Business email compromise (BEC): tactics, warning signs and defensive guidance, with $55B in reported global losses
Huntress published an explainer on business email compromise (BEC), a targeted form of phishing in which attackers impersonate or take over trusted email accounts to redirect payments or steal credentials. The article cites roughly $55 billion in worldwide losses and a Huntress survey of 500+ US IT professionals, in which 36% of organizations reported a BEC attack in the past 12 months. It highlights the growing use of generative AI, voice cloning and deepfakes to make impersonation more convincing. It also lists past cases: Children's Healthcare of Atlanta ($3.6M), Facebook and Google (over $100M), Toyota Boshoku (over $37M) and Grand Rapids Public Schools ($2.8M). This is general awareness and guidance content, not a report of a new incident.
Technical Details
- Typical attack chain: reconnaissance, adversary-in-the-middle (AiTM) phishing, account takeover, impersonation of an executive or vendor, and deception to obtain payment or data.
- Common scam types: invoice scams, CEO fraud, payroll diversion, voice cloning, email spoofing, gift card scams, fake account-compromise notices, attorney impersonation and data theft.
- Post-compromise artifacts to hunt for: malicious inbox rules that hide, delete or forward mail, external forwarding addresses, unknown MFA devices, unapproved OAuth app grants, and sign-ins from unusual locations or hosting/VPN IPs.
- AiTM phishing kits can steal session tokens after MFA is completed, so MFA alone does not stop BEC. Many BEC emails contain no links or malware and evade traditional filters.
Remediation
- Revoke all active sessions and refresh tokens first, then reset the password.
- Remove inbox rules, external forwarding, unknown MFA devices and unapproved OAuth grants.
- Review sign-in logs and mailbox audit logs to establish the access vector and scope, and check whether other accounts were phished from the compromised mailbox.
- If a payment was sent, contact the bank immediately to request a recall and file a report with the FBI IC3.
- Verify payment changes out of band using a known phone number.
- Deploy phishing-resistant MFA (passkeys, FIDO2), ITDR monitoring, security awareness training and simulated phishing, and use a dedicated payment portal.
- Warn finance staff, vendors and customers who were in contact with the compromised account.
Linha do tempo
-
Business email compromise (BEC): tactics, warning signs and defensive guidance, with $55B in reported global losses
ler a análise desta fonte ocultar
Huntress published an explainer on business email compromise (BEC), a targeted form of phishing in which attackers impersonate or take over trusted email accounts to redirect payments or steal credentials. The article cites roughly $55 billion in worldwide losses and a Huntress survey of 500+ US IT professionals, in which 36% of organizations reported a BEC attack in the past 12 months. It highlights the growing use of generative AI, voice cloning and deepfakes to make impersonation more convincing. It also lists past cases: Children's Healthcare of Atlanta ($3.6M), Facebook and Google (over $100M), Toyota Boshoku (over $37M) and Grand Rapids Public Schools ($2.8M). This is general awareness and guidance content, not a report of a new incident.
Technical Details
- Typical attack chain: reconnaissance, adversary-in-the-middle (AiTM) phishing, account takeover, impersonation of an executive or vendor, and deception to obtain payment or data.
- Common scam types: invoice scams, CEO fraud, payroll diversion, voice cloning, email spoofing, gift card scams, fake account-compromise notices, attorney impersonation and data theft.
- Post-compromise artifacts to hunt for: malicious inbox rules that hide, delete or forward mail, external forwarding addresses, unknown MFA devices, unapproved OAuth app grants, and sign-ins from unusual locations or hosting/VPN IPs.
- AiTM phishing kits can steal session tokens after MFA is completed, so MFA alone does not stop BEC. Many BEC emails contain no links or malware and evade traditional filters.
Remediation
- Revoke all active sessions and refresh tokens first, then reset the password.
- Remove inbox rules, external forwarding, unknown MFA devices and unapproved OAuth grants.
- Review sign-in logs and mailbox audit logs to establish the access vector and scope, and check whether other accounts were phished from the compromised mailbox.
- If a payment was sent, contact the bank immediately to request a recall and file a report with the FBI IC3.
- Verify payment changes out of band using a known phone number.
- Deploy phishing-resistant MFA (passkeys, FIDO2), ITDR monitoring, security awareness training and simulated phishing, and use a dedicated payment portal.
- Warn finance staff, vendors and customers who were in contact with the compromised account.