Report: Attackers Are Using AI to Automate Social Engineering
KnowBe4, Monday, July 13th, 2026
Research finds threat actors treat AI as operational infrastructure, mass-producing phishing pages while keeping traditional attack chains.
KnowBe4 covers ReliaQuest research describing how threat actors are folding AI into existing attack operations.
The research identifies two roles for AI: embedded inside attack workflows to generate phishing pages and improve social engineering copy, and used as the lure itself to trick users into installing malicious software.
One campaign saw attackers generate thousands of phishing pages impersonating well-known booking platforms through an apparently AI-assisted workflow built for scale. The researchers conclude AI has not fundamentally changed intrusion tactics, with most actors still relying on proven attack chains.
As the report puts it, actors treat AI as operational infrastructure layered onto traditional methods, leaving human social engineering central.