AI-poweredphishing occurs when cybercriminals use artificial intelligence to generatehighly personalised fraudulent emails that replicate the tone, format, andcontext of legitimate business communications. Unlike traditional phishing,AI-generated emails contain no grammar errors, reference real supplier names,and match the communication patterns of the target. The UAE Cyber SecurityCouncil confirmed this method was used in coordinated attacks on the UAEfinancial sector in July 2026.
UAEbanks were attacked last week. The government stopped them. But one detail inthe announcement almost nobody talked about: the attackers were using AI — notto break into systems, but to write the emails.
TheUAE Cyber Security Council confirmed it. AI-generated phishing campaigns,designed to look legitimate, specific, and impossible to detect throughstandard training.
Theemail arriving in your finance team's inbox tomorrow — correct supplier name,right format, right tone — may not have been written by a person. The UAE faces800,000 cyberattack attempts every day. The ones stopped last week wereannounced. The ones that were not stopped were not.
Standardphishing training teaches employees to spot errors — bad grammar, strangeaddresses, unusual urgency. AI removes every one of those signals. The emailarrives perfectly formatted, in the right context, at the right time.
MostUAE businesses have not updated their phishing training since AI became widelyavailable to attackers. The training designed for the old threat is no longersufficient on its own.
Rebuildphishing training around verification processes, not spotting visual errors
Applya mandatory 24-hour hold on all bank detail change requests — no exceptions
Verifypayment instructions by phone using numbers from your own records, not theemail
Requiretwo-person sign-off for all financial instructions above a defined threshold
Documentand test the verification process — do not rely on individual judgement underpressure
Donot delete emails or change passwords before documenting the current state —preserve headers and the full email thread as evidence. If a financial transferwas made, call your bank fraud team immediately by phone. File a report withDubai Police Cyber Crime Unit. Engage a specialist before taking furthertechnical action — the incident may indicate a broader compromise beyond thephishing email itself.
Incybersecurity assessments across UAE businesses, the most consistent gap is notin technology — it is in process. Businesses have firewalls and antivirus. Theydo not have a documented, tested process for when a payment request arrives byemail. AI phishing exploits exactly that gap.
