Artificial intelligence is making spear phishing scams more effective, and most people cannot tell the difference between an AI-written lure and a human-written one. That is the core finding of new research from Brigham Young University, published in the peer-reviewed Journal of Cybersecurity and Privacy and highlighted in recent coverage by KSL.com and Phys.org.
"Our research is just the latest to show how sophisticated the current state of AI is," said Jerson Francia, a BYU cybersecurity researcher involved in the work, according to BYU's news release.
What the Researchers Did
The study, authored by a BYU team and available as a preprint on arXiv, set up a controlled comparison between personalized phishing text messages generated by GPT-4 and messages written by human novices — students writing under time constraints — for the same 25 targets.
Deltagarna fick var och en en uppsättning med 12 personliga meddelanden som skapats speciellt för dem. Some were AI-generated, some human-written. The researchers used a method they call TRAPD — the Threshold Ranking Approach for Personalized Deception — under which participants ranked the messages, indicated the point at which they would intend to click, explained their reasoning, and judged whether each message had been written by a person or by GPT-4.
Designen är viktig eftersom de flesta tidigare phishing-studier mätte utfall i abstrakt. Den här mätte svaren på meddelanden anpassade för varje enskild deltagare, vilket är exakt hur verkligt spjutfiske fungerar.
More Clicks, No Better Detection
The headline numbers: GPT-4-generated messages elicited an intention to click more often than student-authored messages — 28% versus 21% — although the researchers note that the difference carries statistical uncertainty given the pilot study's size.
Det mer oroande resultatet är vad deltagarna inte kunde göra. På frågan om ett meddelande var skrivet av en människa eller genererat av AI, identifierade mottagarna källan inte mer exakt än slumpen. In other words, the extra wariness people believe they apply to machine-written text did not show up in the results — study participants were essentially coin-flipping on authorship.
The study also found that context beats content: messages framed around job-related matters were significantly more likely to trigger an intention to click than messages tied to hobbies or social media. För angripare är det en kraftmultiplikator, eftersom anställningsuppgifter är bland de enklaste personliga uppgifterna att hitta online.
Varför jobbrelaterade lockelser fungerar bäst
Fyndet om arbetsrelaterade meddelanden förtjänar särskild uppmärksamhet från försvarare. Spear phishing succeeds through personalization — a message that references your employer, your role, or your current projects feels legitimate precisely because it is specific.
BYU-resultaten tyder på att stora språkmodeller komprimerar detta personaliseringsarbetsflöde dramatiskt. What once required hours of manual research and careful drafting by a skilled social engineer can now be approximated from simple prompts at near-zero marginal cost, the researchers write. Hindret för att driva en stor, personlig kampanj är inte längre skicklighet. Det är tillgång till en chatbot och en mållista.
Vad det betyder för försvarare
De praktiska konsekvenserna är nyktra för säkerhetsteam. Awareness training often teaches employees to spot awkward phrasing, odd tone, or unnatural language — tells that historically exposed phishing attempts. A detector that relies on spotting "robotic" writing is now measurably unreliable, since recipients in this study could not distinguish AI-written from human-written messages at all.
The BYU team frames the findings as evidence that accessible AI-assisted personalization may increase the practical scale of social-engineering threats. Försvar som antar att billigt, generiskt nätfiske förblir normen bygger på ett antagande som data inte längre stöder.
Forskarna betonar också studiens gränser. It was a 25-target pilot using SMS messages, with student authors rather than professional phishers — a comparison that, if anything, understates the gap between AI output and average real-world scam quality. The team notes that while human judges could not tell the sources apart, the two message sets remained computationally distinguishable, leaving room for automated detection approaches.
For organizations, the takeaway is procedural rather than technical: verify requests through separate channels, treat urgency and job-related framing as risk signals regardless of how polished the message reads, and assume that well-written no longer means human-written.
Ligg före AI
Tracking how AI is reshaping security and society? Read more AI news on AI Buzz Wire — independent AI coverage, every day.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
