How attackers use AI to take over your email, watch your conversations, and steal your money. Not one phishing email anymore: an AI agent impersonating you across a whole thread, cloning your CFO's voice, and replying to your team in real time while it drains the account.
$2.8 billion lost to BEC in 2024 alone · Every step of it is preventable with the right controls
The old playbook was one spoofed email asking finance to wire money. Modern BEC is fundamentally different. Attackers take over a real mailbox, study the victim for weeks, then deploy an AI agent that reads incoming replies and responds in the victim's tone in real time. It can sustain a twelve-message thread with your CFO while running a thousand other victims at the same time. Traditional defenses were not designed for this.
Attackers scrape a LinkedIn video, a podcast clip, or a voicemail greeting and clone the executive's voice. "Call to verify" no longer works if the voice on the line is fake.
$243K average loss per voice-clone fraud. Keepnet 2026Arup, Hong Kong, 2024: a finance employee wired $25.6M across fifteen transactions after a video call where every other participant, including the CFO, was an AI deepfake. Singapore, 2025: same playbook, $499K.
Widely reported, 2024 to 2025A language model reads the victim's sent mail, learns their tone, vocabulary, and signature, then answers incoming questions in real time while the human attacker focuses on the wire. Your team never hears from a non-fluent attacker.
82% of 2025 phishing AI-generated. SecuredIntelPhishing-as-a-service kits (Tycoon 2FA, EvilProxy, Sneaky 2FA, Mamba 2FA) sit between the victim and the real Microsoft or Google login, capture the password and the session cookie, and skip the MFA prompt entirely.
Microsoft Security BlogOne attacker now runs thousands of parallel BEC conversations. Each email references the victim's real vendors, projects, and pending invoices, scraped from compromised inboxes and public sources.
Verizon DBIR 2025: pretexting nearly doubledAttackers reply inside legitimate threads with vendors and clients, often from a look-alike domain that differs by one character. Your team sees a familiar thread and trusts it.
Abnormal Security 2025: vendor email compromise engagement 90% higher than standard BECEvery modern BEC follows the same five phases, and each phase has specific technical controls that stop it. Understand the chain and you know exactly where to invest.
A phishing kit steals the session cookie. MFA bypassed.
Hidden inbox rules forward your mail. AI reads everything.
Map your vendors, approval flow, and pending invoices.
A look-alike domain or hijacked thread changes the wire instructions.
The wire goes out before anyone notices. 88% of BEC transfers are wires.
Each control with exactly where to configure it in Microsoft 365 and Google Workspace, and why it matters in the AI era. The first six stop the attack chain. The last four catch it if the first six fail.
SMS codes, authenticator-app codes, and push notifications are all defeated by adversary-in-the-middle kits. Passkeys and FIDO2 hardware keys (YubiKey, Titan) bind the credential to the legitimate domain, so a reverse-proxy phishing page cannot complete the challenge.
Entra ID › Security › Authentication methods › enable Passkey (FIDO2), then a Conditional Access policy requiring phishing-resistant MFA
Admin Console › Security › Authentication › 2-Step Verification › "Only security keys", and enroll in the Advanced Protection Program
The number one way attackers keep silent persistence. An auto-forward rule sends a copy of every inbound message to the attacker even after the password is rotated. Block it at the tenant level, not the user level. Almost no one has a business reason to auto-forward externally.
Defender › Email & collaboration › Anti-spam › Outbound spam policy › AutoForwardingMode = Off. Also: Set-RemoteDomain Default -AutoForwardEnabled $false
Admin Console › Apps › Google Workspace › Gmail › End User Access › disable "Automatic forwarding"
Phone back to a number from your vendor master file, never the number in the email. In the deepfake era, a voice alone is not enough: pair the callback with a pre-shared codeword or a specific shared-history question the AI cannot answer. Required for every wire, every ACH change, every banking-detail update, and every gift-card request.
Document it in your money-movement runbook with an approval matrix by dollar threshold and a sign-off log. The playbook below gives you the templates.
Add DLP rules that flag outbound mail mentioning "wire", "ACH", or "banking change" for a second approval.
Run it every week. Look for rules with single-character names, rules that forward externally, rules that move mail to RSS Subscriptions, Conversation History, or Junk, and any ForwardingSmtpAddress set on a mailbox. These are the classic indicators of a compromised mailbox.
Get-Mailbox -RecipientTypeDetails UserMailbox | Get-InboxRule | Where {$_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo}Security Center › Investigation Tool › search "Email forwarding" and filter for external destinations
Stops attackers from spoofing your domain to your own employees or your customers. Quarantine is not enough: it sends suspicious mail to spam, where employees still see and trust it. Reject blocks delivery entirely.
TXT record at _dmarc.yourdomain.com:v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100
The Cythentic™ exposure scan checks your SPF, DKIM, and DMARC posture in about a minute.
Legacy protocols (IMAP, POP3, basic-auth SMTP) do not support MFA, and attackers target them on purpose. Block them tenant-wide, then layer Conditional Access requiring a trusted device, a compliant location, and phishing-resistant MFA for high-risk actions.
Entra ID › Conditional Access › "Block legacy authentication" policy, then "Require phishing-resistant MFA for all users"
Admin › Security › Access and data control › Context-Aware Access › require a security key and a corporate device
Attackers register typosquats, Unicode homographs, and alternate top-level domains days before launching. Continuous monitoring catches the registration so you can block the domain at your gateway before the first phish arrives.
DNSTwist (open source), DomainTools, Bolster, and the Cythentic exposure scan, which surfaces look-alike domains registered against your brand for free.
Pre-register the obvious typosquats of your primary domain on day one. Around $15 a year per domain, and infinite return the day one of them prevents a wire.
Traditional signature-based gateways are blind to AI-written BEC: no malicious links, no malware, no spelling tells. Modern filtering (Microsoft Defender for Office 365, Abnormal, Mimecast, Cloudflare Email Security) detects tonal anomalies, impersonation patterns, and behavioral deviations from learned baselines.
Defender for Office 365: enable Safe Links, Safe Attachments, Zero-hour Auto Purge, and Attack Simulation Training
Admin › Security › Gmail safety › enable advanced phishing and malware protection plus enhanced pre-delivery scanning
When you have an incident, you need 90 or more days of mailbox activity to reconstruct what the attacker did, saw, and sent. Enable auditing for every mailbox and ship the logs somewhere that alerts on suspicious patterns.
Set-OrganizationConfig -AuditDisabled $false
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $trueAdmin › Reporting › Audit logs › enable, and export to your SIEM via BigQuery
Quarterly phishing simulations aimed specifically at finance, accounts payable, and executive assistants, the people who actually move money. Pair them with a printed playbook: callback verification, pre-shared codeword, approval matrix by dollar threshold, and an incident quick card for when something goes wrong.
Defender for Office 365 › Attack Simulation Training (built in)
Remi coaches each person through the lures that actually work, on their work and personal accounts, continuously. A Cythentic phishing assessment shows you who clicks today.
The procedural controls that stop AI-BEC even when your tools fail. Work through the checklist here, then print it, or have us send you the formatted version to circulate to finance, accounts payable, and the executive team.
Tell us where to send it. We will email you the playbook laid out for your team, and if you want, walk finance and IT through it on a short call. No drip sequence, no sales follow-up unless you ask for one.
We use your email only to send the playbook and, optionally, to schedule the walkthrough.
Run these this week. If you find any of these indicators, treat that mailbox as compromised: rotate the password, revoke every session, and audit the OAuth grants immediately.
# Connect first: Connect-ExchangeOnline
Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox |
ForEach-Object {
Get-InboxRule -Mailbox $_.Identity |
Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo -or $_.DeleteMessage }
} | Format-Table Mailbox,Name,ForwardTo,RedirectTo,DeleteMessage
Get-Mailbox -ResultSize Unlimited |
Where-Object { $_.ForwardingSmtpAddress -ne $null -or $_.ForwardingAddress -ne $null } |
Format-Table DisplayName,UserPrincipalName,ForwardingSmtpAddress,ForwardingAddress,DeliverToMailboxAndForward
Get-OrganizationConfig | Format-List AuditDisabled,UnifiedAuditLogIngestionEnabled
Get-Mailbox -ResultSize Unlimited |
Where-Object { $_.AuditEnabled -eq $false } |
Format-Table DisplayName,UserPrincipalName,AuditEnabled
Get-MgUserOauth2PermissionGrant -All |
Where-Object { $_.Scope -match "Mail\.Read|Mail\.ReadWrite|Mail\.Send" }
# Admin Console › Security › Investigation Tool › Source: Gmail log events
# Filter: Event = "Forwarding address added" OR Event = "POP/IMAP enabled"
# Time range: last 90 days
# For each finding: confirm the user authorized it, or revoke and rotate.
# Rule names that mean "hidden": "." " " ".." "a" "b" (single character, single dot, or blank) # Rule actions that mean "exfiltration": ForwardTo: an external address Move to folder: RSS Subscriptions, Conversation History, Junk, Archive MarkAsRead + Delete # Mailbox-level red flags: ForwardingSmtpAddress set AuditEnabled changed to $false in the last 90 days New OAuth grant with a Mail.* scope to an unknown app
If any of these come back positive, you are probably in an active incident. Do not wipe anything. Preserve the mailbox, rotate credentials from a clean device, revoke sessions, and use the Have a Breach button at the top of the page. The first hour matters more than anything that follows.
Selected incidents that defined the threat landscape.
A finance employee wired fifteen separate transactions after a video call where every other participant, including the CFO, was an AI-generated deepfake. Now the canonical reference case.
Widely reported: CNN, FT, ReutersA finance director joined what appeared to be a routine call with senior leadership. The CFO requested an urgent transfer. None of the executives on the call were real.
Multiple 2025 reportsTotal U.S. deepfake fraud losses reached $1.1 billion in 2025, up from $360 million the year before. Voice-clone-only attacks averaged $243,000 each.
Keepnet Labs 2026A single platform, Tycoon 2FA, drove 30 million malicious emails that Microsoft blocked in one month, roughly 62% of all Microsoft-blocked phishing. It makes MFA-bypass attacks available to non-technical criminals.
Microsoft Security BlogAttackers attempted to steal more than $300 million through vendor email compromise in a year. 83% of large enterprises were hit, and 98.5% of these scams went unreported until the money was gone.
Abnormal Security 202521,442 BEC complaints in 2024 totaling $2.8 billion in confirmed losses. The second-costliest cybercrime category. Nearly $8.5 billion cumulative over the three years through 2024.
FBI IC3 2024 Annual ReportTwo surprises every executive learns the hard way after a BEC: how little the cyber policy actually pays out for it, and how far behind the law still is.
BEC was the leading cause of cyber-insurance claims globally in 2025, about 31% of all incidents. But the payout is rarely full:
The regulatory frame around AI-enabled BEC is fragmented and moving fast:
Every step of the attack chain maps to something you can verify, test, or fix. Most of it you can do yourself with the controls above. Where you want independent proof, or a second set of eyes, this is where we come in.
| Attack phase | What the attacker does | How Cythentic helps |
|---|---|---|
| 1 · Compromise | A phishing kit steals the session cookie and MFA is bypassed. | MFA gap analysisRemi™We verify that phishing-resistant MFA is actually enforced everywhere, including the bypass paths a login screen never shows. Remi walks every employee through setting it up on their own accounts. |
| 2 · Watch | Hidden inbox rules, ForwardingSmtpAddress, and OAuth grants keep the attacker inside. | Security assessmentFree scanWe audit forwarding rules, OAuth grants, and audit logging across the tenant, and the free exposure scan shows your email authentication posture from the outside. |
| 3 · Identify | The AI maps your vendors, invoices, and approval workflow. | Phishing assessmentRemiA controlled campaign shows exactly who clicks, before an attacker finds out. Remi keeps coaching them afterward. |
| 4 · Strike | A look-alike domain or hijacked thread delivers the banking change, backed by a voice clone if needed. | Free scanPlaybookThe exposure scan surfaces look-alike domains and DMARC gaps. The playbook above gives finance the callback procedure and codeword that defeat the deepfake. |
| 5 · Drain | The wire moves to a mule network and the 72-hour recovery window starts. | IR readinessHave a BreachWe build and rehearse the first hour before you need it. If it is happening now, Corey has led response on some of the largest breaches on record. |
| Foundation | Everything above sits on a network an attacker may already be inside. | Penetration testVirtual CISOIndependent testing of the external and internal network, and ongoing security leadership without a full-time hire. |
The free exposure scan shows your email authentication gaps, look-alike domains registered against your brand, and what is exposed to the internet, in about a minute, with nothing to install. Then put Remi in front of every employee so the people who approve your wires are the hardest ones to fool.
Verifying the ten controls across every mailbox, testing your people, and proving it to your insurer is what a Cythentic engagement handles. Business email compromise is where businesses actually lose money, so it is the first thing we lock down.