AI vs. AI: Detecting an AI-obfuscated phishing campaign

According to Microsoft Threat Intelligence, Microsoft Threat Intelligence recently detected and blocked a credential phishing campaign that likely used AI-generated code to obfuscate its payload and evade traditional defenses, with the activity appearing to be aided by a large language model. The campaign obfuscated its behaviour within an SVG file, using business terminology and a synthetic structure to disguise its malicious intent, and the SVG was analysed by Security Copilot as likely being AI-generated.

On 18 August 2025, the attackers used a compromised small business email account to deliver phishing emails, attaching a file named “23mb – PDF- 6 pages[.]svg” that was designed to look like a legitimate PDF. The SVG redirected users to a page prompting a CAPTCHA and potentially a fake sign-in page to harvest credentials, while using invisible elements and encoded business terms to conceal the payload.

Microsoft Defender for Office 365 blocked the campaign, with signals including self-addressed emails with BCC, unusual SVG attachments, and browser fingerprinting and session tracking.