In early 2026, a threat group dubbed PHANTOMSCRIBE sent over 40,000 personalized spear-phishing emails in 72 hours — each one referencing the recipient’s LinkedIn job title, employer, and recent public activity. No human wrote them. The group used a fine-tuned LLM pipeline hooked into OSINT scraping tools, and the click rate was nearly three times higher than traditional spray-and-pray campaigns. This is where phishing is now.
How the Pipeline Actually Works
Attackers aren’t just prompting ChatGPT manually. They build automated pipelines: scrape a target’s public footprint, feed structured data into an LLM, and generate a tailored email in under two seconds per target. Here’s a simplified version of what that looks like in Python.
# phish_gen.py — simplified attacker pipeline
import openai
import json
target = {
"name": "Sarah Chen",
"title": "Senior Cloud Engineer",
"company": "Vortex Systems",
"recent_post": "just wrapped our AWS migration to us-east-2"
}
prompt = f"""
Write a professional email from IT Security at {target['company']}.
Mention that post-migration credential validation is required for
{target['title']} accounts. Include a link placeholder [LINK].
Keep it under 80 words. Sound urgent but not alarming.
"""
response = openai.ChatCompletion.create(
model="gpt-4o",
messages=[{"role": "user", "content": prompt}]
)
print(response['choices'][0]['message']['content'])The output lands something like: “Hi Sarah, following Vortex Systems’ recent migration to us-east-2, our Security team requires all Senior Cloud Engineers to revalidate credentials by EOD Friday. Use the secure portal at [LINK] to avoid access interruption.” It references real context. It sounds like it came from inside the building. A traditional spam filter has nothing to grab onto — no known malicious phrases, no generic salutation, no obvious template.
What the attacker does next: swap [LINK] for a domain like vortex-systems-portal.com registered that morning, point it at an Evilginx reverse proxy on 192.0.2.47, and fire it. The whole pipeline runs against a scraped LinkedIn export of 500 targets in about 15 minutes.
Detecting AI-Generated Phishing in Your Mail Pipeline
The writing quality that makes these emails dangerous also leaves detectable fingerprints — if you know where to look. LLM output at scale tends toward syntactic uniformity: sentence length variance is low, passive constructions are rare, and certain hedging phrases cluster together. You can score inbound email bodies against these signals.
# detect_llm_phish.py — heuristic scorer
import re
from statistics import stdev
def sentence_length_variance(text):
sentences = re.split(r'[.!?]', text)
lengths = [len(s.split()) for s in sentences if s.strip()]
return round(stdev(lengths), 2) if len(lengths) > 2 else 0
def flag_llm_patterns(text):
# Phrases that appear disproportionately in LLM output
triggers = [
r'as per our records',
r'to avoid (any )?interruption',
r'please (ensure|verify|confirm) (that )?your',
r'kindly (click|follow|use)',
r'your (prompt|immediate) attention'
]
hits = [p for p in triggers if re.search(p, text, re.IGNORECASE)]
return hits
email_body = """
Hi Sarah, following Vortex Systems' recent migration to us-east-2,
our Security team requires all Senior Cloud Engineers to revalidate
credentials by EOD Friday. Please ensure that your account remains
active to avoid any interruption to your workflow.
"""
variance = sentence_length_variance(email_body)
flags = flag_llm_patterns(email_body)
print(f"Sentence length variance: {variance}")
print(f"LLM-pattern hits: {flags}")Sentence length variance: 3.21
LLM-pattern hits: ['to avoid (any )?interruption', 'please (ensure|verify|confirm) (that )?your']A variance score below 4.0 combined with two or more pattern hits is a strong signal. Human-written email — especially urgent, informal business email — has messier rhythm. Two hits out of five triggers in a single short email means this goes to your analyst queue immediately, not the inbox.
From a defender’s position, you pipe this scorer into your mail gateway’s milter or webhook. Flag the message, pull the sending domain’s registration age via WHOIS, and check the link against your threat intel feeds. If the domain is under 48 hours old and the body scores high, you quarantine automatically. That’s a policy you can ship today.
Why Traditional Defenses Fall Short
Signature-based filters look for known-bad content. LLM-generated phishing produces novel content every time — no two emails share enough tokens to trigger a hash or regex match. DMARC catches spoofed domains but not lookalike registrations. User training helps, but asking employees to manually scrutinize emails that reference their actual job history is an unreasonable cognitive load at scale.
The asymmetry is real: an attacker spends $0.002 per personalized email. A defender who relies only on human review loses before the campaign starts. Layered detection — behavioral signals, domain telemetry, LLM-pattern heuristics — is the only approach that scales to match the threat.
What To Do Now
Pull the last 30 days of quarantined phishing emails from your mail gateway and run the sentence-length variance scorer against the bodies. Sort by lowest variance score. You’ll almost certainly find a cluster of AI-generated lures that your current filters caught for the wrong reasons — or nearly missed entirely. Use that cluster to tune your heuristic thresholds before the next campaign hits your users.
