Hackers using AI to generate phishing emails at scale, says Kaseya

Hackers used AI to generate phishing emails almost by default in 2025, with more than 83% of phishing emails containing AI-generated content and generating more click rates than standard malicious emails.

 

Leading IT management and cyber security services company Kaseya said in its 2026 INKY Email Security Report that the use of AI to generate phishing emails has reached astronomic proportions, with 2025 serving as an inflection point where phishing emails were generated using AI almost by default.

 

Artificial intelligence has enabled cyber criminals to generate effective phishing emails at scale that enjoy a greater success rate compared to standard malicious emails, and this has made it the go-to technology for cyber criminals looking to use phishing as a vector to infiltrate networks, deploy malware, steal sensitive data and obtain payment card details.

 

"In the past year, AI-generated phishing became the baseline," said Dave Baggett, SVP of Security Suite, Kaseya. "Attackers can now produce highly convincing messages at scale, which means the traditional signals security tools relied on for years—bad grammar, suspicious domains, obvious links—are disappearing. Defenders now have to evaluate intent and context, not just indicators."

 

Kaseya found that 26% of all cyber crime complaints filed with the FBI are now phishing-related and phishing attacks accounted for $2.8 billion in losses through business email compromises, indicating that phishing remains the primary attack vector for cyber criminals.

 

The company found that in 2025, hackers used AI to generate phishing emails that impersonated 281 brands. These included as many as 6.7 billion brand impersonation emails in the second half of 2025, 5.3 billion of which impersonated 25 top known brand names.

 

AI-generated phishing emails now closely resemble legitimate emails from top financial institutions and retail brands, building trust among unsuspecting victims. In 2025, AI-generated phishing emails enjoyed a 54% click rate compared to standard malicious emails that could only garner a 12% click rate.

 

"These figures reflect a broader shift toward social engineering-driven fraud – scams that exploit urgency, fear and trust rather than technical vulnerabilities. Many of these schemes begin or are supported by phishing-based email campaigns," Kaseya said.