Modern generative AI models can automatically collect information about individuals from publicly available sources and use it to create highly personalized phishing messages. This is the conclusion of the study "Context-Aware Spear Phishing: Generative AI-Enabled Attacks Against Individuals via Public Social Media Data" (2026).
The researchers found that AI needs to analyze only five or six social media posts to build a detailed profile of a potential victim. Based on this information, it can identify a person's interests, social connections, frequently visited places, important life events, and even emotional state before generating a highly convincing phishing message.
According to the study, these messages can be disguised as invitations to events, messages from employers, service notifications, dating requests, delivery updates, concert ticket offers, or urgent account verification requests.
During the experiment, participants trusted AI-generated phishing messages more often than traditional phishing emails written by humans. To evaluate the effectiveness of the attacks, the researchers used data from the Anti-Phishing Working Group (APWG), an international organization that collects information on phishing campaigns.
The authors conclude that modern generative AI models are capable of automatically collecting publicly available user information and using it to create highly personalized phishing messages that appear more convincing to recipients.
Source:
