TL;DR: 38% of surveyed U.S. consumers had already used generative AI for online shopping and 52% planned to do so in 2026, according to BrandShield and Adobe Digital Insights, which means phishing protection must now cover AI-generated recommendations as well as emails and fake websites. Detection has to move to external discovery, campaign clustering, and takedown before customers trust a malicious source.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on BrandShield's report: AI-assisted shopping is expanding the discovery path for phishing, so malicious sites can surface through recommendations as well as search and email.
Why it matters: Phishing teams now have to protect brand discovery across AI assistants, ads, marketplaces, domains and social channels because the trust decision can happen before a user reaches a site.
By the numbers:
- 38% of surveyed U.S. consumers had already used generative AI for online shopping.
- 52% said they planned to use generative AI for online shopping in 2026.
Context
Phishing protection is the practice of detecting and removing attempts to impersonate trusted brands, but that control model was built around email, search and obvious fake sites. AI assistants now change the discovery path, so organisations need visibility into where malicious sources appear before users decide to trust them.
The governance gap is not the existence of phishing itself. It is the assumption that customers will encounter a suspicious source only after they search or open email, when in reality AI-generated recommendations can surface a fraudulent site earlier in the journey.
Key questions
Q: How do phishing sites appear in AI search results?
A: Phishing sites can appear when an AI assistant retrieves or summarises public web content that looks relevant to a user’s request. The risk is not that the model is broken by default, but that malicious pages already exist in the discovery environment the assistant uses. Security teams need to monitor those external sources and remove fraudulent assets before they are presented as trustworthy.
Q: Why do generative AI tools make phishing and password attacks more effective?
A: Generative AI lowers the cost of producing believable lures at volume. Attackers can rapidly generate tailored messages, mimic a colleague’s writing style, and produce plausible password guesses, which increases both reach and credibility. That combination makes manual review harder and raises the chance that a user or authentication control will accept a malicious request.
Q: What is the best way to investigate a phishing campaign across domains?
A: Investigate it by correlating email headers, sender infrastructure, URLs, certificates, DNS, hosting, and web content, then cluster related domains by shared registration data, redirect chains, and reused assets. Preserve evidence and pivot from one indicator to the next, so you can map the campaign, identify infrastructure reuse, and feed blocking rules, mailbox protections, and domain takedown requests.
Q: When should teams prioritise takedown over detection alerts?
A: Prioritise takedown when the campaign is active, the infrastructure is reusable, and the same domain or host is serving many victims, because removing it can stop delivery faster than alerts alone. Detection alerts should lead when you need immediate containment, but takedown is the stronger option when an exposed phishing site, redirector, or malicious mailbox remains reachable.
Technical breakdown
Why AI-assisted discovery changes phishing exposure
AI assistants do not need to be compromised for phishing risk to increase. They can retrieve, summarise or surface sources that already exist in the public web and external ecosystem, which means a malicious domain can enter the customer decision path if it looks relevant enough to the prompt. That shifts the problem from blocking delivery to governing discovery. A fake store, clone site or impersonation page can be effective even when it is technically ordinary because the trust transfer happens through the answer layer, not the page itself. See the Phishing Guide.
Practical implication: Treat AI search and answer surfaces as part of external threat monitoring, not as a separate communications channel.
How scammers scale credible phishing content with generative AI
Generative AI lowers the cost of producing polished scam content by accelerating copywriting, localisation, image generation and page variation. The attacker no longer needs a unique manual build for every market or language, so one campaign can spawn many lookalike properties with small differences. That makes content-based detection weaker and increases the value of infrastructure and campaign-level analysis. The important signal is often not the page text alone but the relationships among domains, ads, accounts, images and hosting patterns.
Practical implication: Hunt for shared infrastructure and reused assets rather than relying on page-level indicators alone.
Why campaign clustering beats single-URL takedowns
A phishing operation often behaves like a network of related assets rather than one fixed URL. Domains can rotate, advertisements can reappear, and social profiles can be replaced faster than teams can process individual tickets. Clustering links between sites, registration data, analytics identifiers and content patterns turns isolated alerts into a campaign view. That is the difference between removing one instance and disrupting the operation behind it.
Practical implication: Prioritise connected campaign analysis so takedown work targets the operator, not just the latest domain.
Threat narrative
Attacker objective: The attacker wants to steal credentials, payment data or personal information while hiding behind a trusted brand.
- Entry begins when a customer discovers a malicious store, cloned website or impersonation page through search, social ads or an AI-generated recommendation.
- Credential_harvested occurs when the victim trusts the source and enters login details, payment data or personal information into the fake site.
- Impact follows when the attacker uses stolen credentials or payment information for fraud, account compromise or wider brand abuse.
Breaches seen in the wild
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Phishing is becoming a discovery problem, not just a delivery problem. The control boundary has moved upstream into the places where users first encounter brands, products and offers. If the malicious source is surfaced by search, social channels or AI assistants before the victim visits the site, then inbox filtering alone cannot govern exposure. Organisations need visibility into the external environment that shapes trust decisions, not just into messages that arrive in corporate mailboxes.
AI recommendations create a new trust transfer layer for attackers. The user often treats an AI-generated answer as pre-vetted, which shortens the time spent checking the domain, seller or account behind it. That creates a practical governance gap around external discovery paths, and it is why social engineering controls now matter beyond classic phishing hygiene. The implication is clear: security teams must monitor where trust is formed, not only where fraud is delivered.
External phishing now behaves like brand abuse infrastructure. A single malicious store can connect to ads, clones, accounts and support pages, so treating each artefact as a separate issue misses the campaign. The named concept here is AI-assisted phishing discovery: fraudulent sources that gain credibility because AI systems place them in front of users. Practitioner takeaway: prioritise the campaign, not the individual URL.
Detection without enforcement leaves the attacker in control of the customer journey. Once a fraudulent site is live, the organisation must validate, cluster and remove it quickly or the recommendation layer keeps distributing risk. That means external takedown processes now sit alongside internal incident response. The practical conclusion is that phishing governance must measure time-to-disruption, not just time-to-detection.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Phishing Guide
What this signals
AI-assisted phishing discovery will force security teams to treat recommendation surfaces as part of the external attack surface. The practical issue is not whether every AI answer is unsafe, but whether a fraudulent source can be surfaced before a user has a chance to verify it.
Brand monitoring will need to move from single-domain watchlists to campaign-level disruption. That means linking content, infrastructure and discovery channels so takedown decisions are based on exposure, not just on whether a page looks suspicious.
Security programmes that already track social engineering should extend that model to AI assistants and other discovery layers. The control question shifts from 'can we detect a fake site' to 'can we remove it before it becomes the trusted answer.'
For practitioners
- Expand external monitoring to AI discovery paths Track how brand, product and store pages appear in AI-generated responses as well as in search, social media, marketplaces and ads.
- Cluster related phishing assets into campaigns Correlate domains, page copies, hosting patterns, analytics identifiers and account reuse to identify one operator behind many assets.
- Prioritise active exposure over dormant lookalikes Escalate phishing pages that users can currently reach or that appear in AI recommendations before older, inactive clones.
- Build a takedown workflow for external threats Define who validates, who escalates and who initiates removal when a malicious site or impersonation asset is confirmed.
- Add AI platform visibility to phishing metrics Measure how often risky sources surface in AI assistants and how quickly those references are removed or suppressed.
Key takeaways
- Phishing protection now has to account for AI-assisted discovery, because fraudulent sites can reach users through recommendation surfaces as well as email and search.
- The scale problem is operational, not just technical, since attackers can generate many credible variants and link them into one campaign.
- Effective defence depends on external monitoring, campaign correlation and fast takedown, not on treating each malicious URL as an isolated alert.
Related NHI Mgmt Group resources: Phishing Guide · Social Engineering Guide · AI-Driven Account Takeover Guide · Mailchimp breach 2022
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001; TA0006 — Initial Access; Credential Access | Phishing and credential theft are the core adversary behaviours behind AI-assisted discovery fraud. |
| Recommendation — Map phishing paths to initial access and credential access techniques, then hunt for exposed brand impersonation assets. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Continuous monitoring fits external phishing assets that appear across domains, ads and AI discovery surfaces. |
| Recommendation — Extend anomaly monitoring to external brand surfaces and AI discovery channels so new fraud assets are detected early. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | The article broadens phishing control beyond email into web and discovery surfaces, which aligns with CIS-9. |
| Recommendation — Pair email protection with web and discovery monitoring so fraudulent sites are found outside the inbox. | ||
| OWASP API Security Top 10 | API9 — Improper Inventory Management | AI discovery adds unmanaged external surfaces and sources that organisations must inventory to control exposure. |
| Recommendation — Inventory every external brand surface, including AI discovery sources, so fraudulent references are not missed. | ||
Key terms
- Phishing: Phishing is a deceptive message or website designed to trick a person into revealing credentials or other sensitive information. In identity terms, it is an unauthorised collection method that turns human trust into downstream account access and potential privilege abuse.
- Lookalike Domain: A lookalike domain is a web address designed to resemble a trusted brand closely enough to trick users into believing it is legitimate. In identity attacks, the domain becomes part of the deception layer, letting attackers capture credentials, identity details, or payments through a counterfeit flow.
- Brand Impersonation: Brand impersonation is the use of a company’s name, logo, or identity cues to deceive people into trusting a fake message, site, account, or service. In security terms, it is a social engineering and fraud tactic that exploits trusted brand signals to steal credentials, secrets, payments, or access.
- Threat Clustering: Threat clustering is a SOC method for grouping alerts that stem from the same underlying malicious activity. Instead of handling each alert in isolation, analysts review one cluster with shared context, which helps them understand scope, reduce duplication, and move faster from detection to investigation and mitigation.
Deepen your knowledge
The NHI Foundation Level course covers NHI governance, human identity, secrets management and workload identity in a way that helps security teams connect access controls to broader trust decisions. It is useful for practitioners who need a common governance language across identity, fraud and security operations.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org