Abnormal AI Analyzes Nearly 800,000 Email Attacks, Finds Tactics Vary by Target
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Abnormal AI’s 2026 report analyzes 796,505 email attacks observed in late 2025. It finds phishing, business email compromise, and vendor fraud techniques vary with organizational size, employee workflows, and regional procurement practices.
Key points
- The study sampled 796,505 malicious messages from 159.4 million attacks detected across 4,669 customer accounts during July–December 2025. Findings reflect Abnormal AI’s customer base, not a globally representative population.
- Phishing accounted for 58% of observed attacks. Redirects appeared in 21.6% of phishing, while 12.4% used file-sharing lures that imitated routine document exchanges.
- VIP impersonation fell from 43% of named-identity impersonation at small organizations to 7% at large enterprises, where non-executive employee impersonation predominated.
- Lateral BEC sent from compromised internal accounts represented 0.24% of BEC at small organizations versus 23.2% at large enterprises. Higher education’s lateral BEC share reached 33%.
- Vendor or partner impersonation accounted for approximately 61% of BEC. Among BEC attacks reaching shared mailboxes, 81% were vendor-related.
- A separate analysis of more than 18,500 high-risk vendor-fraud campaigns found invoice inquiries were the leading pretext at 41.3%. Billing-account updates had the highest vendor-account compromise rate, at 26.5%.
- Invoice fraud led vendor-fraud pretexts in North America at 42%, while requests for quotes led in EMEA at 41%. The report cautions that smaller non-North American samples make regional findings directional rather than definitive.
Article Details
- Publisher
- Abnormal AI
- Report Period
- 2025-07-01 to 2025-12-31
- Scope
- Serious email threats observed across Abnormal AI customers in three regions, 43 countries, and 21 industries; excludes spam, graymail, and unwanted mail. Segment comparisons reflect the customer base, not global targeting prevalence.
- Sample Size
- 796,505 messages randomly sampled from 159.4 million detected attacks across 4,669 customer accounts; supplemental census of 18,500+ high-risk VEC campaigns with verified categorical labels.
- Key Statistics
- Phishing accounted for 58% of observed attacks; BEC accounted for roughly 11%.
- Redirect links appeared in 21.6% of phishing attacks; 10.2% of redirect-using phishing attacks relied on link shorteners.
- Vendor or partner impersonation accounted for approximately 61% of BEC.
- Lateral BEC represented 0.24% of BEC at small organizations and 23.2% at large enterprises, compared with a sample average of 13%.
- Among high-risk VEC campaigns, 87.5% used impersonation and 8.95% involved compromised vendor accounts; compromise reached 26.5% for billing account update pretexts.
- Recommendations
- Build continuously updated behavioral baselines for employees and vendors using identity, communication context, and message content.
- Evaluate messages against organization-specific communication patterns, approval workflows, vendor relationships, and identity structures before recipients engage.
- In RFQ-heavy environments, assess potential vendor fraud during relationship-building rather than waiting for a payment request.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
officemail@ubscco[.]online | Sender address on attacker-controlled infrastructure used for a CEO-impersonation BEC email requesting outstanding vendor invoice details to enable follow-on fraud. |
MITRE ATT&CK
T1078 · Valid AccountsAttackers used compromised employee, student, and vendor accounts to send authenticated malicious messages.T1534 · Internal SpearphishingCompromised internal accounts delivered phishing and BEC messages to trusted recipients within the same organization.T1566.002 · Spearphishing LinkCredential-theft emails used malicious links disguised as document-sharing notifications and an American Express chargeback notification.T1656 · ImpersonationAttackers impersonated executives, employees, internal departments, and vendors to obtain sensitive business information or induce fraudulent payments.
People
Andrew RudAcknowledged for contributions to the report's research, analysis, and writing.Callie BaronAcknowledged for contributions to the report's research, analysis, and writing.Elizabeth SwantekAcknowledged for contributions to the report's research, analysis, and writing.Erin LudertAcknowledged for contributions to the report's research, analysis, and writing.Izzy TantilloAcknowledged for contributions to the report's research, analysis, and writing.Piotr WojtylaAcknowledged for contributions to the report's research, analysis, and writing.Steven KendallAcknowledged for contributions to the report's research, analysis, and writing.Vincent AielloAcknowledged for contributions to the report's research, analysis, and writing.
Vendors
Products
Industries
Construction & EngineeringThe construction and engineering industry runs close behind at 21.3%.Education- [Industry Insight: Higher Education’s Lateral Attack Challenge](#industry-insight-higher-educations-lateral-attack-challenge)Financial ServicesWithin financial services, 22.2% of phishing attacks use file-sharing lures—nearly double the 12.4% sample average.GovernmentGovernment agencies have the highest billing account update rate of any industry at 40.8% of VEC—approximately 1.7x the sample average of 23.6%.Hospitality### Why Hospitality Leads in Brand ImpersonationMedia and entertainment### Invoice Fraud in Media and EntertainmentNonprofits### VIP Impersonation in NonprofitsTechnologyBrand impersonation borrows credibility from the software platforms employees already trust, and its prevalence tracks closely with the size and complexity of an organization’s technology footprint.