Email AI Assistants Abused to Hijack CEO Accounts and Redirect Wire Transfers

Barracuda Networks researchers demonstrated a proof-of-concept attack showing how email-integrated AI assistants such as Microsoft Copilot could amplify business email compromise after a single mailbox is breached. In the simulated intrusion, attackers used the assistant to create stealthy inbox rules, map internal relationships, summarize sensitive threads, and mimic a user’s writing style, allowing them to conduct reconnaissance and launch convincing internal phishing from a legitimate account.

The attack chain escalated from an employee mailbox to the CEO’s account by capturing the executive’s session token through an adversary-in-the-middle proxy, bypassing MFA and giving the attackers control of the real mailbox. From there, the CEO’s AI assistant was used to identify a legitimate pending wire transfer—reported in one scenario as $247,500—and generate fraudulent payment instructions redirecting funds to an attacker-controlled bank account, while forwarding or deleting messages to conceal the fraud; researchers warned that the risk extends beyond Copilot to any AI assistant with inbox access.