Surfside Beach, South Carolina lost $545,598.30 after staff wired money to a fraudulent account based on emails from a lookalike domain. The forensic review found no compromise of the town’s internal systems or Microsoft 365, attackers simply registered a near-identical domain and used it to impersonate a trusted contractor and redirect payment.
This incident centers on Surfside Beach, South Carolina, which wired $545,598.30 to an account its staff believed belonged to a legitimate contractor. Attackers had registered a lookalike domain, surfsidesbeach.org, just days before the fraud occurred. That domain was a single extra letter away from the town's real address, close enough to pass a quick visual check during a busy workday. Using that domain, attackers impersonated trusted communications tied to an in-progress contractor payment and persuaded staff to reroute the wire to a fraudulent account.
The forensic review found no evidence of unauthorized access to the town's internal systems or Microsoft 365 accounts. This matters because it shows the attack did not rely on stolen credentials, malware, or network compromise. Instead, it exploited the narrow window between domain registration and detection, along with the natural trust placed in an ongoing vendor payment conversation. A convincing sender name and a request framed as a routine update to banking details were enough to override normal scrutiny.
Finance, accounts payable, and procurement teams should treat any vendor payment change request as high-risk by default and verify it out-of-band, calling a number already on file rather than one provided in the email. Staff training should emphasize careful inspection of sender domains for subtle typos, doubled letters, or unexpected top-level domains before acting on financial instructions. Organizations should also consider monitoring for lookalike domains registered against their name, since the gap between registration and weaponization is a realistic window for intervention. Finally, teams should recognize that an absence of account compromise does not mean an absence of risk. As this case shows, a convincing domain name and a moment of misplaced trust can be enough to cause a significant financial loss without any technical breach at all.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers registered surfsidesbeach.org, a near-identical domain with one extra letter, and used it to impersonate a trusted contractor payment conversation, convincing staff to reroute a wire payment to a fraudulent account.
No. The forensic investigation found no evidence of unauthorized access to the town's internal systems or Microsoft 365 accounts, meaning the fraud succeeded through domain impersonation alone, not account takeover.
Staff should closely inspect sender domains for subtle changes like doubled letters, swapped vowels, or an unexpected TLD, and verify any vendor payment change request out-of-band using a known phone number.
The attack relied on a convincing lookalike domain and a moment of misplaced trust rather than technical compromise, showing that domain impersonation alone can bypass traditional security controls.
Surfside Beach wired $545,598 to a fake vendor… all because of one extra letter in an email address. Attackers registered surfsidesbeach.org just days earlier, then jumped into a real contractor payment thread and said, ‘Hey, our bank details changed, send the wire here instead.’ No Microsoft 365 hack, no system breach, just a lookalike domain. Here’s the trap: the email looks routine, the payment is already in motion, and everyone trusts the thread. But the sender line has that single extra 's' and the domain flips from the real address to surfsidesbeach.org right when the bank details change. If an email changes vendor bank details, stop. Don’t trust the thread. Call the vendor using a number from your system, not the email, and confirm before a single dollar goes out.
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
Anthropic says it disrupted a Russian state-linked campaign that used Claude to continuously rebuild malware when security tools detected it. The group (GTG-20006, linked to Midnight Blizzard/APT29) ran phishing and other human-targeted schemes, including device-code token theft against Microsoft…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
Microsoft says it disrupted the “EvilTokens” phishing-as-a-service platform, which it links to compromises of over 12,000 inboxes across more than 10,000 organizations. The service used AI to tailor phishing emails to a victim’s role and to analyze compromised inboxes to identify trusted…
