AI-Powered Phishing Attacks in 2025: How Indian Enterprises Can Stay Ahead

• 15 August, 2026
• No Comments

Phishing has always been the attacker’s favourite door. It is cheap, scalable, and disturbingly effective. But in 2025, something has changed at the root. Generative AI tools—the same technology powering productivity assistants—have given threat actors the ability to craft hyper-personalised, grammatically flawless lures at industrial scale. For Indian enterprises, where rapid digital adoption has expanded the attack surface faster than security maturity, this is not a distant problem. It is landing in inboxes today.

Why AI-Powered Phishing Is Fundamentally Different

Traditional phishing campaigns were easy to spot: generic greetings, broken English, implausible urgency. Security awareness training taught employees to look for exactly those tells. AI-generated phishing eliminates them.

Modern campaigns now feature:

• Language-perfect lures written in polished English or Hindi, Tamil, Bengali—whatever the target’s preference—sourced from leaked LinkedIn profiles and corporate directories.
• Context-aware pretexts referencing the recipient’s actual job title, recent company announcements, or real vendor relationships scraped from public filings and social media.
• Voice and video deepfakes accompanying email campaigns, simulating CFO or CEO voices in follow-up WhatsApp messages to validate fraudulent payment instructions.
• Adversarial-AI bypass: attackers are now testing their payloads against commercial email security gateways before sending, tuning until detection rates drop to near zero.

The result is a class of attack that defeats perimeter email filtering alone—and demands a layered, behavioural defence-in-depth approach.

The Indian Enterprise Exposure

India’s corporate sector presents a particularly attractive target. Several factors converge:

• Rapid SaaS adoption: Microsoft 365 and Google Workspace are now standard across mid-market and enterprise. Both are rich credential targets and vectors for OAuth-based token harvesting.
• Finance and BPO concentration: India hosts a disproportionate share of shared-services centres handling international wire transfers—exactly the accounts targeted by Business Email Compromise (BEC) campaigns.
• Supply-chain exposure: Indian IT and consulting firms serve Fortune 500 clients. Compromising a Tier-2 Indian vendor is often the path of least resistance into a heavily defended Western enterprise.
• Mobile-first workforce: Employees routinely handle corporate email on personal devices where MDM coverage is partial and anti-phishing tooling is absent.

In 2024 alone, CERT-In processed thousands of phishing incident reports across banking, insurance, and manufacturing sectors. In 2025, threat intelligence sources indicate the volume and sophistication of these campaigns has continued to accelerate, with AI-assisted lures now accounting for a growing share of observed phishing kits.

Attack Flow: What a Modern AI-Phishing Campaign Looks Like

Understanding the kill chain helps defenders disrupt it early.

Stage 1 – Reconnaissance

Attackers harvest the target organisation’s email format (e.g., firstname.lastname@company.in) from LinkedIn, company websites, and leaked datasets. Generative AI tools then synthesise personalised lure content from this data at scale—one operator, thousands of bespoke emails.

Stage 2 – Delivery

Emails arrive from compromised legitimate domains (to pass SPF/DKIM checks) or from newly registered lookalike domains aged past reputation blacklists. Attachments are often password-protected archives—bypassing attachment scanners—with the password embedded in the email body so only a human (or an AI lure-reader) can open them.

Stage 3 – Credential Harvest or Malware Drop

Clicking the link lands the victim on a pixel-perfect clone of the corporate identity provider login page (Microsoft, Okta, Google). Real-time adversary-in-the-middle (AiTM) proxies capture not just credentials but live session tokens, bypassing MFA entirely. Alternatively, the payload drops a commodity RAT or an infostealer—enough to harvest VPN credentials and internal tool tokens.

Stage 4 – Lateral Movement and Impact

Armed with a valid session, attackers move laterally through Microsoft 365 tenants, exfiltrate data to cloud storage, set inbox rules to hide their activity, and may trigger BEC wire-transfer requests before defenders notice anything unusual.

Building a Layered Defence: The PJ Networks Approach

No single control stops AI-powered phishing. The defence must be layered, automated, and continuously tuned.

1. Email Gateway Hardening with FortiMail

Fortinet’s FortiMail provides deep content inspection, sandboxing of suspicious attachments, and AI-assisted spam scoring. Critically, it enforces DMARC reject policies—blocking spoofed domains that attempt to impersonate your organisation. For organisations still on p=none DMARC policies, moving to enforcement is the highest-leverage quick win available.

2. ZTNA-Based Access Control

Traditional VPN grants broad network access once credentials are verified. Zero Trust Network Access (ZTNA) decouples identity from access: every application session is independently authorised based on device posture, user role, and risk signals—even if an attacker holds a valid credential. PJ Networks deploys and operates ZTNA for clients using the FortiGate ZTNA fabric, reducing the blast radius of any compromised account to the minimum necessary access scope.

3. MFA Everywhere—With Phishing-Resistant Methods

Standard OTP-based MFA is defeated by AiTM proxy attacks. Phishing-resistant options—FIDO2 hardware tokens, Windows Hello for Business, or certificate-based authentication—cannot be intercepted by a proxy because the credential is bound to the legitimate domain. For organisations where hardware tokens are not yet feasible across the workforce, number-matching MFA in Microsoft Authenticator is a meaningful interim hardening step.

4. 24/7 SOC Monitoring for Anomalous Sign-In Patterns

Even when a credential and a session token are stolen, attackers leave behavioural traces: impossible travel, new device enrolments, atypical access-time patterns, unusual SharePoint or OneDrive download volumes. A staffed 24/7 SOC analysing identity telemetry in near-real-time can detect and contain these incidents before data exfiltration is complete. PJ Networks operates a 24/7 NOC/SOC service combining automated alerting with analyst-in-the-loop triage.

5. Employee Awareness—Redesigned for the AI Era

Annual phishing simulations no longer reflect the real threat. Effective 2025 awareness programmes send AI-generated simulated lures (using the same tools attackers use), personalised to each employee’s role and public footprint, with immediate teachable-moment feedback. The goal is conditioning reflexes—verify before you click, call before you wire—not just knowledge transfer.

PrahiX Ora: Unified SecOps Visibility Across the Kill Chain

Phishing campaigns generate signals across multiple layers simultaneously: email gateway logs, identity provider audit events, endpoint telemetry, network flow records. Correlating these signals manually is the bottleneck that lets attackers dwell undetected. This is the problem the platform we deploy and operate for clients—PrahiX Ora, built by PrahiX Tech Pvt Ltd—is designed to solve.

PrahiX Ora is a unified SecOps platform with four integrated pillars, each directly relevant to phishing-related incident detection and response:

• SIEM: Multi-source log and event ingestion correlates email gateway alerts, Azure AD / Okta sign-in anomalies, and endpoint events against MITRE ATT&CK technique mappings. The platform reconstructs the full attack storyline as a graph—from the initial phishing email delivery (T1566) through credential access (T1078) to data collection (T1530)—in a single analyst view. Tiered hot/cold/archive retention supports CERT-In’s direction on 180-day in-country log retention, ensuring audit evidence is available when an incident is reported.
• NMS: Unified observability across FortiGate firewalls, switches, APs, and WAN/SD-WAN links lets the NOC detect anomalous outbound traffic patterns—large data transfers to unfamiliar cloud storage destinations, unusual DNS query volumes to recently registered domains—that are classic indicators of post-phishing exfiltration. In multi-vendor estates where NOC visibility is fragmented across separate vendor portals, the NMS’s LLDP/CDP topology discovery and ML-based anomaly detection provides a single correlated view.
• Video surveillance (VMS): For manufacturing, retail, and multi-site enterprises, PrahiX Ora integrates ONVIF/Hikvision/Dahua camera management with video analytics alongside network security operations. When a phishing attack is suspected to be part of a broader insider or physical-access scenario, having physical and network security data under one operations view accelerates investigation and reduces the number of separate consoles an analyst must navigate.
• SOAR: Pre-built playbook automation—including connectors to FortiGate for automated blocklist pushes—translates detection into response within minutes rather than hours. In the context of AI-phishing, this means an AiTM-based session token theft detected by the SIEM can automatically trigger revocation of the compromised session, isolation of the affected endpoint, and notification to the identity team before an analyst even picks up the ticket. This level of automation is what makes CERT-In’s 6-hour incident reporting window a realistic operational target rather than a compliance aspiration.

If your organisation is dealing with fragmented security tooling and struggling to get correlated visibility across email, identity, network, and endpoint, we can walk you through how we deploy and operate the PrahiX Ora platform for clients of similar scale.

CERT-In and DPDP Act Implications

India’s regulatory environment adds legal weight to what is already a business-critical security problem.

Under the CERT-In Directions (April 2022), organisations must report cybersecurity incidents—including data breaches resulting from phishing—within six hours of becoming aware of them. AI-powered phishing attacks that result in credential theft and data exfiltration qualify. Organisations without automated detection and documented incident response procedures will find this six-hour window extremely difficult to meet.

The Digital Personal Data Protection (DPDP) Act, 2023 reinforces the accountability framework. Data Fiduciaries must implement “reasonable security safeguards” to protect personal data. A phishing breach that exposes employee PII, customer records, or financial data will be scrutinised against whether proportionate technical controls were in place. Demonstrating layered email security, MFA enforcement, ZTNA access controls, and continuous SOC monitoring supports compliance with these safeguards—though implementing these controls does not guarantee compliance and organisations should seek legal counsel on their specific obligations.

Key regulatory takeaway: Phishing is not just a security risk. It is a regulatory trigger. The six-hour CERT-In reporting clock starts when you become aware—which means your detection capability determines your compliance exposure.

Immediate Action Checklist for IT Leaders

If you are reviewing your phishing defences today, here are the highest-priority actions:

• ☐ Enforce DMARC reject policy on your primary domain and all subsidiary sending domains.
• ☐ Audit MFA coverage: identify all admin and privileged accounts still using SMS OTP or authenticator-app TOTP without number-matching.
• ☐ Enable conditional access policies that block sign-ins from non-compliant or unregistered devices.
• ☐ Activate FortiMail sandbox or equivalent for inbound attachments, with aggressive quarantine thresholds.
• ☐ Review SOC alert coverage for identity anomalies: impossible travel, bulk email rule creation, atypical data download volumes.
• ☐ Update incident response runbooks to include the CERT-In 6-hour notification step and a designated reporting officer.
• ☐ Run an AI-simulated phishing exercise against your executive and finance teams—they are the highest-value targets.
• ☐ Validate log retention: confirm that email gateway, identity provider, and network logs are retained in-country for at least 180 days in line with CERT-In guidance.

Conclusion

AI-powered phishing is not a future threat. It is the present reality for Indian enterprise security teams. The same generative AI capabilities that are reshaping business productivity have lowered the cost and raised the quality of adversarial campaigns to levels that make traditional perimeter defences insufficient on their own.

The response must be equally multi-layered: technical controls at the email gateway, identity, and network layers; automated detection and response through a 24/7 SOC; and an incident response capability fast enough to meet regulatory reporting obligations.

PJ Networks specialises in deploying and operating exactly this kind of defence for Indian enterprises—FortiGate NGFW and FortiMail for perimeter hardening, ZTNA for access control, and 24/7 NOC/SOC services backed by the PrahiX Ora unified SecOps platform. If you would like to assess your current phishing resilience or discuss how these services can be tailored to your environment, reach out to our team.