Email Attackers Target Trusted Relationships and Routine Workflows, Report Finds
Summary
Abnormal AI's analysis of nearly 800,000 email attacks across more than 4,600 organizations finds attackers exploiting trusted relationships and routine workflows through phishing, BEC, and VEC.
Key points
- The report says phishing accounted for 58% of attacks, BEC for 11%, and VEC for more than 60% of BEC attacks.
- More than 20% of phishing attacks used redirect chains to obscure malicious pages, according to the report.
- BEC tactics varied with organization size: VIP impersonation was more common at small enterprises, while lateral attacks rose at larger organizations.
- Nearly 40% of BEC attacks exploited trust in colleagues, executives, or internal departments; 45% of those impersonated a named non-executive colleague.
- Invoice fraud accounted for 42% of VEC campaigns in North America; procurement-stage pretexts accounted for 41% in EMEA.
- The report recommends using AI to analyze identity, context, and content to detect communications that imitate normal business activity.
Article Details
- Publisher
- SecurityWeek
- Report Period
- 2026 report; analysis period not specified
- Scope
- Email attacks and the use of trusted relationships and routine workflows across organizations, based on Abnormal AI’s 2026 Attack Landscape Report.
- Sample Size
- Almost 800,000 email attacks across more than 4,600 organizations.
- Key Statistics
- Phishing accounted for 58% of email attacks.
- BEC accounted for 11% of email attacks.
- VEC accounted for more than 60% of BEC attacks.
- More than 20% of phishing attacks used redirect chains.
- Nearly 40% of BEC attacks exploited trust in colleagues, executives, or internal departments.
- Recommendations
- Use AI to analyze identity, context, and content and build behavioral baselines for employees and vendors, so attacks that mimic normal business activity can be flagged before engagement.