Topic starter
09/07/2026 3:32 pm
TL;DR: AI-enhanced phishing is making credential theft more realistic, more frequent, and far cheaper to run, according to Bitwarden, with the FBI, Verizon, SlashNext, Hoxhunt, and Harvard Business Review all cited as evidence of the escalating problem. User awareness alone no longer matches the scale of deception, so identity controls must assume convincing, high-volume social engineering.
Editorial analysis by NHI Mgmt Group, based on content published by Bitwarden: “AI phishing attacks are on the rise — Are you prepared?”.
By the numbers:
- Phishing attacks have increased by 4151% since Chatgbt was released in 2022, according to Bitwarden.
- AI phishing campaigns are 24% more effective than traditional phishing campaigns operated by humans, according to Bitwarden.
- 60% of cybersecurity breaches are now caused by human error, according to Bitwarden.
Key questions
Q: How should teams reduce credential theft when phishing messages look authentic?
A: Treat trust as a control surface, not a user judgement call.
Q: Why do AI-generated email attacks increase identity risk?
A: AI-generated email attacks increase identity risk because they make malicious requests more convincing at the exact point where people decide whether to trust, approve, or act.
Q: What are the signs that phishing controls are failing in a financial services organization?
A: Warning signs include a rising share of urgent payment, compliance, or executive impersonation emails reaching users, repeated clicks on realistic messages, and suspicious access patterns after credential theft.
Practitioner guidance
- Strengthen recovery-path verification Require out-of-band confirmation for password resets, MFA changes, payment updates, and support requests that arrive through email, SMS, chat, or voice.
- Harden credential exposure points Use passkeys, phishing-resistant authentication, and trusted-site autofill to reduce the chance that a malicious page can capture reusable credentials.
- Add channel separation for high-risk requests Verify urgent requests through a second trusted channel before approving money movement, account changes, or sensitive data release.
Bottom line: AI-generated phishing is no longer mainly a content problem, because the real risk is that convincing deception reaches identity and payment workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:54 pm
AI-enhanced phishing is now an identity control problem, not just a user awareness problem. The article shows that AI can raise realism, volume, and affordability at the same time, which breaks the assumption that better training alone can keep pace. That matters because the target is often a credential, a payment action, or a recovery workflow, all of which sit inside IAM and fraud prevention. Practitioners should treat phishing as an identity governance issue with operational security consequences.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: What should teams do if a user already entered credentials on a phishing site?
A: Assume the account, recovery paths, and any linked sessions may be exposed. Revoke active sessions, reset credentials, review recent authentication events, and check whether the attacker can use the account to pivot into admin, finance, or support workflows. Containment should focus on stopping reuse of the stolen trust signal.
👉 Read our full editorial: AI-enhanced phishing is raising the cost of credential theft