kaseya put out this MSP piece on catching AI phishing and honestly it reads like a list of our own mistakes. free after-action report
The blue team wrote us a how-to-catch-us guide, thanks
the recon section is just describing what we already do. scrape linkedin, feed the profiles to a model, get a personalized spearphish in minutes. they even cite a 54% click rate matching human experts
54%. at a fraction of the cost. the ROI on this is obscene
the part that matters is polymorphic. every email unique — subject, sender, formatting all rotating — so the signature-based gateways have nothing to match. that's why the filters miss
right but read the second half. they're not trying to stop it at the inbox anymore. they gave up on that. they're watching behavior after the click
yeah and that's the part we need to actually respect. the tells they list are all us being sloppy post-compromise:
dropping a mailbox forwarding rule to an external address right after login
impossible travel," same account two countries in minutes
hammering MFA push until they accept
logging in clean then immediately spraying powershell or touching systems that account never touches
every one of those is an own-goal. the phish is flawless and then people set an obvious forward rule from a russian IP thirty seconds later
the forwarding rule is what gets everyone. don't create noisy inbox rules. don't pivot the second you're in. sit. blend. match the user's normal hours
impossible travel is why you route through infra in the target's region. logging in from their city instead of ours kills that alert dead
MFA fatigue works but it's loud — a pile of unrequested pushes is literally on their list now. one clean prompt-bomb attempt, not forty
the meta lesson: their detection isn't about the email anymore, it's correlation across identity + endpoint + email. so our job is to not light up more than one of those at once
and speed. they're measuring response time now, dwell time is the whole game for them. which means it's the whole game for us too — get in, get what we came for, don't linger admiring the view
"one eventually gets past the gateway." they said it themselves. the inbox was never the wall. the wall is whether anyone's watching what happens next
so watch what happens next. quietly.