Your attacker has an AI assistant too — what a security demonstration this month means for the way you approve payments

A company approves a wire transfer to an overseas supplier. The invoice is real, the supplier is real, the amount matches the contract. The only thing that changed is the bank account number, and it changed because an email arrived from the managing director’s own address, in his own phrasing, referring to a thread the two of them actually had a few weeks earlier.

On 4 August, during Black Hat week in Las Vegas, the red team at security firm Barracuda published a step by step demonstration of exactly that sequence. What they used to pull it off was not malware. It was an AI assistant, the same kind your business may have switched on last quarter.

For eleven weeks this column has been about pointing AI at your own work. This week, the other side of the table. The tools that make your finance team faster are making fraud faster in the same way, and the gap between those two speeds is where the money goes missing.

Seven steps from one compromised mailbox to a redirected wire transfer, with the AI assistantdoing the work at every stage. (Branded graphic by PGH Consulting, LLC) What the researchers actually did The attack began with something ordinary: one employee’s email account was compromised. That is the boring part, and it happens every day through a convincing login page.

What happened next is the new part. Instead of a person reading through months of email looking for something useful, the attackers put the account’s own AI assistant to work. They had it create an inbox rule that pushed sign-in alerts straight to Deleted Items, so the employee never saw the warnings.

They asked it to summarise the mail history and map who reported to whom, which surfaced the chief executive as the target worth having. Then they asked it to draft a phishing email in the employee’s natural writing style, referencing a real conversation the two had already had. The chief executive clicked, and a lookalike site sitting between him and the real login page captured his session token, letting the attackers walk past multifactor authentication without ever needing the password.