Research shows that more than half of all spam emails are now generated by AI, while the use of AI in more targeted attacks such as BEC remains limited for now.
An analysis shows that more than 50 percent of all spam emails today are composed using generative AI. More advanced email attacks such as BEC (Business Email Compromise) are currently making less use of this technology.
More spam, fewer errors
Researchers from Columbia University, University of Chicago and Barracuda analyzed emails sent between February 2022 and April 2025. This shows that the use of AI in spam has increased significantly since the launch of ChatGPT in November 2022. In April 2025, 51 percent of spam was generated by AI. For BEC attacks, this share is currently much lower, at 14 percent.
Spam is easier to automate and often targets large volumes. That’s why it pays off for attackers to use generative AI. BEC attacks require customization. They are usually aimed at specific individuals within an organization, often with a financial request.
Grammar
The researchers trained detectors to recognize AI-generated emails. They assumed that emails from before November 2022 were written manually. Based on this, they could measure the rise of AI in email attacks.
The analysis shows that AI is mainly used to make emails more formal and grammatically correct. This makes them harder to recognize and allows them to more easily bypass security systems.
Motives and defense
Criminals also use AI to test variations of the same email. This allows them to investigate which versions are most effective in persuading victims or evading security. This strongly resembles A/B testing as used in marketing.
read also
Cybercriminals pose as OpenAI
However, the tactics behind emails are not changing for now. Both human and AI-generated emails often contain a sense of urgency, such as “urgent transfer” or “click now”. The difference is mainly in language use and presentation