Devising and detecting spear phishing

The talk looks at how large language models can automate the stages of a spear phishing campaign: finding targets, gathering information about them, writing emails, sending them and tracking who clicks. The speakers built a Python tool that runs iterative web searches on a named person, builds a profile from public sources, and pairs it with a synthetic sender and a chosen persuasion technique. In a study of about 200 participants, early pilot results put the automated emails' click rates in a range comparable to emails written by human experts, at a fraction of the cost.

The second half focuses on defense. Because spam filters already catch much mass phishing, the speakers argued that the real gain lies in personalization. They proposed filters that flag the persuasion styles a particular user tends to fall for, such as social proof or authority, and a digital footprint cleaner that highlights exposed details an attacker would find most useful. For detection, they asked several chat models whether an email's intent looked suspicious instead of asking directly whether it was phishing, and found that some models caught most attack emails with few false alarms on legitimate ones.

The main takeaway is that convincing phishing is becoming cheap to run at scale, so organizations should weigh the economics of defense and consider how prompt framing and user-level risk profiles can improve detection. The talk closed with a live demonstration of the information-gathering step on a volunteer, and the speakers noted that a fuller white paper was forthcoming.