- Proofpoint says AI is weakening the behavioral signals email filters rely on, because attackers can make each message look ordinary and different.
- Its example: one actor wrote to more than 30 real estate agents in different words, then asked each to join a video meeting.
- Ask vendors how they judge a message's purpose, and ask your own teams which inboxes act on first contact from strangers.
Looking normal has become cheap
Phishing used to be easy to spot. Bad grammar, stock pretexts and recycled templates gave attackers away. Proofpoint, an email security vendor, says generative AI is wearing those marks down. The Hacker News, reporting on Proofpoint's Protect 2026 conference, says the signals filters have relied on are fading.
Proofpoint argues that behavior has become a "weakening signal." That is a claim about decline, not disappearance.
Proofpoint's argument is that AI has made looking normal cheap. The attacker's goal has not changed. A filter that asks "does this look odd?" is asking something the attacker can now fake. The sturdier question is "what does this message want the reader to do?"
The real estate example
Proofpoint shared a campaign in which one threat actor wrote to more than 30 agents at a single real estate company. The sender accounts differed. So did the listings and the wording. Yet every thread closed with the same ask: join a video call.
The openers were ordinary. Was the property open for inspection? What was the price guide? Could someone view it this week? The Hacker News adds that the sender mailboxes were real and that replies landed in threads agents were already working.
One thread shows the pace. A message about a property inspection went out at 2:58 a.m. Thirteen minutes later, a meeting invite followed. It used a branded template and said the agent's "immediate attention" was needed.
The Hacker News lists odd timing among the behavioral cues filters learned to spot. The sources do not say whether it was weighed in this campaign. The suggestion is that no single cue was enough.
The Hacker News judges that writing 30-plus distinct enquiries is work generative AI does in seconds. The sources do not say Proofpoint confirmed AI wrote these messages.
How the trick works
The join link used a real google.com address. That address was a redirect, which is a web link that forwards the visitor elsewhere. A parameter inside the link passed the click to an unrelated site. Reputation checks judge a link by its starting address. They saw Google and found nothing wrong.
Two other filter signals had nothing to work with. Each sender was making first contact, so there was no sender history to compare. Each message was worded differently, so there was no repeated text to match.
What the messages shared was their purpose, not their look. The Hacker News notes that this is where Proofpoint wants detection to focus.
These are Proofpoint's examples. The sources do not say how many organizations saw this campaign or how often it worked.
Who else is exposed
Proofpoint says the approach fits any business that takes inbound contact from strangers. It named four examples: clinics welcoming new patients, firms signing up clients, banks handling account applications and insurers giving quotes.
One variant targeted insurance agents. It built rapport with quote requests, neighbor referrals and coverage questions. Then it sent a forged conference invite that delivered the attack.
Proofpoint also described campaigns meant to disrupt, not steal. In these, a crowd of separate senders, numbering in the hundreds or thousands, targets the same executives. Each picks a subject matched to the target's industry. Some messages insult the reader. Others attach AI-made or altered images that mock them.
These messages carry no link and ask for no password. Each could pass for one angry correspondent. The Hacker News says scoring messages one by one will not catch them. Defenders have to see the whole set.
Federal figures add context. In its 2025 report, the FBI's Internet Crime Complaint Center logged over 22,000 complaints that involved AI, with losses just under $900 million, as The Hacker News reports. Business email compromise drew 24,768 complaints and about $3.05 billion in reported losses in the same report. These totals are context only. They do not measure this tactic.
Proofpoint's answer, and its limits
On September 22, Proofpoint announced its Agentic Collaboration Security system. It pairs the Proofpoint Knowledge Graph with the Nexus Intent-Based Detection Model, which reasons over what the graph holds. The graph is the foundation. Proofpoint says it combines intelligence on live campaigns and compromised suppliers with facts about each customer: who deals with whom, how people communicate, what data they can reach and how risky each user is.
Proofpoint says most decisions take under half a second. Unclear cases get deeper analysis to judge whether a message's goal makes sense in context.
The analysis runs before delivery at the email gateway, then again in the inbox. Proofpoint adds dedicated models for executives and finance approvers. It also adds browser protection built with Push Security. Proofpoint claims to be the only secure email gateway offering intent-based detection before delivery. That is the vendor's own statement.
Two caveats apply. The new capabilities are due in Q1 2027, so customers do not have them yet. And the sources give no independent test results or detection rates.
What leaders should ask
Start inside the company. Which inboxes act on a first message from a stranger? Think of sales enquiries, patient requests, new-client forms and quote desks. In those places, a sender with no history is normal.
Then put four questions to the security team.
What does our filter do when a sender has no history? Do we judge where a link ends up, or only where it starts? Do executives and finance approvers get protection tuned to them? Can anyone see many similar messages as one campaign?
Ask any vendor selling intent detection two more. How is accuracy measured? And what happens to real messages that look unusual? A tool that judges purpose must be tested on its mistakes as well as its catches.
A message can look entirely normal and still be wrong. The safer habit is to ask what it wants.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Proofpoint.
