AI › Module 5 › Lesson 1
AI Phishing Named
AI phishing named literacy covers LLM-crafted lures, personalization at scale, and detection signals — defender context on YOUR $AI_LAB notes, not crafting attacks against real victims.
Visual · t32_ai_phishing_named
AI phishing literacy. $AI_LAB only. Original Cyberlium.
Opening
Same phish anatomy, faster drafting — literacy names AI-assisted phishing so you detect and defend, not generate lures against live targets.
AI-powered phishing uses LLMs to draft convincing emails, SMS, and voice scripts with personalization from OSINT — faster iteration and fewer grammar tells. Defender signals: generic urgency still present, suspicious links, mismatched sender domains, AI-typical phrasing clusters, and DMARC failures. Literacy names the threat class; students write detection cards, not live phish campaigns. Cyberlium maps AI phishing detection on YOUR $AI_LAB — fictional lure samples labeled training-only. Next: Deepfake Detection.
1. AI phishing traits (named, detect/defend)
Scale: many variants generated quickly. Personalization: OSINT names and roles woven in. Polish: fewer spelling errors — do not rely on grammar alone. Channels: email, SMS, voice scripts, social DMs.
On $AI_LAB, write detection card — four signals and one user reporting habit for fictional AI-phish sample.
Command guide
Try these commands — AI phishing traits (named, detect/defend)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA AI phishing — https://www.cisa.gov/ai (AI-enabled social engineering literacy) MITRE ATLAS — https://atlas.mitre.org/ OWASP LLM Top 10 — https://owasp.org/www-project-top-10-for-large-language-model-applications/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export AI_LAB=${AI_LAB:-$HOME/cyberlium-lab/t32-ai}
cat > "$AI_LAB/threats/ai-phishing-detection-signals.md" <<'EOF'
# AI-Phishing Detection Signals (literacy — no payloads)
- Unusual urgency + payment/wire transfer requests
- Slight domain typosquats; SPF/DKIM/DMARC failures
- LLM-polished grammar but inconsistent sender history
- Voice clone callbacks: verify via known number out-of-band
- Deep link to OAuth consent phishing (not malware attachments)
Document signals for YOUR SOC notes — never craft fraud campaigns
EOFCommand — copy this
grep -E 'Detection Signals|never craft' "$AI_LAB/threats/ai-phishing-detection-signals.md" curl -sS https://www.cisa.gov/ai | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: CISA AI phishing (https://www.cisa.gov/ai); MITRE ATLAS (https://atlas.mitre.org/); OWASP LLM Top 10 (https://owasp.org/www-project-top-10-for-large-language-model-applications/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why detection beats 'AI writes bad grammar' heuristics
Modern LLM lures read fluently — defenders combine link analysis, sender auth (SPF/DKIM/DMARC), behavioral analytics, and user reporting. Security awareness must update: urgency and credential requests remain core tells.
Students analyze labeled fictional samples on lab notes — never send AI phish to real users or stranger inboxes.
3. Literacy ≠ live phish generation
Forbidden: generating phishing emails targeting real people, employers, or stranger accounts. Allowed: AI phishing named card — detection signals, defender playbook, fictional redacted sample on $AI_LAB.
Ship: AI phishing detection card for YOUR lab notes. Next: Deepfake Detection.
4. What you ship: AI phishing detection card for $AI_LAB
Four detection signals, reporting habit, fictional sample. $AI_LAB named. NO live phish. chmod 600.
5. What you record before the next lesson
Date. AI phishing card. $AI_LAB named. File t32-m05-l01-ai-phishing-named.txt chmod 600.
6. Wrong vs right: stranger SaaS vs YOUR toy LLM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Generate phish email to real coworker 'for training.' Skip DMARC check in detection notes.
Right
Write AI phishing detection card for YOUR $AI_LAB. Next: Deepfake Detection.
Mission: write AI phishing detection on YOUR lab
1) List four detection signals. 2) Write user reporting habit. 3) Analyze one fictional redacted sample. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Urgency plus credential request beats debating whether grammar looks AI-written.
Knowledge Check
APPLY: AI phishing on Cyberlium is taught as:
Multiple choice
Knowledge Check
APPLY: True or False: Fluent grammar alone is unreliable for detecting AI-crafted phish.
True or False
Knowledge Check
APPLY: AI phishing literacy avoids:
Multiple choice