Phishing: the cat-and-mouse game between researchers and attackers

Researchers around the world design algorithms capable of analyzing millions of emails. Yet a mundane, well-written message that arrives at the right moment can still fool someone. Why, despite all this technology, does a simple email still work? A look inside a race that never ends.

The paradox: we know how to detect traps… so why do they still work?

The scenario is simple. An email arrives. It seems to come from the bank, the boss, a friend or a well-known service. It is perfectly written, believable, and lands at exactly the right moment. If algorithms can sift through millions of messages, how did this one slip through the net?

Part of the answer lies in the field, far from the labs:

• researchers work with cutting-edge technology, but many companies and public bodies have to make do with old infrastructure;
• some mail servers are configured with the bare minimum;
• detection tools are not always connected to each other;
• and above all, someone has to monitor, update and interpret the alerts. A tool nobody looks at doesn't protect much.

The “bare” server: a sorting center that doesn't read the letters

A mail server is a bit like a post office sorting center: it knows how to receive letters, sort them and forward them to the right address. But without extra tools, it cannot recognize a booby-trapped letter. It moves the mail, that's all. (The full journey of an email is told in the guide How an email travels from sender to recipient.)

These “sorting centers” have names like Postfix, Sendmail or Exim. To make them smarter, specialized assistants are added:

• Amavis acts as a dispatcher: it runs each message past an antivirus and an anti-spam filter;
• SpamAssassin or Rspamd give the message a suspicion score based on hundreds of clues: content, links, reputation of the sending server, SPF, DKIM and DMARC results…

Without these assistants, and without someone to tune them, the server stays “bare”: it delivers everything it is given.

Researchers build digital detectives

Let's move from the problem to the solutions. In the labs, detection has changed a lot: it is no longer just about looking for forbidden words.

1. AI learns to read between the lines

The question used to be: “Does the message contain the word money?” Today, thanks to natural language processing (NLP) and artificial intelligence, the questions sound more like those of an investigator:

• Why is this person writing like this?
• Why are they asking for this action, right now?
• Does this message match the habits of its real sender?

The detector no longer looks only at words, but at context: tone, urgency, consistency with previous messages.

2. Spotting unusual behavior

An employee never sends payment requests. Suddenly, at 3:17 a.m., an urgent request leaves their account, from a connection on the other side of the world. A simple bug… or someone who has just taken over the account?

This is behavioral analysis: the system learns what is “normal” for a person or a service, then flags what deviates from it. The advantage is huge: even a perfectly written message can betray abnormal behavior.

3. Letting machines click for us

A link looks perfectly normal? No way a human should take the risk. A machine opens it in an isolated environment, a sandbox, and watches:

• where does it lead, after all the redirects?
• what does it load?
• is it trying to steal credentials?
• does it download anything suspicious?

Attackers know this, of course: some put a “bouncer” in front of their trap page so that robots only see a harmless page. This trick is explained in the guide Phishing: how scammers get their emails through. For its part, Baitback follows the redirects of an email's links and shows each step, so you can see where they really lead without clicking.

But attackers got the message: sometimes you just have to hack our brain

Here is the paradox: the smarter machines become, the more human attacks become.

A filter is quite good at spotting a suspicious link or a booby-trapped attachment. It is much harder to detect this:

Hi Paul, it's your director. I'm in a meeting
and can't call. Can you make this transfer
before 4 p.m.? It's urgent, I'm counting on you.

This message may have no virus, no link, no spelling mistake, no suspicious word. And yet it can be very expensive: this is the principle of CEO fraud (also called business email compromise). Everything relies on authority, urgency and secrecy. Technically, nothing looks like an attack.

AI versus AI… and human versus human

Researchers improve their detectors. Attackers improve their messages. And generative AI gives them a serious helping hand: it can help produce texts that are more believable, more personalized, free of mistakes, and tailored to each target's job and language.

Research must therefore answer an increasingly difficult question: how do you recognize an attack that looks exactly like a real message? The approaches combine several signals rather than one: the text, the sender's behavior, the reputation of the servers, where the links end up… and user reports.

And what about us?

Detectors learn from examples. Every reported phishing email is one more example: it helps filters recognize the next wave, and it makes it possible to shut down the server that sent it. Reporting is not a pointless gesture: it feeds the cat.

That is the idea behind Baitback: paste a suspicious email, automatically find the sending server and its hosting provider, then send a clear report to the right place in a few clicks.

The real problem may not be email

In the end, email is just a way in. Behind it are algorithms, servers, researchers, attackers… and above all, people. That is what makes cybersecurity so special: every time a technology learns to recognize a trap, someone tries to invent a trap it doesn't know yet.

And when the trick targets people directly, the consequences can be spectacular. Four true stories show it in the guide When a simple message brings down giants.