Topic
A cybercrime scheme in which attackers impersonate executives, vendors, or partners via email to trick employees into wiring or diverting funds.
Fortra researcher Cadence Riddle tracked a 12-fold rise in malicious emails mentioning RFQ from October 2025 to September 2026. Nearly 73% of the lures pointed to a credential-stealing login page, Help Net Security reported.
Reality
Barracuda research describes phishing emails whose hidden prompts tell AI inbox assistants to present them as urgent or to add a vendor payment change. Malwarebytes' account says an ignored message can return as the assistant's own recommendation.
Reality
Microsoft counted more than a million of them between August 3 and 5, each carrying a fabricated ServiceNow invoice and a staged executive email thread, with the attacker's beneficiary bank details changing between targets.
Reality
French notaries lost the money to intruders who lived on their networks and edited payment details before the instructions went out, which is why bank-side verification kept waving the transfers through.
Reality
Huntress found legitimate remote management software abused in 45% of the endpoint incidents it logged in the first quarter of 2026. A rogue copy can behave like IT's approved one, so defenders have to know which tools are sanctioned and how each install arrived.
Reality
Former airmen Chijioke Timothy Odimegwu and Harafat Mogaji got a combined 189 months in federal prison for BEC scams that diverted a $1.68 million wire. Their scheme worked wherever a payer accepted new bank details on the strength of an email.
Perspective Coverage
4 publishersReality
The Cape Town Zone of Black Axe ran romance and advance fee scams from 2011 until South African police made arrests in 2021, and the accounts prosecutors traced also carried business email compromise proceeds.
Perspective Coverage
4 publishersReality
Microsoft's Digital Crimes Unit and its partners pulled down the EvilTokens phishing service about seven months after it launched, and British police arrested its two suspected operators. The authentication technique it sold survives on other platforms.
Perspective Coverage
8 publishersReality
Rapid7's research with Zimbra turned up more than 50 vulnerabilities, several of which let an attacker send mail as another user with no password involved. The operational item today is CVE-2026-73570, the SNMP command injection CISA gave federal agencies three days to fix.
Reality
Microsoft says the phishing-as-a-service platform reached more than 12,000 inboxes at over 10,000 organizations in seven months by abusing a legitimate OAuth flow, and its Digital Crimes Unit has now disrupted the infrastructure behind the service.
Reality
Microsoft Security Research reported over a million emails pairing fake ServiceNow invoices with forged forward threads. No malware ran, so the investigation lives in mail headers and accounting records.
Reality
Rapid7's read of the fraud economy names Xleet, Blackpass, Infodig and Styx as the venues doing the trade, and points teams at MITRE's Fraud Fighting Framework, introduced in early 2026, to order what they watch.
Reality
Hunt.io says a Chinese-speaking operator drove Claude Code, Alibaba Qwen and DeepSeek through an orchestration framework called SecFlow, splitting reconnaissance, exploitation and collection among specialist agents that fired only publicly documented exploits.
Reality
France's ANSSI spent two years quietly evicting a crew that had been altering payment instructions inside notary networks. The procedural fix that landed takes bank details off email rather than checking whether they changed.
Reality
Experian's respondents are funding fraud controls ahead of their own loss experience, so the question facing a finance team this quarter is less whether AI-enabled attacks land than which budget carries the answer.
Reality
KnowBe4 says a new build of the commodity infostealer uses Unicode emoji to break string signatures and keeps its final payload off disk. The lure is a spoofed bank thread aimed at finance teams.
Reality
Cisco Talos revives a 1990s criminology method to describe intrusions as narratives, then uses a business email compromise to show which steps AI makes cheap and where defenders can push back.
Reality