Phishing 3.0: The Fight Moves to Agent Versus Agent
Summary: The article describes a third stage of phishing in which GenAI writes the lure, deepfakes carry it into voice and video, and an attacker agent researches, drafts, sends, and adapts on its own across email, collaboration tools, and live calls. It cites a 2026 Dark Reading poll in which 48% of security professionals ranked agentic AI as the top attack vector, and the Arup case, where a phishing email impersonating the UK-based CFO led to a deepfake video call and 15 transfers worth about $25 million.
Key Takeaway: IRONSCALES analysis of production email traffic cited here puts Microsoft 365 EOP at 293 missed phishing messages per 100 mailboxes every 30 days and Google Workspace at 350, so the volume reaching employees after the gateway is the number that matters. In the same Crogl and Ponemon study, SOCs reported 4,330 alerts a day and investigated just 37% of them, which is the gap an attacker's agent is built to widen.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026