Cranbury, New Jersey wired $26 million to the wrong party
The township of about 4,000 says it was tricked during a land purchase and disclosed the September 28 loss after an election.
Stories per day · 30 days
2 RSS
Relatedphishing5microsoft-3654wire-fraud3aitm2device-code-phishing2email-security2law-enforcement2local-government2mfa2token-replay2account-takeover1adversary-in-the-middle1aitm-phishing1bec1clickfix1credential-theft1cryptocurrency1cybercrime1
14 stories, newest first · one card per story
Stories tagged #business-email-compromise
Three men arrested over AI executive and lawyer impersonation fraud
Prosecutors say the scheme took more than $129 million from companies worldwide between 2024 and 2026.
Commentary: signature email security misses fraud from trusted accounts
The essay cites Verizon’s 2026 report, with third parties in 48% of breaches, and FBI BEC losses above $3 billion.
Whitsett, NC warns of phishing from compromised town email
On October 22 the town found its Microsoft 365 account had sent a fake payment report with two attachments and a PDF password.
1
Huntress ranks RMM abuse and mailbox attacks atop SMB threats
Huntress says RMM abuse was 45% of Q1 2026 endpoint incidents and mailbox manipulation 24.6% of 2026 ITDR signals.
1
Token replay gave attackers Microsoft 365 access at 79 organizations
Huntress logged 497 successful sign-ins and over 200,000 failures from July 14 to September 22, 2026.
2
INTERPOL Serengeti III nets 1,462 arrests and $105 million
Agencies in 21 countries identified 65,929 victims and losses exceeding $385 million from June 29 to August 31.
2
M365 token spray and replay campaign hits 79 organizations
Huntress saw 497 successful sign-ins and more than 200,000 failed attempts from July 14 to September 22, 2026.
3
Proofpoint says generative AI is weakening email behavior detection
One actor emailed more than 30 agents with unique property pitches that all ended in the same meeting request.
1
Hackers disguise phishing as promising business opportunities
Fortra tracked a twelvefold rise in RFQ phishing that steals business credentials, MFA data, and sessions.
Business Email Compromise (BEC) Attacks: How to Stop Them
Huntress explains business email compromise, citing $55 billion in global losses and attacks at 36% of surveyed firms.
2
EvilTokens made phishing-as-a-service look easy. Then it got taken down
Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.
3
Microsoft’s EvilTokens takedown sheds light on state of AI-powered cybercrime
Microsoft seized EvilTokens infrastructure after the AI phishing service compromised about 12,000 Microsoft 365 inboxes.
1
Credential Theft: How Attackers Steal & Use Stolen Credentials
Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.