Researchers at the University of Texas at Arlington have shown that AI can harvest public social‑media posts and create convincing phishing emails.
AI Phishing Leverages Public Posts
They examined 200 public Instagram accounts and found that ten posts per user provide enough data to craft a targeted message.
In tests of over 18,000 AI‑generated emails, participants rated the messages more trustworthy than traditional phishing attempts.
Scammers extract travel photos, concert tickets or event check‑ins from a public profile, then feed the details into an AI model that writes a personalized email referencing the exact trip.
For example, a recent Brazil vacation can trigger a fake hotel discount, while a concert announcement may include a bogus ticket upgrade link.
Because the content matches recent experiences, the email feels legitimate and bypasses typical warning signs such as spelling errors.
AI Safety Tools Fall Short
The study evaluated three AI safety filters—Llama Guard, ShieldGemma and WildGuard—and found they blocked only 0% to 19% of phishing requests by default.
When researchers tuned the filters for context‑aware phishing, detection rose to 99% in lab tests, showing stronger safeguards are possible.
Practical Defenses
Set your social‑media accounts to private. Approve followers only.
Delay posting real‑time location updates. Wait until you are home before sharing vacation photos or event check‑ins.
Never click links in unexpected emails. Open the company’s website directly or use a verified phone number to confirm.
Install reputable antivirus software. Keep it updated and enable multifactor authentication on all important accounts.
Consider a personal data removal service. It can reduce exposed address, phone number and other details that scammers can harvest.
Use unique, strong passwords stored in a trusted manager. Enable passkeys where supported and never share verification codes.
Apply system and security updates promptly. Activate email provider’s phishing filters and report suspicious messages through the provider’s tool.
If You Click a Suspicious Link
Stop interacting immediately. Close the page and run a security scan with updated antivirus.
Change any passwords you entered. Review account activity for unfamiliar logins and enable multifactor authentication.
Contact your bank or credit‑card issuer right away if financial data was shared. File a report with the FTC at reportfraud.ftc.gov/.
Report phishing emails via your email provider to help protect others. Doing so helps protect other users.
Key Takeaway
AI enables criminals to exploit publicly shared moments and deliver personalized scams at scale, evading traditional detection.
This makes the attacks harder to spot.
Users should tighten privacy settings, verify unexpected messages, and maintain strong security hygiene to stay ahead of the threat.
Doing so reduces the chance of falling victim.
