You post a few photos from a concert on Instagram. The next day, an email arrives that appears to be from the venue, offering you access to exclusive photos from the show. It mentions the artist you saw and even references the night you attended. Sounds legitimate, right? You might be tempted to click without giving it a second thought. But what if that email came from a scammer who used artificial intelligence to study your social media posts?
That’s the alarming possibility researchers at the University of Texas at Arlington have uncovered. Their study shows how widely available AI tools can gather personal details from public social media accounts and turn them into highly convincing phishing emails. Even more concerning, the technology can generate these personalized messages at a scale that once required far more time and effort. Think about the photos and updates you’ve shared recently. Could someone use those details to convince you an email is legitimate? According to this research, the answer could be yes.
Missed CyberGuy LIVE? Watch the replay and discover 5 ways to travel smarter and save money.
Our free CyberGuy LIVE class, 5 Ways to Travel Smarter and Save Money, has ended, but you can still watch the full replay. Kurt “CyberGuy” Knutsson walks you through five practical ways to protect your phone and personal information, avoid common travel scams, find better deals, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Watch the free replay + downloadable checklist now at CyberGuyLive.com.
AI-POWERED CYBERATTACKS FUEL ‘BLACK OCTOBER’ FEARS
You’ve probably seen your share of phishing emails. Maybe someone claims there’s a problem with your bank account or a package couldn’t be delivered. Many of these scams follow familiar patterns, and we’ve become pretty good at spotting the obvious ones. But AI is giving scammers a much more personal approach. Researchers at the University of Texas at Arlington studied a technique known as context-aware spear phishing. In plain English, it means using details about someone’s everyday life to create a scam that feels like it was written specifically for them.
Let’s say you recently returned from a vacation in Brazil. You posted photos of the hotel and tagged a few places you visited. A scammer could use AI to analyze those posts and generate an email that appears to come from your hotel. The message might thank you for staying and offer a discount on your next visit. Everything seems to line up with your actual trip. However, the link could lead to a fake website designed to steal your password or credit card information.
Shirin Nilizadeh, an associate professor in UTA’s Department of Computer Science and Engineering who led the study, explained why this is so concerning. “Anyone can be the attacker, and that makes it scarier,” Nilizadeh said. And she’s right. Someone using these tools may need very little personal knowledge about you. Your public posts can provide much of the information needed to create a believable message.
The research team, which included graduate student Elham Pourabbas Vafa and researcher Sayak Saha Roy, examined how AI could analyze public social media activity and generate personalized phishing emails. According to the research paper, the team studied 200 public Instagram accounts. They found that as few as 10 posts from an individual could provide enough information to create highly targeted messages.
The researchers evaluated more than 18,000 AI-generated emails and compared them with thousands of real-world phishing messages. The AI tools pulled information from travel photos and public updates about upcoming events. They also examined personal concerns people had shared online. From there, the technology created emails that appeared relevant to each person’s recent experiences. The researchers even tested how AI could customize subject lines, sender names and links to make the messages more believable.
Consider something as simple as posting that you’re excited about an upcoming concert. A scammer could use that information to send a fake ticket confirmation or an offer for upgraded seats. If you had recently complained about a delayed flight, an email offering compensation might arrive at just the right moment. These examples show how easily familiar details could be turned against someone. In a user study, participants generally rated the AI-generated emails as more convincing and less suspicious than the real-world phishing examples used for comparison.
However, the researchers evaluated people’s reactions to the messages in a controlled setting. They did not measure how many people would actually click the malicious links during a real attack. Even with that limitation, the results raise serious concerns about how easily personal information can be used to manipulate someone’s trust.
One of the most unsettling parts of this research is that scammers may never need to hack your social media account. If your profile is public, they can potentially collect details you’ve already shared with the world. And those details can make an otherwise suspicious message feel familiar.
An email mentioning a restaurant you visited yesterday might seem harmless. So could a message referencing a concert you attended over the weekend. When the timing and details are accurate, people may be less likely to question where the message came from. That’s the advantage scammers are hoping to exploit.
This research adds another concern because AI can automate much of the work involved in creating personalized messages. There’s also the problem of how polished these emails can sound. We’re used to looking for spelling mistakes and awkward wording. AI can produce professional-sounding messages, so those traditional warning signs may be missing. You could receive an email that looks perfectly normal, references something you actually did and still comes from someone trying to steal your information.
A SCAMMER HAS YOUR NAME, PHONE NUMBER AND ADDRESS. WHAT CAN THEY ACTUALLY DO?
Now, you might assume AI companies already have safeguards that prevent people from using their tools to create phishing scams. They do. But the researchers found that those protections had significant weaknesses. The team tested three widely used AI safety tools: Llama Guard, ShieldGemma and WildGuard. These systems attempt to recognize harmful requests before an AI model responds.
With their default settings, the tools detected only 0% to 19% of the requests to create personalized phishing attacks. That’s a pretty troubling result, especially considering how quickly AI can generate these messages.
The researchers then explored whether more specific instructions could help the safety systems recognize these attacks. The improvement was substantial. After researchers adjusted the safeguards to identify context-aware phishing attempts, detection rates reached as high as 99% in their tests. That’s encouraging because it suggests stronger safeguards are possible. However, those results came from a research setting. They don’t guarantee that every malicious request would be blocked in the real world.
The researchers also left the exact instructions used to generate their phishing emails out of the public paper. They wanted to avoid providing criminals with a ready-made guide. Nilizadeh is urging AI companies to take these threats seriously and improve their protections against targeted social engineering attacks.
These findings show how easily scammers could turn everyday social media posts into convincing emails. You don’t need to stop sharing your life online, but it’s worth being more thoughtful about what strangers can see. And there are several practical ways to protect yourself if a suspicious message reaches your inbox.
Start by checking who can see your posts on Instagram, Facebook and other social media platforms. If your accounts are public, strangers may be able to view your photos and personal updates. Consider limiting access to approved followers and reviewing older posts that reveal more than you’d like. You can follow our guide on how to change your Instagram privacy settings. Keep in mind that people can still share or screenshot content from private accounts.
Posting vacation photos while you’re still away can reveal where you are. The same goes for announcing upcoming travel plans or tagging yourself at an event. Consider waiting until you’re home to share certain experiences. Also, check location tags and other details in your photos before posting them publicly. You don’t need to stop sharing the things you enjoy, but a little discretion can make it harder for strangers to follow your activities.
If an email arrives from a hotel or another business referencing something you recently did, don’t assume it’s legitimate. Open the company’s official app or type its website address into your browser instead of clicking the email link. You can also contact the business through a phone number you’ve independently verified. Be especially suspicious when a message asks you to sign in, provide payment information or respond urgently. Even a familiar-looking sender address can be spoofed.
Strong antivirus software can help protect your devices if you encounter a phishing attack. Some security tools can warn you about known dangerous websites and detect malware hidden in suspicious attachments or downloads. That’s valuable protection if you accidentally click something malicious. However, antivirus software cannot guarantee that every phishing website will be blocked, especially if you voluntarily enter your information. Keep your security software updated and turn on its available protection features. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.
FAKE CHATGPT BILLING EMAILS CAN STEAL YOUR LOGIN
Scammers can learn more about you than you might realize. Data brokers and people-search websites may expose your home address, phone number and other personal details that criminals could use to make phishing emails more convincing. A personal data removal service can help find that information and request its removal from covered websites. While no service can erase everything about you online or remove your public social media posts, it can help reduce the personal information available to scammers. You can also request removals yourself for free, although doing so across multiple websites can take time. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.
A scammer who steals one password may try using it to access other accounts. That’s why every important account should have a unique, strong password. A trusted password manager can help you create and store them. Enable multifactor authentication wherever possible, preferably with an authenticator app or security key. Passkeys can offer even stronger phishing resistance on supported services. And never share a verification code with someone who contacts you unexpectedly.
Security updates help close vulnerabilities that criminals can exploit. Turn on automatic updates for your phone, computer and browser whenever possible. It’s also worth checking that your email provider’s spam and phishing filters are active. Gmail, Outlook and other major email services already block many suspicious messages, although some attacks can still get through. If you receive a suspicious email, use the built-in option to report it as phishing.
Accidentally clicking a phishing link doesn’t automatically mean your device has been compromised. However, if you think you’ve encountered a scam, here’s what to do next.
One final suggestion. When an email seems unusually well-timed or knows something personal about you, give it a second look. That little bit of hesitation could prevent a very expensive mistake.
I think most of us understand that sharing personal information online comes with some risk. But this research takes that concern in a direction many people probably haven’t considered. You could share a perfectly innocent photo from dinner or a weekend getaway and later receive an email that seems to know exactly where you’ve been. I can see how someone might trust that message, especially if it arrives at the right time and looks like it came from a familiar business. That’s what worries me. AI is making it easier for criminals to use our own experiences to earn our trust. And they may be able to do it without spending much time researching us individually. I’m encouraged that the researchers found ways to improve AI safety filters. I’d like to see companies put those findings to work. In the meantime, I think we all need to be a little more careful about what we post publicly and a lot more skeptical of unexpected emails, even when the details seem right.
Should AI companies be held responsible when their technology helps criminals create convincing scams? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Newsletter
Copyright 2026 CyberGuy.com. All rights reserved.