The pattern
Impersonation moved beyond the inbox in 2024. At Arup in Hong Kong, the first contact was a phishing email in the name of the UK finance chief, according to Hong Kong's Security Bureau. The employee doubted it. A video call with deepfaked colleagues then removed the doubt, and HK$200 million went out. The email started the fraud. The call finished it.
State attackers polished their attachments. Midnight Blizzard sent signed remote-desktop files from real, compromised addresses, built so that each check would come back clean. Payment fraud kept its old shape. CityHousing Hamilton paid a fake contractor after the real one had warned it to call before any bank change.
A new target appeared: the assistant that reads mail. Johann Rehberger showed that an email could make Microsoft 365 Copilot search the mailbox and hide what it found in invisible characters inside a link. In February Microsoft and OpenAI reported state groups using language models to draft spear-phishing. In September HP Wolf Security described an email campaign against French speakers whose malicious scripts were likely written with generative AI. HP based that on the code itself, which explained every line in comments.
The cases
-
January 2024, disclosed February 2024, Arup named in May
Arup: a doubted email, a deepfake video call and HK$200 million
In January 2024 a finance worker at Arup in Hong Kong doubted an email from the "UK finance chief". A video call full of deepfaked colleagues removed the doubt.
-
March 2024, made public April 2025
CityHousing Hamilton pays $552,000 after the vendor had warned it to call first
In March 2024 a fake contractor email changed bank details. Two weeks earlier the real contractor had warned of a breach and asked to be called first.
-
Reported January and February 2024, disclosed August 2024
An email tells Microsoft 365 Copilot to search your inbox and hide the results in a link
In 2024 a researcher showed that hidden instructions in an email could make Copilot gather other mail and hide it in invisible characters inside a link.
-
From 22 October 2024
Midnight Blizzard mails signed remote-desktop files to thousands of officials
In October 2024 Midnight Blizzard sent spear-phishing emails with signed RDP attachments. Opening one connected the computer to the attackers' server.
What was not email, or not shown to be
Several of the year's largest incidents are often grouped with phishing. The sources point elsewhere.
- Change Healthcare. The attackers used stolen credentials on a remote-access portal that had no multi-factor authentication, according to UnitedHealth's chief executive in testimony to Congress. How the credentials were stolen has not been disclosed.
- Snowflake customers. Mandiant found that the credentials used against about 165 organisations came mainly from infostealer malware on other systems.
- Microsoft. Midnight Blizzard got in through a password spray against a legacy test account, then read the email of senior leaders. Email was the target, not the way in.
- Orion and Pepco. Orion, a carbon black maker, reported a charge of about $60 million after fraudulently induced wire transfers. Pepco Group reported losing about €15.5 million in Hungary to what it called a sophisticated phishing attack. Neither company said the fraud arrived by email, so neither is counted here.
The figures
| Measure | 2024 |
|---|---|
| All complaints | 859,532 |
| Reported losses, all crimes | $16.6 billion |
| Phishing and spoofing complaints (rank 1) | 193,407 |
| Business email compromise complaints | 21,442 |
| Business email compromise adjusted losses (rank 2) | $2,770,151,146 |
Reported losses rose 33% on 2023. Phishing complaints fell sharply, while losses to business email compromise stayed close to $2.8 billion. In December the FBI warned that criminals were using generative AI to write messages faster, to reach more people with believable content, and to avoid the grammar and spelling mistakes that once gave them away.
The UK's Cyber Security Breaches Survey 2024 found that half of businesses had experienced a breach or attack. The question had changed, so this is not comparable with 2023. Phishing was involved for 84% of them. Verizon's 2024 report measured how fast people fall for a phishing email: a median of under 60 seconds from opening it to entering their data.
Sources
- 2024 IC3 Annual Report, FBI Internet Crime Complaint Center, 23 April 2025.
- FBI press release on the 2024 report, FBI, 23 April 2025.
- Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud, FBI Internet Crime Complaint Center, 3 December 2024.
- Cyber Security Breaches Survey 2024, UK government, 9 April 2024.
- 2024 Data Breach Investigations Report, Verizon, May 2024.
- Staying ahead of threat actors in the age of AI, Microsoft Threat Intelligence, 14 February 2024.
- HP Wolf Security press release on AI-written malware, HP, 24 September 2024.
- Hackers deploy AI-written malware in targeted attacks, Bill Toulas, BleepingComputer, 24 September 2024.
- Change Healthcare, compromised by stolen credentials, did not have MFA turned on, Matt Kapko, Healthcare Dive, 30 April 2024.
- Congress circles UnitedHealth as effects of ransomware attack continue, Jonathan Greig, The Record, 30 April 2024.
- UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion, Mandiant, 10 June 2024.
- Mandiant says hackers stole a 'significant volume of data' from Snowflake customers, Zack Whittaker, TechCrunch, 10 June 2024.
- Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard, Microsoft Security Response Center, 19 January 2024.
- Russian hackers stole Microsoft corporate emails in month-long breach, Lawrence Abrams, BleepingComputer, 19 January 2024.
- Orion S.A., Form 8-K, US Securities and Exchange Commission, filed 12 August 2024.
- Carbon black supplier Orion loses $60 million in business email compromise scam, Jonathan Greig, The Record, 13 August 2024.
- Notice regarding Hungarian business, Pepco Group, 27 February 2024.
- Discount Retail Giant Pepco Loses €15 Million to Cybercriminals, Eduard Kovacs, SecurityWeek, 29 February 2024.