The pattern
In 2025 the reader of an email was no longer always a person. Three of the year's documented cases targeted the AI assistant that reads mail on someone's behalf. EchoLeak showed that one unopened email could make Microsoft 365 Copilot send internal data out. A report through Mozilla's 0DIN programme showed hidden text turning Gemini's summary of an email into a fake Google security alert. In September Radware described ShadowLeak, in which hidden instructions in an email made ChatGPT's Deep Research agent send personal data from a Gmail inbox to an attacker's address. OpenAI fixed it. All three were found by researchers and fixed. None was reported as used in a real attack.
The oldest pattern also held. A lookalike domain and a changed bank account still moved money. Milwaukee paid a library contractor's bill to scherrerconstruction.us. The same trick, aimed at a software maintainer, had a far larger reach. One fake npm support email from npmjs.help gave an attacker the account behind packages downloaded over 2 billion times a week.
The cases
-
Found January 2025, disclosed June 2025
EchoLeak: one unopened email could make Microsoft 365 Copilot leak data
In 2025 researchers showed that one email, never opened, could make Microsoft 365 Copilot send internal data to an attacker. Microsoft fixed it before any known abuse.
-
Published 10 July 2025
Hidden text turns a Gemini email summary into a fake security alert
In July 2025 a researcher showed that invisible text in an email could make Gemini's summary in Gmail warn of a hacked password and give a phone number to call.
-
June to September 2025
Milwaukee sends $460,866 to a builder's .us twin, and gets it back
In 2025 an email from scherrerconstruction.us, not .com, changed where Milwaukee paid a library contractor. The bank held the money and police recovered it.
-
8 September 2025
One phishing email poisons npm packages with over 2 billion weekly downloads
In September 2025 a fake npm support email from npmjs.help took over the account of the maintainer of chalk and debug, and 18 packages were poisoned.
The figures
The FBI's report on 2025, published on 6 April 2026, crossed one million complaints for the first time. It was also the first to count complaints that mention artificial intelligence.
| Measure | 2025 |
|---|---|
| All complaints | 1,008,597 |
| Reported losses, all crimes | $20.877 billion |
| Phishing and spoofing complaints (rank 1) | 191,561 |
| Business email compromise complaints | 24,768 |
| Business email compromise adjusted losses (rank 2) | $3,046,598,558 |
| Complaints mentioning AI, all crimes | 22,364 |
| Losses in complaints mentioning AI, all crimes | $893,346,472 |
| Business email compromise losses involving AI | $30,256,592 |
Losses rose 26% on 2024, and losses to business email compromise passed $3 billion. The AI figures count complaints that mention artificial intelligence, so they overlap the other categories. The report explained how AI fits business email compromise: chat generators can quickly write official-sounding emails that mimic a company's chief executive or other officials.
The UK's Cyber Security Breaches Survey 2025 found that 43% of businesses had experienced a breach or attack in the previous year, and phishing was involved for 85% of them. ENISA, the EU's cybersecurity agency, found phishing in about 60% of the intrusions in its own dataset for July 2024 to June 2025. Verizon's 2025 report said that, according to partner data, synthetically generated text in malicious emails had doubled over the previous two years.
Sources
- 2025 IC3 Annual Report, FBI Internet Crime Complaint Center, 6 April 2026.
- FBI press release on the 2025 report, FBI, 6 April 2026.
- Help Net Security report on the 2025 figures, Help Net Security, 7 April 2026.
- Cyber Security Breaches Survey 2025, UK government, 10 April 2025.
- ENISA Threat Landscape 2025, European Union Agency for Cybersecurity, October 2025.
- 2025 Data Breach Investigations Report, Verizon, April 2025.
- OpenAI plugs ShadowLeak bug in ChatGPT, Carly Page, The Register, 19 September 2025.
- ShadowLeak: Radware Uncovers Zero-Click Attack on ChatGPT, Pierluigi Paganini, Security Affairs, 18 September 2025.