AI Phishing Named

AI phishing named literacy covers LLM-crafted lures, personalization at scale, and detection signals — defender context on YOUR $AI_LAB notes, not crafting attacks against real victims.

AI Phishing Named• Audio Walkthrough

00:00/03:36

Visual · t32_ai_phishing_named

AI phishing literacy. $AI_LAB only. Original Cyberlium.

Same phish anatomy, faster drafting — literacy names AI-assisted phishing so you detect and defend, not generate lures against live targets.

AI-powered phishing uses LLMs to draft convincing emails, SMS, and voice scripts with personalization from OSINT — faster iteration and fewer grammar tells. Defender signals: generic urgency still present, suspicious links, mismatched sender domains, AI-typical phrasing clusters, and DMARC failures. Literacy names the threat class; students write detection cards, not live phish campaigns. Cyberlium maps AI phishing detection on YOUR $AI_LAB — fictional lure samples labeled training-only. Next: Deepfake Detection.

1. AI phishing traits (named, detect/defend)

Scale: many variants generated quickly. Personalization: OSINT names and roles woven in. Polish: fewer spelling errors — do not rely on grammar alone. Channels: email, SMS, voice scripts, social DMs.

On $AI_LAB, write detection card — four signals and one user reporting habit for fictional AI-phish sample.

Command guide

Try these commands — AI phishing traits (named, detect/defend)

═══ LINUX / macOS (Terminal Practice) ═══

Check system state and user context

Command — copy this

id
whoami
uname -a

Inspect network sockets listening for connections

Command — copy this

ss -tuln 2>/dev/null || netstat -tuln

Audit active processes

Command — copy this

ps aux | grep -v "\[" | head -15

═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information

Command — copy this

whoami /all
Get-ComputerInfo | Select-Object CsName, OsName, OsVersion

Primary tools to practice this lesson: grep, curl. Reference sites: CISA AI phishing (https://www.cisa.gov/ai); MITRE ATLAS (https://atlas.mitre.org/); OWASP LLM Top 10 (https://owasp.org/www-project-top-10-for-large-language-model-applications/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why detection beats 'AI writes bad grammar' heuristics

Modern LLM lures read fluently — defenders combine link analysis, sender auth (SPF/DKIM/DMARC), behavioral analytics, and user reporting. Security awareness must update: urgency and credential requests remain core tells.

Students analyze labeled fictional samples on lab notes — never send AI phish to real users or stranger inboxes.

3. Literacy ≠ live phish generation

Forbidden: generating phishing emails targeting real people, employers, or stranger accounts. Allowed: AI phishing named card — detection signals, defender playbook, fictional redacted sample on $AI_LAB.

Ship: AI phishing detection card for YOUR lab notes. Next: Deepfake Detection.

4. What you ship: AI phishing detection card for $AI_LAB

Four detection signals, reporting habit, fictional sample. $AI_LAB named. NO live phish. chmod 600.

5. What you record before the next lesson

Date. AI phishing card. $AI_LAB named. File t32-m05-l01-ai-phishing-named.txt chmod 600.

6. Wrong vs right: stranger SaaS vs YOUR toy LLM

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Generate phish email to real coworker 'for training.' Skip DMARC check in detection notes.
Right: Write AI phishing detection card for YOUR $AI_LAB. Next: Deepfake Detection.

Hands-on Exercise