Loading story…
Business Email Compromise (BEC) and Vendor Email Compromise (VEC) have emerged as significant threats to organizations, leveraging trusted relationships and sophisticated deception techniques to achieve financial and data theft. Attackers frequently gain unauthorized access to email accounts, often by compromising credentials or exploiting third-party vendors, and then use this access to monitor communications, create forwarding rules, and gather sensitive information. Once inside, adversaries may spend weeks or months surveilling email traffic, collecting intelligence on business processes, financial transactions, and supply chain relationships. This information is then weaponized to craft convincing fraudulent emails, such as fake invoices or requests to change bank account details, which are sent to employees or partners who are unlikely to question messages from familiar contacts. The use of AI-driven language models allows attackers to mimic the tone and style of legitimate correspondents, making detection by both humans and traditional secure email gateways (SEGs) challenging. Malicious content is often delivered via reputable file-sharing services, further reducing suspicion. Organizations that lack proper audit logging, such as Unified Audit Logging (UAL) in Microsoft Exchange environments, may be unable to determine which emails were accessed or what data was exfiltrated, hampering incident response and remediation efforts. Security teams are advised to ensure that audit logging is enabled and to regularly review configurations to support forensic investigations. Advanced detection tools, such as Darktrace / EMAIL, have demonstrated the ability to identify subtle anomalies in email behavior, flagging out-of-character messages even when they originate from trusted vendors. In one documented case, Darktrace detected four separate vendor compromise campaigns targeting a single customer within a two-week period, highlighting the prevalence and persistence of these attacks. The impact of BEC and VEC incidents can be severe, resulting in direct financial losses, reputational harm, and exposure of sensitive corporate data. Attackers may also use compromised information to launch further phishing campaigns or to infiltrate additional organizations within the supply chain. Effective defense requires a combination of technical controls, such as AI-powered anomaly detection, and procedural measures, including employee training and robust incident response planning. Organizations are encouraged to treat ongoing conversations with vendors and partners with appropriate scrutiny, especially when financial transactions or sensitive data are involved. Regular reviews of email security configurations and proactive monitoring for suspicious activity are essential to mitigate the risks posed by these evolving threats. The growing sophistication of BEC and VEC attacks underscores the need for continuous improvement in both technology and user awareness to protect organizational assets and relationships.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Business email compromise (BEC) operators continued to defraud organizations through social engineering-heavy email campaigns that often avoided malware and attachments, instead impersonating executives, employees, and trusted business contacts to request wire transfers, gift cards, contract payments, and invoice changes. Researchers reported that attackers abused a wide range of email infrastructure, including free and local email services, encrypted providers, self-registered look-alike domains, and compromised accounts containing stolen email threads, while also hiding malicious routing through deceptive `Reply-To` addresses and spoofed display names. The activity showed increasing sophistication across industries and regions, with some campaigns using acquisition-related pretexts, telecom-themed domains, multilingual lures, and COVID-19 or tax-related narratives to pressure victims into urgent financial action. Security firms said BEC remained one of the most financially damaging cybercrime threats, particularly in the Americas and Europe, and urged organizations to combine stronger email protections with employee awareness, careful review of sender details, and out-of-band verification for payment or account-change requests.
Aug 15, 2026
Organizations across industries are facing a surge in email-based attacks, with phishing, impersonation, and account takeover attempts driving a significant increase in breaches. Attackers are leveraging email as the primary entry point, with malware delivered via email rising by over 130% year-over-year and scams and phishing incidents also seeing substantial growth. The manufacturing, retail, and healthcare sectors are particularly targeted, with attackers exploiting outdated systems and user behavior to bypass security controls, resulting in business disruption, data loss, and financial fraud. At the same time, advancements in AI-driven technologies such as voice cloning are making social engineering attacks even more effective. Red teaming exercises have demonstrated that AI-enabled deepfakes can convincingly impersonate employees, tricking help desks into resetting credentials and granting unauthorized access. These sophisticated vishing attacks highlight the urgent need for organizations to test their defenses against both traditional and emerging social engineering techniques, and to educate staff on recognizing and responding to these evolving threats.
Jul 12, 2026
Recent reporting and vendor research indicate threat actors are increasingly prioritizing **identity-based intrusion paths**—notably phishing, credential theft, and **Business Email Compromise (BEC)**—over traditional vulnerability exploitation as the most common initial access vector. A Darktrace report cited by SC Media describes identity breaches as the leading entry point, alongside broader trends including accelerated breach tempo, increased automation, and “converging” tactics; it also notes exploitation can occur **before public disclosure** and that overall **CVE volume rose by 20%+ year-over-year**. Email remains a dominant delivery mechanism in these identity-first campaigns. Darktrace telemetry referenced by SC Media reported **32M+ high-confidence phishing emails** across its customer base, with many messages bypassing baseline controls (including **70% passing DMARC**), targeting executives, using **malicious QR codes**, and leveraging newly registered domains. Separately, a SOCRadar analysis frames the U.S. financial sector as a disproportionate target for phishing and dark-web activity, emphasizing AI-enabled crime, persistent BEC, and third-party/supply-chain risk, and citing metrics such as **~48% of global financial phishing activity** and **~23.5% of finance-related dark web threat activity** attributed to the U.S. market.
Jun 29, 2026