Threat actors are increasingly improving their tactics to make suspicious emails look like legitimate email notifications to potential victims, deploying techniques that impersonate internally sent emails from executive team members. While this technique is not new, the adoption of AI has enabled threat actors to improve their campaign templates and construct emails tailored to their recipients. Additionally, threat actors are incorporating multiple techniques within the same email to improve the overall narrative further.
In this blog, we will discuss a recent campaign observed using third-party email delivery infrastructure to send out over a million financial fraud scam emails that displayed multiple indicators consistent with the use of generative AI during email template creation. The threat actor impersonated CEOs of multiple target companies, attempting to convince accounts payable departments of the same companies to process an Automated Clearing House (ACH) payment of nearly $50,000. To add legitimacy, the actor included a forwarded email thread (and a fabricated invoice) between the impersonated CEO and ServiceNow (which was also being impersonated).
Read more…
Source: Microsoft News
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Hackers are breaking into company networks via hacked CCTV camera software
October 29, 2026
Attackers abused camera management software to gain initial access and establish persistence on networks. Campaign used DLL sideloading and reverse shells to evade detection and maintain control. Researchers urge treating camera systems as security-sensitive assets and monitoring them for abnormal activity. Read more… Source: Sign up for the Cyber Security Review Newsletter The latest cyber security news and insights delivered ...
- Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents
October 28, 2026
Personally identifiable information belonging to thousands of U.S. Department of Homeland Security employees has been published online after a hacker stole reams of data in a previously undisclosed breach at the government department earlier this year. The breach includes names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, ...
- A security flaw in these widely used barcode scanners could open up warehouses and stores to cyberattack
October 28, 2026
Researchers find Bluetooth flaws in warehouse barcode scanners that could provide a foothold into enterprise networks. Attackers could spoof scanner input, inject keystrokes, and potentially pivot to ransomware or data theft. Kaspersky urges stronger device authentication, network segmentation, and stricter security controls for warehouse infrastructure. Read more… Source: TechRadar News Sign up for the Cyber Security Review Newsletter The latest cyber ...
- Rogue AI agent engages ‘Skynet mode’ to search the internet for exposed LLMs to hijack and run malware attacks
October 26, 2026
Researchers uncovered an autonomous AI attack campaign that hijacks exposed AI agents and infrastructure. The malicious “Skynet” agent deployed cryptominers, stole credentials, and recruited new AI systems autonomously. Security teams are urged to secure AI endpoints, restrict permissions, and protect high-value API keys. Read more… Source: TechRadar News Sign up for the Cyber Security Review Newsletter The latest cyber security news ...
- Patient records exposed in Quest breach
October 26, 2026
Quest Diagnostics has confirmed that an unauthorized party accessed a system healthcare providers use to order laboratory tests and view results, affecting personal information and patient records. Quest is a major US laboratory testing company whose services help healthcare professionals diagnose and monitor medical conditions. Those services range from routine laboratory testing to specialized testing in ...
- A 16-year-old bug could be putting millions of routers at risk — despite Broadcom saying it patched the issue years ago
October 26, 2026
A Broadcom WPS flaw dating back to at least 2010 lets attackers within Wi-Fi range run code on routers without the password. Broadcom told the researcher it replaced the code from 2018, but declined to assign a CVE, calling the software obsolete. Changing your Wi-Fi password won’t help, and disabling WPS may not either; firmware updates or ...