Business Email Compromise

Business email compromise involves fraudulent actors gaining unauthorized access to corporate email accounts to conduct financial fraud, espionage, or social engineering attacks. These breaches pose significant governance risks because attackers can impersonate executives to authorize unauthorized wire transfers, access sensitive data, or compromise downstream systems. For enterprises, defending against BEC requires coordinated controls spanning email authentication, access management, user training, and transaction verification procedures that fall under broader information security and compliance frameworks.

1 item

ResearchGlobal2026-08-04

Email AI Assistants Can Be Weaponized to Steal $250K and Suppress Audit Logs

Barracuda Networks researchers demonstrated a proof-of-concept attack in which a compromised email account's built-in AI assistant is turned against the enterprise, suppressing audit logs, conducting internal reconnaissance, and ultimately redirecting a $250,000 wire transfer. The attack uses only the AI tool's existing legitimate permissions, making it invisible to standard behavioral monitoring. Traditional compensating controls including MFA and email authentication did not prevent the attack chain.

Barracuda Networks business email compromise Living off the Land email AI assistant audit log integrity agentic AI BEC fraud prompt injection