A Banca Ifis manager received payment-request emails from someone posing as a colleague and approved transfers totaling about €23.8 million. The incident is a business email compromise (BEC) case: the attacker used a trusted internal identity and a routine payment workflow rather than a technical exploit.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A colleague’s email. A €23.8 million mistake. In May 2026, a Banca Ifis manager got emails from someone posing as a colleague: ‘Hi, please urgently approve the attached payment request from your colleague.’ The payments were approved. Funds went through Spain, Singapore, Hong Kong, and Bahrain. That’s business email compromise: a familiar name isn’t proof. Before approving a payment, call your colleague on a number you already know.
OpenAI says it disrupted a Cambodia-based scam network that used ChatGPT to run investment and romance scams, impersonate law enforcement, and recruit workers using fake job ads aimed at people in India. The group used the tool to create believable personas, translate scam messages, and generate…
EU regulators are investigating Booking.com over phishing, fraudulent listings, and impersonation scams affecting travelers and accommodation partners. The article describes several real campaigns, including fake Booking.com messages that sought payment details from customers and complaint-themed…
EU regulators are investigating whether Booking.com has done enough to stop criminals from posting fake properties and taking over real property-owner accounts. The reported scam workflow involves attackers posing as accommodation owners and sending guests messages demanding additional payments,…
An Arup employee transferred $25 million to fraudulent accounts after joining a video call featuring deepfake impersonations of company executives. The case shows how realistic-looking executive impersonation can pressure employees into approving high-value payments, even when the request appears…
OpenAI says it disrupted a Cambodia-based scam network operating from Poipet that used ChatGPT to scale romance, investment, gambling, and law-enforcement impersonation scams. The group used messaging apps to build trust, then pressured victims to pay deposits, activation fees, or fake fines,…
Researchers say a one-click phishing link could trick ChatGPT into creating a malicious AI “agent” inside a company’s ChatGPT workspace. The agent could act using the employee’s existing access (Outlook, Teams, Slack, Google Drive, etc.), run on a schedule, and take instructions from attacker…
