40 percent of BEC attacks are AI generated

Almost half (49 percent) of all detected spam emails are attributed to business email compromise (BEC) scams, with the CEO, followed by HR and IT, being the most common targets according to a new report.

The research from VIPRE Security Group puts a more sinister complexion on this trend, revealing that a full 40 percent of the BEC emails uncovered were AI-generated, and in some instances, AI likely created the entire message.

VIPRE processed 1.8 billion emails globally, detecting 226.45 million spam emails and 16.91 million malicious URLs to identify the email threat trends that impact enterprises the most. The research has identified 16.91 million malicious URLs, a 74 percent rise from the previous year.

Phishing remains a dominant threat with attackers favouring URL redirection and cloud-hosting services. Threat actors increasingly targeted the manufacturing sector with 25 percent of email attacks, followed by retail (which was absent from 2023's targets) at 20 percent and real estate at 11 percent. This suggests attackers are focusing on industries perceived as lacking advanced cybersecurity measures.

The US tops the list of countries sending and receiving spam (receiving nearly half of all phishing emails), most likely thanks to its vast data center infrastructure. Consistent with last quarter, the UK was the second-largest source of spam, followed by Canada, Sweden, and Iceland; three countries that failed to make the list either last quarter or this time last year.

"As AI technology advances, the potential for BEC attacks grows exponentially. Malefactors are now leveraging sophisticated AI algorithms to craft compelling phishing emails, mimicking the tone and style of legitimate communications," says Usman Choudhary, chief product and technology officer at VIPRE Security Group. "The next wave of BEC attacks could see attackers using AI to dynamically analyse and exploit real-time information, creating tailored and contextually accurate scams nearly indistinguishable from genuine correspondence. Enterprises must stay ahead by adopting robust AI-driven defenses and continuously educating their workforce on emerging threats."

You can get the full Email Threat Trends Report on the VIPRE site.

Image credit: fitztudio/depositphotos.com