Financial Spear Phishing Digest

Greek police recovered the full €4 million in a BEC attack where suspects illegally accessed a shipping company's correspondence with a foreign bank,...

Vendor Impersonation Campaigns

• 🔥 VEC Engagement Data: Abnormal's report on 1,400+ organizations shows 44.2% employee engagement with read VEC...

Vendor impersonation campaigns exploit brand trust by nesting malicious redirects inside legitimate security-vendor domains. A recent...

Attackers abuse Microsoft's Device Authorization Grant to phish high-value accounts by tricking users into entering codes on official login pages.

-...

AI is driving device-aware phishing that fingerprints victims for tailored malware while compressing attack timelines, demanding faster...

• AI-generated phishing reaches 54% click-through rates versus 12% for traditional campaigns, using LLMs for automated reconnaissance and polymorphic...

LLMs now automate the entire spear-phishing chain from reconnaissance to personalized delivery, fueling a 14-fold surge that accounts for four in ten...

• Scale: FBI logged 22,364 AI-related complaints in 2025 totaling exactly $893,346,472 in losses.
• Techniques: AI-generated scripts now enhance...

AI-Assisted BEC from Compromised Inboxes

• 🔥 Kali365 Claude Integration: After stealing Microsoft 365 OAuth tokens via device-code phishing,...

Manufacturing's high-volume payment flows and fluid supplier networks mirror financial transaction environments, creating parallel spear-phishing...

Article 1 frames supplier bank account verification—confirming legitimacy, account validity, and ownership via independent channels—as the control...

• After device-code phishing yields an OAuth token, Kali365 feeds captured M365 threads to Claude, which scores conversations for fraud potential and...

• Attacker registered hyphenated lookalike domain, sent via Gmail API sales tool, earning clean SPF/DKIM/DMARC passes.
• DMARC policy set to p=none...

ClickFix now reaches macOS by delivering an AppleScript link that opens Script Editor to run attacker commands, extending the Windows...

BEC-as-a-Service Platform Details

• 🔥 ARToken Kit Capabilities: Cisco Talos analysis describes ARToken as a mature BEC operations environment with...

AI is transforming AR/AP attacks by enabling deepfakes, synthetic vendor identities, and fabricated invoices that bypass traditional controls.

-...

• Session token capture via Tycoon 2FA and legitimate Microsoft OAuth grants attackers direct M365 access
• Device fingerprinting from user-agent data...

FTC 2025 data shows business impersonators, especially fake bank agents, drove $1 billion in losses, underscoring targeted social engineering against...

Device code phishing abuses Microsoft's legitimate auth flow to harvest M365 access and refresh tokens without passwords.

• Attackers initiate the...

Why does Business Email Compromise remain effective against financial organizations despite high awareness?

• Technical deception relies on account...