From obvious scams to sophisticated attacks

Remember those laughably bad phishing emails from the early 2000s? The ones riddled with typos, claiming you'd inherited millions from distant relatives, or offering miracle weight loss solutions? Those amateur-hour attempts were easy to spot and dismiss, and delete.

Back then, phishing emails were usually filled with broken English, pixelated logos, and outrageous promises. They cast wide nets, hoping to catch the most vulnerable users. While some people fell for these obvious scams, most recipients could clock them a mile away.

Today's modern phishing tactics

Fast-forward to today, and the phishing landscape has transformed dramatically. Cybercriminals now use AI-powered tools to craft grammatically perfect emails that mirror legitimate communications. They study company communication styles, replicate exact formatting, and even time their attacks to coincide with regular business activities. In our 2026 Cyber Threat Report, infostealers made up 24% of all incidents we saw and malicious scripts another 22%—two categories that often show up after a successful phish, when attackers steal credentials or drop automation-friendly tooling.

Modern phishing attempts often target specific individuals or organizations (known as spear phishing). Attackers research their victims on social media, company websites, and professional networks to create highly personalized messages. They might reference recent company news, mutual connections, or industry-specific words and phrases to build credibility.

These sophisticated attacks can fool even the most savvy internet users. The key difference lies in the details—subtle inconsistencies that become apparent when you know what to look for.

Beyond email – new phishing channels

Phishing has expanded beyond traditional email to include multiple attack vectors. QR code phishing (or "quishing") has surged in popularity, with attackers embedding malicious links in seemingly innocent QR codes. Victims scan the code expecting legitimate content but land on credential-stealing websites. Quishing is especially dangerous because QR codes often slip past secure email gateways—they look like harmless images until they’re decoded into a malicious URL.

SMS phishing, or "smishing," targets mobile users with fake text messages claiming urgent account issues or prize notifications. Social media platforms have become hunting grounds for phishers who create fake profiles to impersonate trusted people and brands.

These multi-channel approaches make detection more challenging, so users have to stay vigilant across all digital communications.

1. Suspicious or misspelled sender addresses

Always look at the sender's email address closely. Legitimate companies use consistent, professional email domains. Phishing emails often use look-alike domains with subtle misspellings—think "amazom.com" instead of "amazon.com" or "paypa1.com" with a number instead of the letter "l."

Pay attention to the display name versus the actual email address. Scammers might show "Microsoft Security Team" as the sender name while using a completely unrelated email address like "updates@suspicious-domain.net."

2. Urgency and fear tactics in the message

Phishing emails thrive on creating panic. They'll claim your account will be suspended, your security has been compromised, or immediate action is required to avoid consequences. Legitimate companies rarely demand instant responses or threaten account closures without proper notice.

Common urgent language includes phrases like "Act now," "Immediate action required," "Your account will be terminated," or "Respond within 24 hours." These pressure tactics aim to bypass your critical thinking and force hasty decisions. That urgency works: the 2025 Cyber Threat Report shows most users who fall for phishing do so in under a minute, clicking and entering details before they’ve had time to question the message.

3. Generic greetings instead of personalization

Authentic business communications typically include your name or specific account information. Phishing emails often use generic greetings like "Dear Customer," "Dear Account Holder," or "To Whom It May Concern."

While some legitimate companies do send generic communications, be extra cautious when combined with other red flags.

4. Unexpected attachments or odd file types

Be wary of unsolicited attachments, especially executable files (.exe), compressed files (.zip, .rar), or documents that request that you enable macros. Legitimate businesses rarely send unexpected attachments, especially from security or billing departments.

Even seemingly innocent files like PDFs can contain malicious code. When in doubt, verify the sender's identity through a separate communication channel before opening any attachments.

5. Mismatched or hidden URLs

Hover over links without clicking to reveal their true destinations. Phishing emails often hide malicious URLs behind innocent-looking text. A link that says "Click here to verify your PayPal account" might actually lead to "evil-phishing-site.com."

Look for URL shorteners (bit.ly, tinyurl.com) in professional communications, as these can mask the true destination. Legitimate companies typically use their branded domains for all communications.

6. Too good to be true offers or rewards

Unexpected prize notifications, incredible discounts, or "exclusive" opportunities are classic phishing baits. Scammers know people love free stuff and use fake rewards to lure victims into providing personal information.

If you didn't enter a contest or aren't an existing customer, be skeptical of congratulatory messages about winnings or special offers.

7. Poor grammar and spelling (still common, even with AI assistance!)

While AI has improved the quality of phishing emails, many still have grammatical errors, awkward phrasing, or spelling mistakes. Professional organizations have editing processes that catch these issues before sending communications.

Look for inconsistent formatting, unusual punctuation, or phrases that don't sound quite right in context.

8. Unusual or sensitive requests

Legitimate companies never ask for sensitive information via email. This includes passwords, Social Security numbers, full credit card details, or requests to purchase gift cards for any reason.

Be especially suspicious of requests to change payment methods, update banking information, or provide verification codes you didn't request.

The old rules for spotting phishing are getting less reliable.

For years, security awareness training taught people to look for grammar mistakes, spelling errors, and awkward phrasing as the clearest signs that an email wasn’t legitimate. Those cues still show up sometimes, but they’re no longer the dependable giveaway they once were.

Attackers now have access to the same large language models everyone else does. That means they can generate polished, context-aware email copy in seconds, in nearly any language, and tailor it to a specific role, company, or industry. In other words, phishing often looks more professional than it used to.

As Huntress Chief Product Officer Prakash Ramamurthy puts it: “Phishing isn’t just about mass email blasts anymore. Attackers are leveraging breached data, open-source intelligence, and AI-generated deepfakes to craft highly personalized lures. We’re seeing convincing deepfake audio used in wire fraud, generative AI powering phishing emails that evade detection, and attackers social engineering their way past identity verification.”

That shift matters because people often decide fast. According to the Huntress 2026 Cyber Threat Report, the median time it takes for a user to click a phishing link and submit their information is under 60 seconds.

What still works for detection:

What still tends to hold up are signals tied to process and context, not just writing quality. Ask yourself:

• Is this request normal? Would this person usually ask for this, through email, in this way?

• Does the channel match the request? Finance or payroll changes should rarely happen through a single email with no supporting process behind them.

• Is there unusual urgency or pressure to skip a normal step? A polished message can still be suspicious if it pushes you to move faster than your usual approval or verification flow.

• Did I initiate this interaction? Password reset emails, MFA prompts, invoice notices, and delivery updates you didn’t trigger deserve extra scrutiny.

• Does the sender’s address match the real domain exactly? AI can improve tone and grammar, but it does not make a lookalike domain trustworthy.

Email is still central, but it’s no longer the only place attackers operate. AI is also makingvishing more convincing by lowering the barrier to voice cloning and scripted social engineering.

Attackers can pair a phishing email with a follow-up phone call that sounds credible enough to reduce a victim’s hesitation. If the call is asking you to confirm credentials, approve access, or act on a suspicious message, treat the call as part of the verification problem, not proof that the email was legitimate. The safest move is to hang up and call back using a known, trusted number.

The takeaway is not that phishing is impossible to spot now. It’s that the most useful signals have shifted. Teach your team to question the situation, not just the sentence.

Recognizing a phishing email is only half the job. What you do next helps protect both you and the rest of your organization.

Step 1: Stop engaging with the email

Don’t click links, open attachments, reply, or click “unsubscribe.” In many cases, even that click can confirm that your address is active and monitored.

Step 2: Don’t delete it right away

The email may contain useful evidence. Your IT or security team may need the sender details, headers, links, attachments, and message body to understand what happened and determine whether others received the same campaign.

Step 3: Report it to your IT or security team

Use your organization’s normal reporting path, whether that’s a phishing-report button, internal ticketing process, or shared inbox. If you’re not sure how phishing should be reported internally, it’s worth clarifying that before you’re in the middle of a real incident.

Step 4: If you clicked, act quickly

If you clicked a link, entered credentials, opened an attachment, or approved an MFA prompt before realizing something was off, treat it like a real security incident.

• Change the password for the affected account first, then update any other accounts that share the same password.

• Revoke active sessions if your platform supports it.

• Contact your IT or security team immediately and tell them what you clicked, what you entered, and when it happened.

• Avoid using the device for sensitive work until your security team has had a chance to review it.

Step 5: Use your email client’s built-in reporting tools

Many Microsoft 365 and Google Workspace environments include built-in phishing reporting options. Use those tools in addition to notifying your internal security team, not instead of it.

Step 6: Alert your colleagues

If you received a phishing email, others may have received it too, especially if it impersonates a known vendor, internal employee, or popular platform. A quick heads-up can keep someone else from being the first click.

Step 7: Document what happened

If you’re involved in IT, security, compliance, or incident handling, document the details while they’re fresh: sender, subject line, claimed request, links or attachments, who received it, and whether anyone interacted with it.

Cybersecurity is always a team effort—and phishing defense works best when everyone is trained to recognize the signs. By spotting and reporting suspicious emails, you’re not only protecting yourself but also keeping your entire organization safe. Make phishing detection part of your daily routine, reinforce these skills through regular security awareness training, and encourage your colleagues to do the same. The more prepared your team is, the fewer opportunities attackers have to succeed.

From a macro view, healthcare and education accounted for 38% of all incidents Huntress investigated in 2024, and adding tech, manufacturing, and government brings that to 70%—sectors that run on email, shared inboxes, and constant notifications.

Ready to dive deeper into the current threat landscape? Download the Huntress 2026 Cyber Threat Report for comprehensive insights into how cybercriminals are adapting their tactics. For organizations seeking robust, around-the-clock protection, explore Huntress 24/7 human led AI-centric SOC services to complement your internal security awareness efforts.