How Attackers Use LLMs to Automate Phishing at Scale

In March 2026, a mid-sized logistics firm lost $2.1 million after employees received hyper-personalized spear-phishing emails that referenced real internal project names, their managers’ writing styles, and accurate org-chart details — all generated in bulk by an LLM pipeline running against scraped LinkedIn data. This wasn’t a nation-state op. It was a criminal crew with a Python script and an API key.

LLMs didn’t invent phishing. They industrialized it. Here’s what that pipeline actually looks like — and what you can catch.

Stage 1: Scraping Context, Feeding the Model

The first step is data enrichment. Attackers pull public data — LinkedIn profiles, company blogs, GitHub commit histories, press releases — and feed it as context into an LLM prompt. The model then writes a tailored lure for each target.

A simplified version of that pipeline looks like this:

# target_enrichment.py
import requests, openai

targets = [
    {"name": "Dana Okafor", "title": "Senior DevOps Engineer", "company": "NovaTrans Logistics",
     "recent_post": "Just wrapped our Kubernetes migration to AWS EKS. Smooth sailing!"},
    {"name": "Marco Reyes", "title": "Finance Controller", "company": "NovaTrans Logistics",
     "recent_post": "Q2 close was brutal this year. Ready for Q3."},
]

def generate_lure(target):
    prompt = f"""
    Write a professional email to {target['name']}, a {target['title']} at {target['company']}.
    Reference this context naturally: "{target['recent_post']}"
    The email is from IT Security, asking them to verify their credentials
    at https://portal-novatrans-secure.192.0.2.47.workers.dev before 5 PM today.
    Tone: urgent but calm. Under 120 words.
    """
    response = openai.chat.completions.create(
        model="gpt-4o",
        messages=[{"role": "user", "content": prompt}]
    )
    return response.choices[0].message.content

for t in targets:
    print(f"--- Email for {t['name']} ---")
    print(generate_lure(t))
    print()

The output for Dana Okafor might read: “Hi Dana — great work on the EKS migration. As part of our post-migration security sweep, IT requires all engineers to re-verify credentials by 5 PM. Click here: https://portal-novatrans-secure.192.0.2.47.workers.dev”. That URL is a Cloudflare Worker proxying a credential harvester. The email passes a casual read because it sounds like it knows Dana.

At scale, this loop runs against hundreds of targets in minutes. Each email is unique — evading signature-based filters trained on repeated strings. The attacker’s cost per lure drops to fractions of a cent.

Stage 2: Infrastructure That Blends In

The lure is only half the attack. The phishing domain needs to survive long enough to harvest credentials. Attackers now use LLMs to generate convincing HTML login clones on demand, then host them on legitimate cloud infrastructure to abuse trust.

Here’s what hunting for these pages looks like from the defender’s side, using httpx (a fast HTTP toolkit) against a list of suspicious domains flagged by your DNS logs:

# domains_to_check.txt
portal-novatrans-secure.192.0.2.47.workers.dev
auth-novatrans-it.192.0.2.83.pages.dev
novatrans-vpn-verify.192.0.2.12.netlify.app

$ cat domains_to_check.txt | httpx -title -status-code -content-length -tech-detect -silent

https://portal-novatrans-secure.192.0.2.47.workers.dev [200] [NovaTrans — Secure Login] [12847] [Cloudflare,React]
https://auth-novatrans-it.192.0.2.83.pages.dev       [200] [NovaTrans IT Portal]      [11203] [Cloudflare,Vue]
https://novatrans-vpn-verify.192.0.2.12.netlify.app  [403] [Forbidden]                [148]   [Netlify]

Two pages are live and rendering React/Vue login clones. The content-length values (~11–13 KB) match typical SPA credential-harvesting kits. The third is dead — probably taken down or misconfigured. A defender’s next move: pull the page source, extract form action URLs, and submit IOCs to your threat intel platform. Also check those domains against URLScan.io and PhishTank — LLM-generated pages often share structural fingerprints even when text varies.

Attackers hosting on workers.dev or pages.dev are deliberately abusing Cloudflare’s trusted reputation to slip past category-based web filters. Many enterprise proxies whitelist *.workers.dev by default. Audit yours.

What Defenders Should Do Differently

Traditional phishing detection looks for known bad domains and repeated strings. LLM-generated campaigns break both assumptions. You need detection that looks at behavior and structure, not just content.

• Flag anomalous login page structure: Phishing kits often POST credentials to an external endpoint. Scan harvested URLs for form actions pointing off-domain.
• Monitor DNS for lookalike registrations: Tools like dnstwist generate permutations of your domain and check if they’re registered. Run it weekly.
• Deploy email header analysis: LLM lures still travel through infrastructure. Check SPF/DKIM/DMARC alignment. A convincing email from a misaligned domain is still a red flag.
• Train on context, not just spelling: Old phishing awareness training taught people to spot typos. Modern lures are grammatically perfect. Retrain your users to distrust urgency — not just bad grammar.

Signal to watch: An employee receives an email referencing a project that was only discussed in a Slack channel or internal doc. That’s not a coincidence — it means data was exfiltrated or scraped from a public source the team forgot about.

Try This Right Now

Run dnstwist against your primary domain today. Install it with pip install dnstwist, then run:

$ dnstwist --registered --format json yourcompany.com | python3 -m json.tool | grep -E '"domain"|"dns_a"'

Any registered lookalike domain that resolves to an IP is a live threat. Take the list, check each in URLScan.io, and submit confirmed phishing pages to Google Safe Browsing and your email gateway vendor immediately. It takes twenty minutes. Do it before an LLM-generated email does it for the attacker.