Discourse analysis, forensic linguistics and iag: authorship and enunciation scene in cyberattacks - phishing in the eviltokens case

Abstract

ABSTRACT: The use of Generative Artificial Intelligence (GAI) has been causing changes in the ways statements are produced, adopted, and circulated in digital environments, raising important questions for understanding authorship and the construction of discursive identities. In the field of cyberattacks, text generation systems can facilitate social engineering practices by producing statements that simulate subjects, institutions, and communicative situations, creating effects of authenticity and legitimacy. This article aims to discuss the possible connections between Discourse Analysis (DA) and Forensic Linguistics (FL), considering GAI as a tool for discursive practices related to identity simulation and the production of potentially fraudulent messages. To do this, we draw on the contributions of Maingueneau (2005 to 2024), Foucault (2009), Coulthard and Johnson (2007), Sousa-Silva and Coulthard (2016), Schmitt and Flechais (2024), Sousa-Silva (2026), Carreira and Nascimento (2020), among others, to understand the relationships between authorship, ethos, enunciation scenes, and the production of linguistic evidence. This is a qualitative research study with an interpretative approach, whose corpus consists of two enunciated excerpts related to social engineering situations from the Eviltoken case analyzed by the Microsoft security team on their blog on September 22, 2026. The analysis shows that constructing simulations of institutional identities can produce effects of legitimacy through the appropriation of socially recognized ways of speaking. We conclude that the interface between AD and LF allows for a better understanding of the relationships between enunciation, identity, and authorship, especially when language is part of social practices that can have legal consequences.