BEC Campaign Using AI Generated Fake Email Threads. : 11 August 2025

Dimakatso Makinta - Moderator · 2025-08-11T13:33:28+00:00

Key Points * Large-scale BEC invoice fraud campaign targets global organizations across multiple industries using urgent payment requests to exploit time-sensitive business processes. * Attackers deploy sophisticated automation including AI-generated email content, programmatic file creation, and headless browser…

Dimakatso Makinta - Moderator

Key Points

Large-scale BEC invoice fraud campaign targets global organizations across multiple industries using urgent payment requests to exploit time-sensitive business processes.
Attackers deploy sophisticated automation including AI-generated email content, programmatic file creation, and headless browser technology generating PDF invoices before distribution.
Campaign employs advanced deception techniques combining fake email threads with fabricated CEO confirmations and automated HTML construction establishing false legitimacy.

Campaign Overview

The Mimecast Threat Research team has identified a Business Email Compromise (BEC) campaign that leverages automated fake email threads to execute invoice fraud at scale. This campaign represents a significant evolution in BEC tactics, combining traditional social engineering with advanced automation using Artificial Intelligence to create convincing fabricated conversations between executives and external service providers. The threat actors construct fake email chains that appear to show legitimate business correspondence, with each thread carefully crafted to include CEO or senior executive approval for urgent invoice payments. The campaigns demonstrate clear signs of automation, from AI-generated email content to programmatically created PDF attachments that are generated using headless browser technology immediately before email transmission

Technical Analysis of the campaign reveals several indicators of automated deployment.

Linguistic and structural analysis of the email body revealed characteristics—such as highly fluent language, coherent context, and lack of typical grammatical errors—that are strongly indicative of content generated by a Large Language Model (LLM), rather than crafted manually.

The email HTML contains several embedded comments which illustrates what should go in each section of the email.

Please click here to read the entire article.
We welcome your questions; please ask them by posting a comment below.

Dimakatso Makinta

Find more posts tagged with

Threat Intelligence

Threat Intelligence Notifications

Email Threat

Email & Collaboration Threat Protection

Mimecast Threat Insights

Comments

John DeFreitas

Has Mimecast modified it's code logic to identify and block this type of attack ?

Dawn Cronin - Moderator

John:

From the article linked in this notification (Please click here to read the entire article):

"Mimecast Protection

Mimecast has implemented comprehensive detection capabilities to identify and block emails associated with this automated BEC campaign. We continue to monitor for evolving tactics and techniques used by these threat actors to ensure our customers remain protected against this sophisticated threat. View the Advanced BEC Protection page to learn more about how our advanced AI and Natural Language Processing capabilities aid in the detections of evolving threats".

I hope this helps answer your question.

Dawn Cronin

Open_Door_MSP

I am curious at how these emails are getting through if organizations are correctly configuring their SPF, DKIM, and DMARC records. I assume they are using Look-alike domains and exploiting the psychological aspect of real looking ongoing conversations from decision makers in the company? Or possibly even compromised mailboxes from the actual organization.

Toby Metcalf

Hi @Open_Door_MSP please see the full article HERE.
If that does not answer your question, please post a follow-up comment in this discussion and I will connect with the authors of the article for more information for you.

Best,
Toby

Open_Door_MSP

I see so the sending domains are attacker controlled and are impersonating what could be seen as a vendor or partner platform with real looking conversations and payment authorizations. The victim's domains are not what's being spoofed.

John DeFreitas

Hi Dawn,

We have been using BEC from the get-go (we were also a beta tester) and do have impersonation protection policies in place for senior and other staff members. We were targeted by this campaign on 7/30 however BEC did not detect and block. Attacker's email was sent to a disto list. The senders domain was @sansei -jyushi.com and was not impersonating any staff (display name). Should there be a repeat attack along these lines would BEC now be able to detect and block such campaign?

Dawn Cronin - Moderator

John:

I think the best way to get insights into your last question is to reach out to the Mimecast Support team. Having a case open will facilitate getting insights from the Mimecast Security team. You might also contact your Mimecast Customer Success team for more information, as well.

Thanks for your comments!

Dawn Cronin