This page may contain stale information. Last updated: 2026-09-23
This is a stub page. It needs to be expanded with proper content.
Definition
Business Email Compromise (BEC) is a social-engineering fraud pattern where attackers impersonate trusted contacts — executives, vendors, or colleagues — to trick employees into authorizing wire transfers, changing payment details, or exposing sensitive data. Modern BEC campaigns increasingly use AI to analyze compromised inboxes and draft contextually convincing impersonation messages.
Key Points
- EvilTokens (Sep 2026): Microsoft disrupted a PhaaS platform that automated BEC by AI-analyzing up to 5,000 emails per batch to map org charts and payment authorizations (eviltokens)
- Overlaps with spear-phishing and device-code-phishing as initial access vectors
- Primary defense: MFA, payment verification workflows, and ai-agent-security monitoring
Related
- spear-phishing
- eviltokens
- device-code-phishing
- agentic-threat-actors
- ai-security
- account-takeover-fraud