What Is DeepPhish? AI-Generated Phishing, Detection and How to Defend

Key takeaways

• "DeepPhish" is best known as an academic demonstration of AI-generated phishing, not as a defensive tool. Some articles describe it as a detector, which is not what the research was. If you see a product using the name, evaluate it on its own evidence.
• ML phishing detection looks at URLs, domains, page content, visual look-alikes, and email headers. It is useful but fallible, and attackers adapt to it.
• Email authentication and MFA stop whole categories of attack that no content filter can guarantee to catch.
• Reporting matters. In India you can report phishing to CERT-In and the national cybercrime portal.

What is DeepPhish, and what is it not?

The term DeepPhish appears in security research from 2018 about using deep learning, specifically recurrent neural networks, to learn from phishing URLs that had already been blocked and generate new ones that detection systems did not recognise. The point of the study was to measure how much a learning attacker could improve its success against a typical detector. It was a warning to defenders: detectors trained on yesterday's phishing can be beaten by an attacker who learns from them.

It was not presented as a detection product. Check the original paper for its authors, method and numbers rather than relying on summaries, including this one. Phishing pages that use AI have since become more common, for example through language models that write convincing messages in any language, as our post on AI-generated phishing emails explains.

How ML-based phishing detection works

When people say AI phishing detection, they usually mean classifiers that score a message or link as likely phishing. Common signals include:

Models range from simple classifiers on these features to deep-learning and language models that read the message. Each has strengths. Feature-based models are fast and easy to explain. Language models read context better but cost more and are harder to audit.

Why do detectors fail?

• New campaigns: a page created minutes ago has no reputation. Many phishing sites live for only hours.
• Adversarial adaptation: attackers test messages against filters and change them until they get through. This is the lesson of the DeepPhish research.
• Legitimate-looking channels: phishing sent from compromised real accounts, or hosted on trusted cloud services, inherits good reputation.
• False positives: aggressive filters block real invoices and password resets, and users then lose trust in warnings.
• Non-email channels: SMS, WhatsApp, QR codes and phone calls often sit outside email filters.

Controls that do not depend on guessing

1. SPF, DKIM and DMARC. They let receivers verify that mail claiming to come from your domain really does. DMARC is defined in RFC 7489. Start with a monitoring policy, then move to quarantine and reject once legitimate senders are covered.
2. Multi-factor authentication, ideally phishing-resistant. Passkeys and hardware security keys are bound to the real site, so a fake login page cannot reuse them. SMS codes and app codes can still be relayed by attackers.
3. Link and attachment protection. Rewrite or detonate suspicious links and files in a sandbox.
4. Least privilege and payment controls. Require a second approval and a call-back on a known number for any change of bank details.
5. A one-click report button and a team that reads the reports. Reports turn users into sensors.
6. Realistic, fair phishing simulations and short training based on what really arrives in your inbox.
7. Logging and response: a runbook to reset credentials, revoke sessions and search for the same message across mailboxes.

A practical exercise: inspect a suspicious email safely

Use a sample from a phishing-awareness dataset or an email you were sent, and do this in a lab, not on a work machine:

1. Open the full message headers. Find the Received chain and note the sending server.
2. Look for Authentication-Results. Did SPF, DKIM and DMARC pass, and for which domain?
3. Compare the display name, the From address and the Reply-To.
4. Hover over, but do not click, each link. Does the real destination match the text?
5. Look up the domain's registration date with WHOIS. A domain a few days old is a strong warning sign.
6. Write your verdict and the evidence in one paragraph.

Our posts on AI-powered phishing detection and how AI can detect and prevent phishing look at the detection side further.

If you receive or fall for a phishing message in India

• Do not click or reply. Report it internally if it came to a work account.
• If you entered credentials, change the password immediately from a clean device and sign out all sessions.
• If money was involved, call the national cybercrime helpline 1930 right away and file a complaint at cybercrime.gov.in. Speed helps banks freeze funds.
• Organisations can report incidents to CERT-In.

The global Anti-Phishing Working Group publishes research and trend reports on phishing, and is a good source for current data.

Next steps

If you want to learn how phishing is investigated and handled in a security operations centre, our Certified SOC Analyst course covers email analysis and incident response in lab conditions.

Related reading

• Using AI for Online Scam Detection | How Artificial Intelligence is Combating Digital Fraud and Cyber Threats