AI turns public social posts into targeted scam emails in UT Arlington study

An email that knows about a recent vacation or concert interest need not come from someone familiar. University of Texas at Arlington researchers found that widely available AI tools could turn public social-media details into personalized scam emails. Their study also found that tested safety tools missed most requests to create those messages under default settings.

The university described the findings in a November 2 research release. Shirin Nilizadeh, an associate professor of computer science and engineering, led the study, with graduate student Elham Pourabbas Vafa as a co-author. Their work examines context-aware spear phishing: fraudulent messages tailored around details of a recipient’s life.

Everyday updates become the bait

Spear phishing is not new. Nilizadeh contrasts this approach with targeted scams built around relatively fixed information, such as an employer or job title. Here, the tools drew on recent public posts, including photos. The material for a message could come from what someone had just done, wanted to do or worried about.

• Travel: The team tested emails built around details of people’s trips.
• Events: Messages drew on interests in activities such as concerts.
• Personal concerns: The researchers also used worries people had shared online as material for tailored emails.

The personalization extended beyond the email’s main text. Researchers tailored subject lines, sender names and links to each recipient. The emails were designed to get people to click malicious links and surrender sensitive information, including passwords or credit card numbers. The same personal context could therefore shape several parts of the apparent approach.

UTA illustrates the risk with a hypothetical hotel email following a trip to Brazil. A message thanks the traveler for staying and offers a discount on another visit. Details drawn from vacation posts make it appear connected to a real experience, even though the hotel did not send it. That is an illustration, not a reported victim’s case.

Participants in a user study gave the generated emails high marks for quality. That result concerns how the messages were judged; it does not establish that recipients clicked their links or handed over information. The distinction matters when assessing the study’s finding: convincing-looking output is not itself a measured rate of successful fraud.

The safeguards needed a more specific warning

The team tested Llama Guard, ShieldGemma and WildGuard, safety tools intended to identify harmful AI requests. This part of the research examined whether safeguards recognized requests to generate personalized phishing emails—not whether an inbox filter caught the finished email. The researchers were looking for a way to stop production of the messages.

0%–19%Default settings

Detection rates for attack requests ranged from 0% to 19% with the tested tools’ default settings.

As high as 99%Specific instructions

Giving the safety tools specific instructions to recognize these attacks raised detection rates as high as 99%.

The higher figure is a best reported result, not a claim that every tested tool reached 99%. Nilizadeh urged AI companies to take highly targeted social-engineering attacks seriously and put safeguards in place to prevent their tools from producing them. The intervention tested here was explicit recognition guidance for the safety tools.

A public paper without the attack instructions

The researchers withheld the exact instructions used to generate the scam emails from the public version of their paper to reduce the risk of misuse. That disclosure concerns the attack-generation instructions, rather than the separate guidance used to help safety tools recognize the requests.

According to UTA, the study has been accepted for presentation at the Network and Distributed System Security Symposium in Seoul in March 2027. Pourabbas Vafa also presented the research at the Texas Security Workshop at the University of Texas at Dallas.