What Happened
PhishByte, a provider of phishing simulation and security awareness training, published a warning on 16 September 2026 that AI-generated phishing has made traditional detection methods obsolete for many Australian organisations.
The company said generative AI has transformed phishing emails from broad, error-filled messages into tailored communications that appear credible and specific to each recipient. Spelling mistakes, generic greetings and implausible scenarios, once reliable signals of a scam, have largely disappeared from AI-generated attacks, PhishByte said.
The figures cited by the company show a sharp escalation. AI-generated phishing accounted for 56 per cent of all phishing attacks during the December 2025 holiday period, up from a baseline of about 4 per cent. AI-related cyber threats across Australia and New Zealand also doubled in 2025 from the previous year.
Why It Matters
Australian businesses lost AUD $166.8 million to payment redirection fraud in 2025, according to figures cited by PhishByte, with AI-generated business email compromise messages increasingly tied to those losses. The average cost of a cybercrime incident for an Australian small business now stands at AUD $56,600.
PhishByte also cited a widely reported case involving a finance employee in Hong Kong who authorised a USD $25 million payment after joining a video conference in which every other participant, including the Chief Financial Officer, was an AI-generated deepfake.
The company pointed to a confidence gap among Australian workers as a compounding factor. "90% of Australians are confident they can spot a deepfake. Only 42% actually can," PhishByte said. "The gap between confidence and capability is exactly what attackers are exploiting. And with AI-generated phishing accelerating at a pace the threat landscape has never seen before, the training your team received last year is already out of date," the company added.
Key Details
PhishByte said attackers are using dark-web tools such as FraudGPT and WormGPT to produce polished corporate language within seconds. AI-based personalisation systems can also use scraped employee information to generate thousands of unique emails built around a recipient's role, employer and work context.
The shift represents a change in attacker economics. Instead of sending large volumes of generic emails in the hope of catching a few recipients, criminals can now use large language models and automated data collection to produce tailored messages at scale.
Background and Context
PhishByte pointed to the federal government's AUD $90 million Horizon 2 commitment as a sign that policymakers now recognise the risks created by staff exposure to increasingly persuasive digital deception.
The Australian Cyber Security Centre has previously documented business email compromise as one of the costliest cyber threats facing Australian organisations. The ACCC's Scamwatch programme also tracks payment redirection fraud as a persistent and growing category of financial loss for businesses.
What Comes Next
PhishByte did not specify a timeline for any product releases or regulatory submissions. The company's warning was directed at organisations relying on security awareness training developed before the widespread availability of generative AI tools.