Generative AI Raises the Stakes for Fake Login Page Attacks
Generative AI is making fraudulent login pages faster to create, easier to tailor and harder for employees to distinguish from legitimate authentication portals. The 2026 Verizon Data Breach Investigations Report found that phishing represented 44% of the AI-assisted initial-access techniques it examined, underlining the continued role of credential theft in account compromise.
Attackers can reproduce familiar branding, logos, page layouts and sign-in prompts, then pair them with personalised IT notifications aimed at a particular organisation or employee. Lookalike domains with small spelling changes or extra characters add another layer of deception. The individual techniques are established, but generative AI enables campaigns to be created, customised and adapted more rapidly and at greater scale.
Credential collection can extend beyond passwords
A fake portal may imitate a multi-step sign-in process and collect a one-time MFA code as well as a username and password. Attackers can then attempt to use that code before it expires to enter corporate accounts or applications.
More advanced campaigns use adversary-in-the-middle techniques. A fraudulent site operates as a proxy, passing authentication requests between the victim and the legitimate service in real time. Once the user authenticates successfully, an attacker may capture a session cookie or authentication token.
That token can enable session hijacking: access to an already authenticated account without another password entry or MFA challenge. MFA remains an important control, but an active session can become the target when an attacker is able to intercept the authentication flow.
Why established anti-phishing controls have gaps
Security awareness training can help users spot phishing, yet even experienced staff may miss subtle signals when a page presents familiar corporate branding and expected authentication prompts. Email filtering, URL blocklists and reputation services can stop known threats, but newly registered domains and short-lived sites may avoid detection.
Phishing links can also arrive through text messages, collaboration platforms and search advertising rather than email. Inspecting an address remains useful, but lookalike domains are deliberately difficult to recognise. A valid HTTPS connection encrypts traffic; it does not establish that the destination is legitimate.
Controls to reduce the impact of a compromised account
Organisations can use phishing-resistant MFA, including FIDO2 security keys and passkeys, whose cryptographic authentication is tied to legitimate website domains. Browser-level protections can identify suspicious URL patterns, lookalike domains and brand impersonation before users submit credentials.
Authentication and session monitoring can surface unfamiliar devices, unusual sign-in locations and suspicious session behaviour. Least-privilege policies, removal of unnecessary standing privileges and just-in-time access reduce what a compromised account can reach. A documented response process should also cover reporting, session revocation, credential resets and investigation of unauthorised access.
The practical priority is to protect the point of credential entry as well as the inbox: combine phishing-resistant authentication, website detection and session controls so that a convincing fraudulent page has fewer opportunities to become an account takeover.