lists
- Push notification manipulation: forged notification payloads that mimic your app's visual identity drive in-app approvals
- Session hijacking via insecure token storage: once the victim taps through, an insecurely stored session token is the attacker's actual prize
How RASMISER closes the gaps attackers exploit
RASMISER audits every entry point a phishing campaign is likely to target: deep-link handling, OAuth redirect validation, push notification processing, and authentication flows. Each finding is mapped to OWASP MASVS and comes with a concrete remediation step your developers can act on the same day.
With runtime protection enabled, deep links and external inputs are validated before they reach sensitive app flows, session tokens are stored in hardware-backed secure storage, and the authentication paths that phishing campaigns rely on stay tamper-resistant after launch. You cannot stop an attacker from sending the message, but you can make every action they are pushing the victim toward unreachable.
The takeaway
AI-generated phishing has eliminated the quality gap between a casual mass-email and a targeted executive attack. The defence is not better spam filters — it is hardening every in-app action an attacker might direct a victim toward, and scanning those flows before they ship.
Scan your app free
