IntelliOSRolling Intelligence|AIRolling BEC & Fraud Watch

Business Email Compromise Rolling Intelligence Card

AI-generated, AI-updated weekly, AI quality-checked, and source-cited, this rolling 90-day BEC Rolling Intelligence Card reconciles provider telemetry, incident-response findings, campaign research, phishing infrastructure, and claims data. It explains which identities and payment workflows attackers exploit, how ordinary MFA can be bypassed, what losses look like, and which finance, identity, and response controls prevent an unrecoverable transfer.

Coverage

Jul 30–Oct 27, 2026

Record Version

v25

Updated

Oct 20, 2026

AI Monitor

Weekly · Tue midday ET

Evidence

1 Retained Sources

Product

Rolling Intelligence Card

Classification

TLP:CLEAR

Research Framing

Field

Value

Decision Question / User Topic

Business email compromise activity that can turn a trusted message, identity, or payment workflow into direct financial loss during the active rolling 90-day window—including impersonation, gift-card and wire requests, payroll diversion, adversary-in-the-middle phishing, stolen Microsoft 365 sessions, malicious domains, and mule-account cash-out.

Interpreted Questions

What does the current evidence say about message volume, conversational lures, cash-out methods, requested amounts, affected sectors, MFA bypass, and recovery? Which figures describe attempted messages, incident-response cases, active-defense engagements, or historical insurance claims? Which controls must finance and security operate together, and who can stop a payment, revoke a session, preserve evidence, and call the bank in the first minutes?

Initial Observations

Sixteen retained sources illuminate different parts of the same loss chain. Microsoft’s Q2 report shows an anomalous April spike near 9 million BEC attacks before May and June returned to a roughly 3–4 million monthly baseline; generic outreach represented 87–92% of initial contact. Cofense adds a distinct inbox-behavior lane: its Q1 2025–Q1 2026 finance-phishing analysis found operational business language represented 59%–79% of observed subject-line patterns and 79% in Q1 2026, while separate July research documented Google Ads brand impersonation, multi-stage credential harvesting, and platform-aware kits that change delivery by device. Beazley found vendor impersonation was the leading vector in its Q1 cases and that approximately 53% of responding organizations reported full or partial MFA. APWG and Fortra provide Q1 and June cash-out baselines, Verizon’s 3,934 historical BEC claims supply loss and recovery context rather than current-quarter prevalence, and two DOJ/FBI-linked case publications add official recovery, forfeiture, restitution, and mule-account evidence without becoming a prevalence denominator.[5]Evidence dated Source date not published

Source Coverage

Tier	Checked	Candidate Hits	Planner Selected	Not Used
Tier 0 — Most Trusted / Official	2	0	0	2
Tier 1 — Authoritative / First-Party	3	0	0	3
Tier 2 — High-Value Research	0	0	0	0
Tier 3 — Corroborating News	0	0	0	0
Tier 4 — Social Media / Community Signal	0	0	0	0
Tier 5 — Custom Source	0	0	0	0
Tier 6 — Custom Integrations with API/Keys	3	1	1	2
Tier 7 — Inner Discovery	0	0	0	0
Tier 8 — Expansion Research / AI Agent Delta	0	0	0	0
Total	8	1	1	7

Complete Tier 0–8 counts are shown here. The 1 retained sources and their claim treatment are identified in Citations. Planned integrations are not counted as checked or selected.

Evidence Boundary:TLP:CLEAR, public, defensive, and source-bound. Microsoft detections are not confirmed compromises; Fortra and APWG observations are not a global census; Beazley percentages describe its response cases; Cofense subject-line percentages describe its observed finance-phishing corpus; Cofense campaign articles do not prove successful compromise or BEC conversion; webinar summaries are qualitative synthesis; DOJ/FBI-linked case publications are not a prevalence dataset; and Verizon’s 2019–2024 BEC insurance claims are an impact baseline published inside the window, not proof of current prevalence. Coveware, the FBI IC3 annual report, Coalition, and Abnormal Security were reviewed, but their relevant BEC publications predate the April 29 cutoff or do not add a new controlling BEC dataset. The decision standard is whether the company can independently verify value movement, resist session theft, revoke access, preserve evidence, and contact the bank before funds become unrecoverable.

Reporting-Period Statistics

Rolling 90-Day Intelligence Snapshot

At-a-glance measures from the retained evidence set. Citations identify the source controlling each statistic.

Period Coverage

Jul 30, 2026–Oct 27, 2026

90 calendar days, inclusive. Records are included by their first-observed date inside this window; the period does not imply that every underlying incident began or was confirmed during it.

90-day windowWeekly on Tuesday at midday ET

Jul 30 · Window opensSep 12 · MidpointOct 27 · Latest included

Evidence-Prioritized Access Paths

Top Initial Access & Account-Takeover Vectors

Evidence-prioritized, not a synthetic prevalence ranking: the retained sources use different datasets and collection methods. Beazley is the only retained source that explicitly identifies a leading vector. OAuth device-code phishing is a separate user-authorization path—not AiTM reverse-proxy token theft. It remains monitored in the connected Kali365 product, but the current Microsoft device-code publication predates this card’s Apr 30 cutoff and is therefore not counted as an in-window vector.

Trusted-account compromise

Compromised third-party vendor mailboxEvidence dated Source date not published

Leading vector in Beazley’s Q1 response cases

How it starts: An attacker gains control of a real supplier or service-provider mailbox, studies an existing relationship, and sends a request from the legitimate account or thread.
Attacker outcome: Invoice or bank-detail diversion that inherits the vendor’s real domain, signature, history, and business context.
What to monitor: Vendor payment changes; unusual reply-to or sending patterns; new inbox rules; anomalous vendor sign-ins; requests that resist callback to a known number.

Look-alike identity

Typosquatted vendor domain and credential lureEvidence dated Source date not published

Recurring vendor-impersonation path

How it starts: A near-match domain impersonates a known vendor and delivers a malicious attachment, credential-harvest page, or altered payment instruction.
Attacker outcome: Credential theft, account takeover, or direct payment diversion without first compromising the real vendor.
What to monitor: Newly registered look-alike domains; character substitutions; reply-to mismatch; altered remittance details; attachment-to-login chains.

Reverse-proxy token theft

AiTM phishing lure and session takeoverEvidence dated Source date not published

Confirmed campaign technique; also observed in response cases

How it starts: A PDF or link moves the victim through CAPTCHA and redirect stages to a proxy in front of the real Microsoft sign-in page. The victim completes ordinary authentication and MFA through the proxy.
Attacker outcome: The proxy captures the authenticated session token, enabling mailbox access without requiring the attacker to repeat the MFA challenge.
What to monitor: Compliance-themed PDFs; CAPTCHA-to-login chains; unfamiliar session properties; token replay; impossible travel; mailbox searches, rules, or messages after the sign-in.

Conversational trust entry

Authenticated, link-free role-mailbox outreachEvidence dated Source date not published

Confirmed high-scale June campaign

How it starts: Python-generated messages sent through Amazon SES pass SPF and DKIM, contain no link or attachment, and target accounts-receivable, HR, payroll, and other role mailboxes.
Attacker outcome: A reply opens a trusted conversation that can progress from aging-report or customer-data collection to payroll or payment diversion.
What to monitor: New senders asking for aging reports, employee data, or availability; tracking pixels; unusual bulk outreach; role mailboxes replying outside an approved workflow.

Conversational BEC

Generic availability check followed by financial requestEvidence dated Source date not published

Dominant initial-contact pattern in Microsoft telemetry

How it starts: A short message asks whether the recipient is available, at a desk, or able to complete a task; the attacker withholds the financial request until the recipient responds.
Attacker outcome: Gift-card purchase, wire transfer, payroll change, sensitive-document release, or a pivot into a longer impersonation exchange.
What to monitor: Short executive or vendor availability messages; secrecy or urgency after the first reply; abrupt moves to personal email, gift cards, payroll, or payment.

Process-language social engineering

Routine finance-workflow credential lureEvidence dated Source date not published

Dominant language class in Cofense’s Q1 2026 finance-phishing observations

How it starts: The subject and message resemble ordinary remittance advice, invoice review, settlement, procurement, contract, e-signature, or vendor-follow-up work instead of using obvious pressure language.
Attacker outcome: The recipient opens a credential-harvest page, releases a document, or continues a payment conversation because the request looks like normal operational traffic.
What to monitor: First-seen counterparties; unexpected remittance or review links; business-process references the recipient cannot independently validate; changes to payment, settlement, or document-sharing workflows.

Device-fingerprinted delivery

Platform-aware adaptive phishingEvidence dated Source date not published

Observed Cofense Intelligence campaign pattern

How it starts: A link collects browser, operating-system, language, time-zone, screen, and location information before selecting the next page or payload.
Attacker outcome: The same infrastructure can deliver credential phishing to one device and a remote-access tool to another, increasing campaign reach and complicating siloed detection.
What to monitor: Multi-stage redirects; user-agent or Cloudflare gating; the same lure producing different outcomes by device; shared domains or paths across email, identity, endpoint, and mobile telemetry.

Credential theft

Commodity credential-phishing kitEvidence dated Source date not published

Less common than vendor impersonation in Beazley’s case mix

How it starts: A familiar cloud-login, document, voicemail, or security-alert lure sends the user to a credential-harvesting page operated through a reusable phishing kit.
Attacker outcome: Mailbox or SaaS account takeover that supports reconnaissance, internal impersonation, persistence, and later payment fraud.
What to monitor: New credential-collection domains; cloned login pages; password reuse; unfamiliar sign-ins; new MFA methods, OAuth grants, or forwarding rules.

Identity impersonation without account compromise

Executive or display-name impersonation[5]Evidence dated Source date not published

Observed but less common in Beazley’s response cases

How it starts: The attacker uses an executive’s name, role, signature, and situational context from a free-webmail or deceptive sender address without controlling the real account.
Attacker outcome: Urgent gift-card, payroll, invoice, wire, cryptocurrency, or sensitive-data request that exploits authority rather than technical access.
What to monitor: Display-name/address mismatch; personal-mail senders; secrecy; urgency; bypassed approval steps; requests that move conversation off the corporate channel.

Delivery infrastructure

Free-webmail impersonation and malicious-domain delivery[5]Evidence dated Source date not published

72% free-webmail share in two time-bounded datasets

How it starts: Attackers use disposable or aged consumer-mail accounts, or newly registered domains, to deliver impersonation and payment lures at low cost.
Attacker outcome: Direct fraud conversation, credential harvesting, or a first-stage message that identifies responsive targets.
What to monitor: Consumer-mail senders claiming to be executives or vendors; first-seen domains; domain age; sender/reply-to mismatch; repeated language or wallet/account reuse.

Vector / Evidence	How It Starts	Attacker Outcome	What to Monitor
1 Trusted-account compromise Compromised third-party vendor mailboxEvidence dated Source date not published Leading vector in Beazley’s Q1 response cases	An attacker gains control of a real supplier or service-provider mailbox, studies an existing relationship, and sends a request from the legitimate account or thread.	Invoice or bank-detail diversion that inherits the vendor’s real domain, signature, history, and business context.	Vendor payment changes; unusual reply-to or sending patterns; new inbox rules; anomalous vendor sign-ins; requests that resist callback to a known number.
2 Look-alike identity Typosquatted vendor domain and credential lureEvidence dated Source date not published Recurring vendor-impersonation path	A near-match domain impersonates a known vendor and delivers a malicious attachment, credential-harvest page, or altered payment instruction.	Credential theft, account takeover, or direct payment diversion without first compromising the real vendor.	Newly registered look-alike domains; character substitutions; reply-to mismatch; altered remittance details; attachment-to-login chains.
3 Reverse-proxy token theft AiTM phishing lure and session takeoverEvidence dated Source date not published Confirmed campaign technique; also observed in response cases	A PDF or link moves the victim through CAPTCHA and redirect stages to a proxy in front of the real Microsoft sign-in page. The victim completes ordinary authentication and MFA through the proxy.	The proxy captures the authenticated session token, enabling mailbox access without requiring the attacker to repeat the MFA challenge.	Compliance-themed PDFs; CAPTCHA-to-login chains; unfamiliar session properties; token replay; impossible travel; mailbox searches, rules, or messages after the sign-in.
4 Conversational trust entry Authenticated, link-free role-mailbox outreachEvidence dated Source date not published Confirmed high-scale June campaign	Python-generated messages sent through Amazon SES pass SPF and DKIM, contain no link or attachment, and target accounts-receivable, HR, payroll, and other role mailboxes.	A reply opens a trusted conversation that can progress from aging-report or customer-data collection to payroll or payment diversion.	New senders asking for aging reports, employee data, or availability; tracking pixels; unusual bulk outreach; role mailboxes replying outside an approved workflow.
5 Conversational BEC Generic availability check followed by financial requestEvidence dated Source date not published Dominant initial-contact pattern in Microsoft telemetry	A short message asks whether the recipient is available, at a desk, or able to complete a task; the attacker withholds the financial request until the recipient responds.	Gift-card purchase, wire transfer, payroll change, sensitive-document release, or a pivot into a longer impersonation exchange.	Short executive or vendor availability messages; secrecy or urgency after the first reply; abrupt moves to personal email, gift cards, payroll, or payment.
6 Process-language social engineering Routine finance-workflow credential lureEvidence dated Source date not published Dominant language class in Cofense’s Q1 2026 finance-phishing observations	The subject and message resemble ordinary remittance advice, invoice review, settlement, procurement, contract, e-signature, or vendor-follow-up work instead of using obvious pressure language.	The recipient opens a credential-harvest page, releases a document, or continues a payment conversation because the request looks like normal operational traffic.	First-seen counterparties; unexpected remittance or review links; business-process references the recipient cannot independently validate; changes to payment, settlement, or document-sharing workflows.
7 Device-fingerprinted delivery Platform-aware adaptive phishingEvidence dated Source date not published Observed Cofense Intelligence campaign pattern	A link collects browser, operating-system, language, time-zone, screen, and location information before selecting the next page or payload.	The same infrastructure can deliver credential phishing to one device and a remote-access tool to another, increasing campaign reach and complicating siloed detection.	Multi-stage redirects; user-agent or Cloudflare gating; the same lure producing different outcomes by device; shared domains or paths across email, identity, endpoint, and mobile telemetry.
8 Credential theft Commodity credential-phishing kitEvidence dated Source date not published Less common than vendor impersonation in Beazley’s case mix	A familiar cloud-login, document, voicemail, or security-alert lure sends the user to a credential-harvesting page operated through a reusable phishing kit.	Mailbox or SaaS account takeover that supports reconnaissance, internal impersonation, persistence, and later payment fraud.	New credential-collection domains; cloned login pages; password reuse; unfamiliar sign-ins; new MFA methods, OAuth grants, or forwarding rules.
9 Identity impersonation without account compromise Executive or display-name impersonation[5]Evidence dated Source date not published Observed but less common in Beazley’s response cases	The attacker uses an executive’s name, role, signature, and situational context from a free-webmail or deceptive sender address without controlling the real account.	Urgent gift-card, payroll, invoice, wire, cryptocurrency, or sensitive-data request that exploits authority rather than technical access.	Display-name/address mismatch; personal-mail senders; secrecy; urgency; bypassed approval steps; requests that move conversation off the corporate channel.
10 Delivery infrastructure Free-webmail impersonation and malicious-domain delivery[5]Evidence dated Source date not published 72% free-webmail share in two time-bounded datasets	Attackers use disposable or aged consumer-mail accounts, or newly registered domains, to deliver impersonation and payment lures at low cost.	Direct fraud conversation, credential harvesting, or a first-stage message that identifies responsive targets.	Consumer-mail senders claiming to be executives or vendors; first-seen domains; domain age; sender/reply-to mismatch; repeated language or wallet/account reuse.

Intended Reader and Decision Context

Persona / Audience

Who this brief is written for, the geographic and organizational lens it uses, and how readers should apply the intelligence.

Audience Field	Assessment
Audience fieldPrimary audience	AssessmentExecutives, CFOs, controllers, treasury and accounts-payable leaders, CISOs, identity and email-security teams, legal and incident-response owners, insurers, and risk managers.
Audience fieldOrganization profile	AssessmentMost relevant to organizations that move money, change vendor bank details, issue payroll, buy gift cards, administer Microsoft 365, or rely on email for approval and account recovery.
Audience fieldDecision perspective	AssessmentUse the brief to set transaction-verification rules, define who can stop a payment, identify high-risk identities, and trigger immediate session revocation, evidence preservation, bank coordination, and law-enforcement escalation.
Audience fieldEvidence posture	AssessmentA suspicious message, domain, wallet, or login is an investigative signal. A confirmed financial loss, mailbox compromise, or actor attribution requires organization-specific evidence.

Executive Briefing Priorities

Top 10 Briefing Points

Automation Transparency

AI Agent Run Status

Agent	BEC Rolling Intelligence Card Publisher
Status	Active · rolling 90-day automation
Cadence	Weekly on Tuesday at midday ET; publish only when retained evidence materially changes fraud, identity, or response decisions
Previous run	No completed run is retained within the active rolling window · Run Not available
Previous result	The previous recorded run is outside the current 90-day coverage window and is not displayed.
What the previous run found	•No qualifying run findings are retained within the active rolling window.
Next run	At midday ET on the card's configured weekly review day.
Sources monitored	•Fortra FIRE and APWG BEC research •Microsoft Security and Defender campaign telemetry •Cofense Blog, Cofense Intelligence, and Cofense Phishing Defense Center research •Beazley Security incident-response reporting •Verizon Breach Impact Study / CyberAcuView claims analysis •DOJ, FBI, and IC3 case, PSA, recovery, and annual reporting •Coveware, Coalition, Abnormal Security, and other BEC, identity, fraud, insurance, and incident-response source streams •Connected IntelliOS identity, claims, and DFIR products •PETRA report database query constrained to the active rolling 90-day publication window; older reports remain discovery-only
Publication and alert policy	Publish and alert only for a material source-backed change; do not notify for no-change checks or date-only rolling-window movement.

Related Intelligence and CARDS Records

Other IntelliOS Products

PANDA Flash Threat Brief

Kali365 Microsoft 365 PhaaS Brief

Identity-focused analysis of Microsoft 365 phishing, token abuse, OAuth, and account-compromise risk.

Open product

Citations

Retained Sources and Claim Treatment

#	Publisher	Published	Publication / Evidence	Why Used / Claim Treatment	Source
Source5	PublisherCofense	PublishedNot available	Publication / evidenceThreat-research blog indexecosystem monitor	Why used / claim treatmentOfficial Cofense publication index monitored weekly for BEC, phishing, credential-theft, brand-impersonation, and email-defense research. The index is a discovery route; each retained article controls its own finding.	SourceCofense Blog https://cofense.com/blog