- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
Phishing has always been the attacker’s weapon of choice — low cost, high return, devastatingly effective against the human layer of any security stack. But something fundamental changed in 2024 and has accelerated into 2025: generative AI has democratised the crafting of near-perfect spear-phishing lures. What once required a skilled social engineer fluent in corporate jargon can now be churned out in seconds by a $20-a-month AI subscription. For Indian enterprise IT leaders and CISOs, this is not a theoretical risk. It is the threat landscape your inbox sees every Monday morning.
Traditional phishing relied on volume: send ten million generic “Your account has been suspended” emails and wait for the 0.01 % click rate to pay off. AI-powered phishing flips the model. Attackers now combine:
The net effect: a spear-phishing email indistinguishable from a genuine message from your CISO, your auditor, or your largest customer — personalised, contextual, and arriving exactly when a wire transfer or a credential reset feels most plausible.
India’s rapid digital expansion has created an attack surface that threat actors are actively mapping. Several factors make Indian enterprises particularly attractive targets in 2025:
The rush to move workloads to AWS, Azure, and GCP during and after the pandemic left many organisations with fragmented identity stacks — on-premise Active Directory alongside cloud IAM, sometimes bridged by legacy VPNs. Phishing attacks that harvest cloud credentials (Microsoft 365, Google Workspace, Salesforce) yield far higher returns than stealing a local LAN password, because cloud accounts often have access to data across the entire organisation.
India processes over 17 billion UPI transactions a month. Business Email Compromise (BEC) attacks targeting accounts payable teams — convincing a finance executive to change a vendor’s bank details — are increasingly AI-crafted. The attacker needs only a plausible-looking email thread, a spoofed domain one character off, and a well-timed request.
India’s Digital Personal Data Protection (DPDP) Act 2023, and its associated rules under development, create a compliance pressure that attackers exploit. Phishing lures themed around “DPDP audit findings”, “data localisation notices”, or “CERT-In advisory compliance” are now observed in the wild. Employees anxious about regulatory consequences are more likely to click urgently-framed links.
Post-pandemic hybrid work means employees regularly receive email requests from unfamiliar colleagues, external vendors, and new customer contacts. The cognitive load of evaluating every sender is enormous — and attackers know it. AI-generated lures exploit familiarity and routine.
Understanding the attack lifecycle is the first step to building effective defences. A sophisticated AI-assisted campaign typically runs as follows:
Legacy secure email gateways (SEGs) were built for a world of signature-based malware attachments and blacklisted domains. They struggle against AI-generated phishing for several reasons:
Defending against AI-powered phishing requires layered controls across people, process, and technology.
Deploy an API-integrated cloud email security solution that can analyse email after delivery (and pull back messages that are initially clean but later reclassified). Look for capabilities that use large-scale behavioural modelling — understanding what a legitimate sender’s email looks like — rather than purely signature-based detection. FortiMail with integration into FortiSandbox provides detonation-based analysis of suspicious links and attachments, including HTML smuggling payloads.
Malicious domains used in phishing campaigns are often very short-lived. DNS-layer filtering (FortiDNS, integrated with FortiGate NGFW policy) blocks resolution of newly registered domains, DGA domains, and domains flagged by threat intelligence feeds — stopping clicks before a connection is made, even from mobile or BYOD devices routed through cloud DNS.
Time-based OTP codes (TOTP) and SMS OTPs are defeated by AiTM proxies. Upgrade critical accounts — privileged admins, finance, executive assistants — to phishing-resistant MFA: FIDO2 hardware keys (YubiKey) or passkeys that bind authentication to the legitimate origin URL. Even if a credential is stolen, the session cannot be replayed to a different domain.
Traditional VPN gives authenticated users broad network access — a stolen credential equals a lateral movement highway. ZTNA enforces per-application access decisions based on identity, device health, and context. FortiClient with FortiGate ZTNA means that even if phishing harvests a user’s credentials, the attacker cannot reach internal applications without a compliant, enrolled device — a control most phishing campaigns are not equipped to bypass.
Annual security awareness training is insufficient when the threat evolves weekly. Run continuous, automated phishing simulations — including AI-generated lures that mirror current campaign patterns — to keep employees’ threat-recognition instincts sharp. Track click rates by department and role; prioritise targeted training for consistently vulnerable cohorts.
When a phishing link is clicked, response time is measured in minutes. Prepare playbooks that cover: immediate session revocation across M365/Google Workspace; forced MFA re-registration; email forensics to identify other recipients of the same campaign; and threat hunting for OAuth app grants or new device enrolments made in the hours after the click. CERT-In’s 6-hour reporting window for cyber incidents makes a documented, tested playbook non-negotiable.
The defence framework above generates enormous telemetry: email gateway logs, DNS query logs, identity provider (IdP) audit trails, endpoint detection events, network flow records. Without a platform to ingest, correlate, and act on that data, your security team is reading from separate dashboards and missing the connections between them. That is precisely the problem the PrahiX Ora platform addresses — and the platform we deploy and operate for clients as PJ Networks’ primary field deployment partner.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. It brings four integrated capabilities to bear on threats like AI-powered phishing:
SIEM: Ora’s SIEM ingests logs from FortiMail, FortiGate, Azure AD / Entra ID, Google Workspace, and endpoint agents — correlating events against MITRE ATT&CK techniques (T1566 Phishing, T1078 Valid Accounts, T1021 Remote Services) to reconstruct the full attack storyline as a graph, not a flat list of alerts. For Indian enterprises, this directly supports CERT-In’s direction on 180-day in-country log retention: Ora’s tiered hot/cold/archive storage keeps your evidence chain intact and searchable when an incident review is demanded.
NMS: Phishing often leads to lateral movement across network segments. Ora’s network management system provides unified observability across FortiGate firewalls, switches, APs, and SD-WAN links — with LLDP/CDP-based topology discovery that shows you exactly which segments an attacker could reach from a compromised endpoint. ML-based anomaly detection flags unusual east-west traffic spikes that correlate with credential-based lateral movement, even before a traditional signature would fire.
Video Surveillance (VMS): For manufacturing, retail, and multi-site organisations, physical security is part of the threat picture. Ora’s video surveillance module manages ONVIF, Hikvision, and Dahua cameras with built-in video analytics — and correlates physical access events with network security events in a single operations view. If an employee’s credentials are phished and then used to badge into a restricted area at 2 AM, your SOC sees both events in the same pane of glass.
SOAR: CERT-In’s 6-hour incident reporting window is only achievable if your response is largely automated. Ora’s SOAR playbooks — pre-built for phishing response — can automatically push a phishing domain to FortiGate’s threat intelligence blocklist across all your firewalls within minutes of detection, revoke active sessions via the IdP API, and draft an initial incident report template populated with the relevant log artefacts. Automation is what makes the 6-hour window realistic, not aspirational.
If your current SOC lacks this level of integration — or if phishing incidents are taking hours to triage — reach out to us at PJ Networks to discuss how we can deploy and operate Ora in your environment.
A successful phishing attack that results in access to personal data of customers or employees creates immediate obligations under India’s DPDP Act 2023 (once notified) and existing CERT-In directions:
Use this checklist as a starting point for your next security review:
- [ ] Email security gateway upgraded to include post-delivery analysis and HTML smuggling detection
- [ ] SPF, DKIM, and DMARC records configured and in enforcement mode (p=reject)
- [ ] DNS-layer filtering enabled for all endpoints, including remote/BYOD
- [ ] MFA enforced for all users; phishing-resistant MFA (FIDO2/passkeys) for privileged and finance roles
- [ ] ZTNA deployed for remote access; VPN access reviewed and shrunk to minimum necessary
- [ ] OAuth app grant policy configured — unknown third-party apps require admin approval
- [ ] Phishing simulation programme running at least quarterly; AI-generated lures included
- [ ] Incident response playbook for phishing documented, tested, and covers the 6-hour CERT-In window
- [ ] Log retention configured for 180 days in-country per CERT-In directions
- [ ] SOC has unified visibility across email, identity, endpoint, and network telemetry
AI-powered phishing is not a future threat — it is the threat landscape of today, and it is evolving faster than most enterprise security programmes can track. For Indian enterprises navigating the dual pressures of rapid digitisation and tightening regulatory requirements under DPDP and CERT-In, a layered, intelligence-driven defence is no longer optional.
The good news: the same AI capabilities that attackers are weaponising can be deployed defensively — in email security platforms, in SIEM correlation engines, in SOAR automation — to detect and respond to campaigns at machine speed. The organisations that will navigate 2025 with the least disruption are those that have already built that integrated security operations capability.
PJ Networks helps Indian enterprises design, deploy, and operate that capability — from FortiGate NGFW and FortiMail to ZTNA, managed NOC/SOC, and the PrahiX Ora unified SecOps platform. If you want to assess your current phishing readiness or accelerate your security operations maturity, get in touch with our team.