AI Phishing Can Turn Public Social Posts Into Convincing Emails, Study Finds

Fox News Technology's CyberGuy column reports on a University of Texas at Arlington study that examined how AI can use public social media activity to produce tailored phishing emails. The article describes the technique as context-aware spear phishing: messages that use everyday details—a trip, a concert, a delayed flight—to appear relevant to the recipient. The reported findings matter because they suggest scammers may not need to break into an account. Public posts can supply the raw material.

According to the article, the researchers looked at 200 public Instagram accounts and found that as few as 10 posts could provide enough information for highly targeted messages. They evaluated more than 18,000 AI-generated emails and compared them with thousands of real-world phishing messages. The AI tools drew on travel photos, updates about upcoming events, and personal concerns people had shared. In a user study, participants generally rated the generated emails as more convincing and less suspicious than the real examples.

The article also reports a limitation: the reactions were measured in a controlled setting, not in a live attack, so the study did not establish how many people would actually click malicious links. That caveat matters for interpreting the results. The research points to a plausible and concerning mechanism, but it is not evidence of a specific campaign against a named victim or a measured increase in real-world compromises.

The safety-filter findings are another part of the report. The team tested Llama Guard, ShieldGemma, and WildGuard. With default settings, the tools detected only 0% to 19% of requests to create personalized phishing attacks, according to the article. When researchers adjusted the safeguards to recognize this kind of request, detection rose as high as 99% in their tests. Those results came from a research setting and do not guarantee real-world blocking. The article says the researchers withheld the exact generation instructions to avoid providing a ready-made guide, and it says they are urging AI companies to improve protections. No specific patch, recall, or vendor fix is described.

Who is affected? People whose social profiles are public, and anyone who receives an unexpected message that references real recent activity. The article's advice is practical rather than technical. Review who can see posts on Instagram, Facebook, and other platforms; limit access to approved followers where appropriate; and revisit older posts that reveal more than intended. The article notes that private content can still be screenshotted or shared. It also suggests delaying vacation and event posts until after the fact, and checking location tags and photo details before publishing.

When a message arrives from a hotel, venue, or other business and cites something you actually did, do not trust the link. Open the company's official app or type its address into a browser, or call a number you have independently verified. Be wary of requests to sign in, pay, or act urgently; sender addresses can be spoofed. The article also recommends unique passwords, a password manager, multifactor authentication—preferably an authenticator app or security key—and passkeys where supported. It advises automatic updates, active spam filters, and reporting suspicious mail as phishing. Antivirus tools can help warn about known dangerous sites or malicious attachments, but the article says they cannot guarantee protection, especially if a user voluntarily enters information.

The practical takeaway is not that people should stop sharing online. It is that public details can be reused to earn trust, and a well-timed, well-written email is not proof of legitimacy. The article's examples are illustrative; the study's strongest evidence is about how convincing the generated messages were in tests, and about the weaknesses in default safeguards. Readers should treat unexpected messages as unverified until they check through an independent channel.