- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
It is no longer enough to train employees to spot broken English or suspicious sender domains. In 2025, adversaries are using large language models to craft spear-phishing emails that are grammatically perfect, contextually aware, and deeply personalised—pulling data from LinkedIn profiles, company websites, and even leaked CRM records. Indian enterprises, which sit at the intersection of rapid digital adoption and a still-maturing security culture, are a primary target.
This post examines how AI-powered phishing works, what the attack chain looks like, and the concrete controls your security team can deploy today.
Traditional phishing was a volume game: cheap, poorly crafted messages sent to millions of addresses in the hope that a fraction would click. Defenders fought back with email gateway filters that looked for tell-tale signs—misspelled domains, generic salutations, unusual sender geographies.
Generative AI upends that model in three ways:
The result: click rates on AI-crafted spear-phishing campaigns are reported to be three to five times higher than traditional bulk campaigns in red-team exercises conducted globally.
Understanding the kill chain helps defenders choose where to apply controls most efficiently.
Attackers use open-source intelligence (OSINT) tooling—Maltego, LinkedIn scrapers, WHOIS lookups, GitHub searches—to map the target organisation. For Indian enterprises, the Ministry of Corporate Affairs public filings and SEBI disclosures are also rich sources. AI summarises this corpus into a target dossier in seconds.
An LLM generates the email body, subject line, and sender persona. The model can be prompted to match the company’s communication style, reference a real ongoing initiative (an audit, a product launch, a regulatory deadline), and embed urgency without raising obvious red flags.
Rather than sending from obviously malicious domains, sophisticated groups register lookalike domains days or weeks before the campaign, warm them up with legitimate traffic, and time delivery to coincide with periods of high activity—Monday mornings, the days before a board meeting, or immediately after a public announcement.
The link may lead to a convincing clone of the corporate Microsoft 365 or SAP Fiori login page hosted on a bulletproof provider. Alternatively, the attachment contains a macro-free document exploiting a parser vulnerability, or a QR code that bypasses email gateway scanning by shifting the malicious URL to the endpoint’s camera.
Once initial access is gained, the adversary moves laterally using legitimate credentials, targeting high-value assets: Active Directory, ERP systems, or cloud storage. In the Indian context, this often means targeting SAP, Oracle Financials, or Microsoft Azure tenants.
Two compliance frameworks add urgency for Indian organisations:
Under CERT-In’s 2022 directions (updated and reinforced since), organisations must report certain cybersecurity incidents—including ransomware, data breaches, and compromise of critical systems—within six hours of detection. A successful phishing attack that leads to credential theft and data exfiltration triggers this clock. Organisations that lack automated detection and a pre-tested incident response process will almost certainly miss the window.
India’s DPDP Act places obligations on data fiduciaries to implement reasonable security safeguards. A successful spear-phishing attack that exposes personal data of employees or customers will be scrutinised against whether the fiduciary had adequate technical measures in place. Phishing simulation programmes, MFA enforcement, and endpoint detection controls are the kind of evidence auditors will expect to see.
The good news: the same security hygiene stack that defends against traditional phishing is still the foundation. The difference is that each layer must be tuned more aggressively and supplemented with behavioural analytics.
Deploy a cloud-delivered email security solution—Fortinet’s FortiMail is our deployment standard for enterprise clients—configured to sandbox all attachments and URLs, including those embedded in QR codes via image scanning. Set strict DMARC, DKIM, and SPF policies. Reject, not quarantine, failures on your own domain. A policy of p=reject on all owned domains (including parked and legacy domains) closes off one of the most common BEC vectors.
SMS OTP is not phishing-resistant. Adversary-in-the-middle (AiTM) proxy kits can relay OTP codes in real time. Mandate FIDO2 hardware tokens or passkeys for all privileged accounts and for access to critical SaaS applications. For broader rollout, Microsoft Authenticator’s number matching and additional context features significantly raise the bar over traditional push notifications.
Even if an adversary obtains a valid credential, ZTNA enforces continuous verification—device posture, user identity, and behavioural signals—before granting access to any application. A stolen credential from a non-compliant device or an unusual geography gets blocked rather than granted broad network access. PJ Networks deploys ZTNA fabric using Fortinet’s ZTNA solution integrated with FortiGate NGFW, giving clients granular, application-level access control that limits the blast radius of a compromised account.
Awareness training remains important, but the content must evolve. Run quarterly simulations that include AI-crafted lures, QR code attacks, voice phishing (vishing) scenarios, and pretexts specific to your industry. Measure click rate, credential submission rate, and reporting rate. Trend these over time—a rising reporting rate is a leading indicator of a maturing security culture.
Limit what a compromised account can do. Enforce just-in-time (JIT) privilege elevation, session recording for privileged access, and break-glass procedures for emergency access. Attackers who compromise a standard user account should encounter significant friction before reaching domain controllers or financial systems.
Signature-based antivirus will not catch novel malware generated or mutated by AI tooling. Deploy EDR with behavioural detection that alerts on anomalous process chains, unusual outbound connections from Office applications, and credential dumping patterns—regardless of whether the payload has a known signature.
Detection without response is incomplete. When a phishing campaign succeeds—and eventually some will—your team needs to move fast. That means:
Detecting and responding to AI-powered phishing requires correlating signals from email gateways, authentication logs, endpoint telemetry, and network traffic—often across multi-vendor estates. This is exactly where siloed point tools break down and analyst fatigue sets in. PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd; PJ Networks is its primary field deployment and operations partner, deploying and operating the platform for enterprise clients across India.
Ora brings together four integrated pillars that cover the phishing kill chain end to end:
When a phishing campaign lands, the investigation question is: what happened after the click? Ora’s SIEM ingests log and event streams from FortiMail, FortiGate, Microsoft 365, Azure Active Directory, and endpoint agents into a unified pipeline. Correlation rules mapped to MITRE ATT&CK techniques—including T1566 (Phishing) and T1078 (Valid Accounts)—surface attack storylines as a graph rather than a flat, chronological list of alerts, so analysts can see the chain of events without manually piecing together dozens of raw log entries. Tiered retention (hot, cold, and archive tiers) supports CERT-In’s direction on 180-day in-country log retention, meaning the evidence chain remains intact when regulators or auditors ask for it.
After initial access, adversaries move laterally and beacon to command-and-control infrastructure. The network is often the first place this becomes visible—if anyone is watching. Ora’s Network Management System (NMS) provides unified observability across firewalls, switches, wireless access points, and SD-WAN links, with LLDP/CDP topology discovery and network path tracing. ML-based anomaly detection flags unusual east-west traffic or unexpected external connections that manual threshold rules would miss. For enterprises running multi-vendor environments where NOC visibility is fragmented across separate dashboards, this single-pane view removes the gaps that attackers exploit.
Targeted phishing campaigns are sometimes preceded by physical reconnaissance: badge cloning, tailgating, or social engineering visits to reception desks. Ora’s video surveillance (VMS) module integrates ONVIF-compatible cameras—including Hikvision and Dahua equipment common in Indian enterprise deployments—and supports video analytics to flag defined events. By bringing physical security events into the same operations view as network and security alerts, the platform gives manufacturing, retail, and multi-site organisations the ability to correlate a physical access anomaly with a concurrent suspicious network login attempt. Security ceases to be two separate programmes running on separate screens.
The hardest part of CERT-In’s 6-hour reporting directive is not writing the report—it is having contained the incident, preserved evidence, and assembled the facts in time to write it. Ora’s SOAR layer provides playbook automation with pre-built connectors that can push blocklists to FortiGate, revoke Azure AD sessions, or quarantine an endpoint—all within seconds of a confirmed alert, without waiting for an analyst to log in and take each action manually. Pre-built phishing response playbooks cover the full loop from alert triage through containment, evidence capture, and notification draft generation. Automation is what makes the CERT-In timeline realistic; manual processes almost never do.
If your team is assessing whether a unified SecOps platform fits your environment and SOC model, we are happy to walk through an Ora deployment framework relevant to your estate size and sector.
p=reject on all owned domains, including parked and legacy domainsPJ Networks has been securing Indian enterprise networks for over two decades, operating a 24/7 NOC and SOC and deploying Fortinet’s security fabric—FortiGate NGFW, FortiMail, FortiEDR, and ZTNA—across sectors from BFSI to manufacturing to multi-site retail. Our managed security service combines purpose-built technology, documented operational processes, and the round-the-clock expertise to run it when your team cannot.
If you are reassessing your email security posture, planning a ZTNA rollout, evaluating a managed SOC that can meet CERT-In’s reporting timelines, or simply want a second opinion on your current phishing defence stack, reach out to our team for an initial conversation. We will start with your current environment and work forward from there—no boilerplate recommendations.