Social Media Ideas for Business Email Compromise

Threat Actors Abuse Trusted Accounts and Internal Tools to Launch Convincing BEC Attacks

Attackers are continually finding new ways to refine business email compromise (BEC) attacks, according to Douglas McKee, Director of Vulnerability Intelligence at Rapid7. When at...

Business email fraud drives bulk of US cybercrime losses: Analysis

New FBI-based analysis shows business email compromise caused more than seven times the combined losses from ransomware, data breaches and IP theft in 2025

Why business email compromise keeps landing on law firms, and why nobody is covering it

The verification rule has been in the Legal Practice Council Rules for years. Whether it gets followed on a busy Friday afternoon is a separate matter. If you have been anywhere ne...

Fake Acquisition Scam Uses Forged NDAs to Demand €626,000 Corporate Payment.

Threat actors impersonated Gen executives and major consulting firms in a targeted business email compromise-style operation that used forged non-disclosure agreements to isolate a...

AI phishing kits are making micro businesses worth attacking, Coalition warns

BEC claims up 30% as US$500-a-month kits bypass MFA

Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise

Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using phishing, stolen session tokens an...

Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments

A large email fraud campaign used fake CEO messages and invoices to push employees toward payments of nearly $50,000. The operation did not rely on a malicious attachment or softwa...

Scammers Exploit Dell and Staples Order Emails to Bypass Traditional Phishing Detection

Scammers are abusing legitimate Dell and Staples order notifications to deliver callback phishing lures, embedding fraudulent helpline numbers inside transactional emails that pass...

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passk...

Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems

Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024....

Revolut Disclosed Sensitive Data in Sophisticated Impersonation Scam

One of the tell-tale signs of fraudulent communications has traditionally been the domain from which a message originates, as cybercriminals often use lookalike websites and email...

Business-Themed Phishing Lures Deliver RMM Tools

Microsoft is tracking phishing campaigns that use various lures to deliver MSP360, a legitimate RMM tool that attackers are abusing to gain a foothold on compromised systems.

The devil is still in the email – but wearing a new mask

When phishing can increasingly pass familiar checks, avoiding or limiting the damage depends on how quickly your company can detect and contain the attack

Financially Motivated Threat Actor BREEZE COMET Targets Brazil

Introduction  Beginning in 2024 Mandiant investigated a string of compromises affecting Brazilian financial services, retail, and eCommerce organizations. Google Threat Intelligenc...

Direct Send: How Attackers Weaponize Your Infrastructure Against You

Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service (SaaS) offerings throug...

Hackers Breach Brazilian Financial Firms and Execute Hundreds of Fraudulent Transactions

A financially motivated threat actor tracked as BREEZE COMET has breached Brazilian financial, retail, and eCommerce organizations, using privileged access to payment platforms to...

Former US Air Force members sent to prison over BEC attacks

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC...

Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines

Attackers are turning routine business complaints into malware traps. A message about a damaged delivery or refund request can look ordinary, yet one click leads employees to a fak...

Phantom Deal Hackers Impersonate Executives and Use Fake NDAs to Steal Corporate Wire Transfers

Cybercriminals are using fake acquisition deals to steer employees toward large wire transfers. The campaign, called Phantom Deal, begins with a believable WhatsApp message from so...

Only a third of small firms actively block email spoofing their domain

About a third of small CPA firms have implemented a measure that prevents fraudsters from sending fake emails in their name but the majority remain vulnerable to impersonation.

US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access

ANY.RUN researchers traced a US-focused CSuite phishing campaign across 351 sandbox analyses, with 51% of submissions coming from the United States. Technology, manufacturing, gove...

Undetected HR Identity Fraud Compromises Company Networks

Attackers have been exploiting critical Zimbra flaw to steal emails

A simple email gives the attackers the ability to remotely inject OS commands.