Generative AI put to work for phishing

For a long time, a spelling mistake or an awkward phrase was enough to unmask a phishing e-mail. That marker is fading fast: generative AI tools now write flawless, personalized messages, sometimes paired with convincing fake documents. Here's what that actually changes, and why it shifts the analytical work toward infrastructure rather than text.

The gradual disappearance of obvious mistakes

A language model writes grammatically correct English (or any language) by default, with no particular effort from the scammer. The old tell-tale signs — clunky machine translation, odd phrasing, agreement errors — become less and less reliable. It's not that these signals have vanished everywhere: the sloppiest campaigns still exist. But they can no longer be relied on as a primary criterion.

Personalized messages thanks to OSINT

OSINT (Open Source Intelligence) refers to gathering information that's already public: a LinkedIn profile showing a job title and a company, a press release mentioning an ongoing project, a social network revealing habits. Cross-referenced with generative AI, this information makes it possible to write a message that cites the right name, the right department, sometimes the name of a real colleague — without any data breach needed, just automated public research at scale.

Fake documents on an assembly line

Invoice, ID card, bank statement, contract: the same tools can generate visually convincing documents, tailored to a targeted company's visual identity. Combined with a personalized e-mail, they reinforce the overall credibility without any step requiring particular design skill.

Automatic adaptation of campaigns

Beyond the initial message, some tools allow a campaign to be adjusted on the fly: rewording a message that gets few clicks, adapting the tone to the targeted industry, generating variants so that one text, once detected, doesn't become the signature of the whole campaign.

Why analyzing content alone is becoming insufficient

If a message has no mistakes left, a perfectly calibrated tone and a convincing fake document, looking for a clue in the text becomes a less and less reliable bet. A busy reader, even a savvy one, can legitimately spot nothing unusual on a quick read. Continuing to rely only on a message's style means dropping your guard exactly where the scammer has invested the most.

Infrastructure, on the other hand, stays hard to hide

An AI can generate perfect text, but it can't erase the technical traces that exist independently of the message: the real age of the domain name, the identity of the host, the sending server's IP address, or the content of the headers (see how to pick them apart). These elements don't depend on the message's writing quality: they belong to a completely different layer, one that generative AI doesn't touch.

This is a shift in balance rather than something entirely new: technical infrastructure analysis has always been the most reliable way to act, even back in the days of poorly written messages. It simply becomes essential today, where it was just a good complementary practice yesterday.

From a suspicious message to a report

Faced with a message that seems too well written to be honest, the question to ask is no longer "does the wording sound off?" but "where does this message actually come from, and where does it lead?": which IP sent the e-mail, which domain hosts the link, who can act on it. It's this journey, from the message to the infrastructure and then to the report, that the anatomy of an actionable report covers.

Baitback starts from this principle: rather than judging a message on its style, the tool analyzes its infrastructure directly — the e-mail, its headers, its links — to find who can actually act, regardless of how good the text is.