https://antilure.com/blog Real email attacks of the last five years, one case per post, each built from court filings, regulators, the victims' own statements and reputable reporting. en Thu, 05 Nov 2026 00:00:00 GMT https://antilure.com/blog/five-years-of-email-attacks https://antilure.com/blog/five-years-of-email-attacks Thu, 05 Nov 2026 00:00:00 GMT From 2021 to 2026 the email that costs money changed its tools: lookalike domains, hijacked threads, relayed codes, AI-written text. The request did not change. summary business email compromise phishing AI assistants https://antilure.com/blog/email-attacks-2026 https://antilure.com/blog/email-attacks-2026 Thu, 05 Nov 2026 00:00:00 GMT The first ten months of 2026 brought multi-million payment fraud against US schools and counties, a breach at a defence supplier, and a fake alert in Copilot. https://antilure.com/blog/email-attacks-2025 https://antilure.com/blog/email-attacks-2025 Thu, 05 Nov 2026 00:00:00 GMT In 2025 researchers showed emails steering Copilot, Gemini and ChatGPT, one phishing email poisoned npm packages used everywhere, and the FBI began counting AI in fraud. https://antilure.com/blog/email-attacks-2024 https://antilure.com/blog/email-attacks-2024 Thu, 05 Nov 2026 00:00:00 GMT In 2024 a deepfake call finished a fraud an email had started, state hackers mailed signed remote-desktop files, and an email was shown to steer Copilot. https://antilure.com/blog/email-attacks-2023 https://antilure.com/blog/email-attacks-2023 Thu, 05 Nov 2026 00:00:00 GMT In 2023 attackers hid links in QR codes, broke email gateways with crafted attachments, studied vendors before asking for money, and sold AI tools for fraud. https://antilure.com/blog/email-attacks-2022 https://antilure.com/blog/email-attacks-2022 Thu, 05 Nov 2026 00:00:00 GMT In 2022 the best-known identity attacks arrived by text message and push prompt, while email redirected city payments and opened Dropbox's code to an attacker. https://antilure.com/blog/email-attacks-2021 https://antilure.com/blog/email-attacks-2021 Thu, 05 Nov 2026 00:00:00 GMT In 2021 one attachment led to ransomware across Ireland's health service, a real USAID mailer carried malware, and US towns paid fraudsters posing as partners. https://antilure.com/blog/pulaski-county-jail-contractor-2026 https://antilure.com/blog/pulaski-county-jail-contractor-2026 Thu, 05 Nov 2026 00:00:00 GMT One email in June 2026 changed where an Arkansas county paid its jail medical contractor. About $1.9 million went astray until the real firm asked why. payment fraud vendor impersonation changed bank details local government https://antilure.com/blog/ieh-corporation-mailbox-phishing-2026 https://antilure.com/blog/ieh-corporation-mailbox-phishing-2026 Thu, 05 Nov 2026 00:00:00 GMT In August 2026 an employee of a US military supplier entered Microsoft 365 credentials on a fake page. The mailbox held engineering files. credential phishing Microsoft 365 defence mailbox rules https://antilure.com/blog/pine-bluff-schools-thread-hijack-2026 https://antilure.com/blog/pine-bluff-schools-thread-hijack-2026 Thu, 05 Nov 2026 00:00:00 GMT In December 2025 an Arkansas school district paid a construction invoice to the wrong account. The wiring instructions had been slipped into a genuine email thread. payment fraud thread hijacking compromised mailbox schools https://antilure.com/blog/copilot-outlook-summary-fake-alert-2026 https://antilure.com/blog/copilot-outlook-summary-fake-alert-2026 Thu, 05 Nov 2026 00:00:00 GMT In 2026 a researcher showed that hidden text in an email could make Copilot's summary in Outlook show a fake security alert. Microsoft fixed it in March. AI assistants hidden instructions Outlook prompt injection https://antilure.com/blog/dickinson-schools-fake-builder-2026 https://antilure.com/blog/dickinson-schools-fake-builder-2026 Thu, 05 Nov 2026 00:00:00 GMT Between November 2025 and February 2026 a North Dakota school district sent two construction payments to a fraudster's account. The FBI recovered the money. payment fraud vendor impersonation lookalike address schools https://antilure.com/blog/npm-chalk-debug-maintainer-phishing-2025 https://antilure.com/blog/npm-chalk-debug-maintainer-phishing-2025 Thu, 05 Nov 2026 00:00:00 GMT In September 2025 a fake npm support email from npmjs.help took over the account of the maintainer of chalk and debug, and 18 packages were poisoned. credential phishing software supply chain lookalike domain MFA https://antilure.com/blog/milwaukee-library-contractor-2025 https://antilure.com/blog/milwaukee-library-contractor-2025 Thu, 05 Nov 2026 00:00:00 GMT In 2025 an email from scherrerconstruction.us, not .com, changed where Milwaukee paid a library contractor. The bank held the money and police recovered it. payment fraud lookalike domain vendor impersonation local government https://antilure.com/blog/gemini-email-summary-hidden-text-2025 https://antilure.com/blog/gemini-email-summary-hidden-text-2025 Thu, 05 Nov 2026 00:00:00 GMT In July 2025 a researcher showed that invisible text in an email could make Gemini's summary in Gmail warn of a hacked password and give a phone number to call. AI assistants hidden instructions Gmail call-back phishing https://antilure.com/blog/echoleak-copilot-zero-click-email-2025 https://antilure.com/blog/echoleak-copilot-zero-click-email-2025 Thu, 05 Nov 2026 00:00:00 GMT In 2025 researchers showed that one email, never opened, could make Microsoft 365 Copilot send internal data to an attacker. Microsoft fixed it before any known abuse. AI assistants prompt injection hidden instructions Microsoft 365 https://antilure.com/blog/midnight-blizzard-rdp-attachments-2024 https://antilure.com/blog/midnight-blizzard-rdp-attachments-2024 Thu, 05 Nov 2026 00:00:00 GMT In October 2024 Midnight Blizzard sent spear-phishing emails with signed RDP attachments. Opening one connected the computer to the attackers' server. state actor attachment spear-phishing compromised sender https://antilure.com/blog/copilot-ascii-smuggling-email-2024 https://antilure.com/blog/copilot-ascii-smuggling-email-2024 Thu, 05 Nov 2026 00:00:00 GMT In 2024 a researcher showed that hidden instructions in an email could make Copilot gather other mail and hide it in invisible characters inside a link. AI assistants prompt injection hidden instructions Microsoft 365 https://antilure.com/blog/cityhousing-hamilton-bank-details-2024 https://antilure.com/blog/cityhousing-hamilton-bank-details-2024 Thu, 05 Nov 2026 00:00:00 GMT In March 2024 a fake contractor email changed bank details. Two weeks earlier the real contractor had warned of a breach and asked to be called first. payment fraud vendor impersonation changed bank details housing https://antilure.com/blog/arup-deepfake-video-call-2024 https://antilure.com/blog/arup-deepfake-video-call-2024 Thu, 05 Nov 2026 00:00:00 GMT In January 2024 a finance worker at Arup in Hong Kong doubted an email from the "UK finance chief". A video call full of deepfaked colleagues removed the doubt. deepfake executive impersonation payment fraud secrecy https://antilure.com/blog/fort-lauderdale-fake-contractor-2023 https://antilure.com/blog/fort-lauderdale-fake-contractor-2023 Thu, 05 Nov 2026 00:00:00 GMT In September 2023 the city paid a request that posed as the contractor building its new police headquarters. The paperwork looked right. Police later recovered the money. payment fraud vendor impersonation construction local government https://antilure.com/blog/qr-code-phishing-energy-company-2023 https://antilure.com/blog/qr-code-phishing-energy-company-2023 Thu, 05 Nov 2026 00:00:00 GMT From May 2023 more than 1,000 emails carried QR codes that led to fake Microsoft 365 logins. About 29% of them went to one large US energy company. QR code credential phishing brand impersonation energy https://antilure.com/blog/new-haven-schools-bus-company-2023 https://antilure.com/blog/new-haven-schools-bus-company-2023 Thu, 05 Nov 2026 00:00:00 GMT In 2023 attackers read a school manager's mailbox, then posed as the bus contractor. Six payments went out before the real company asked where its money was. payment fraud compromised mailbox lookalike address schools https://antilure.com/blog/barracuda-esg-email-attachment-zero-day-2023 https://antilure.com/blog/barracuda-esg-email-attachment-zero-day-2023 Thu, 05 Nov 2026 00:00:00 GMT From October 2022 crafted attachments broke into Barracuda's email security gateways as they scanned them. Barracuda told customers to replace affected devices. zero-day attachment email gateway state actor https://antilure.com/blog/dropbox-circleci-phishing-2022 https://antilure.com/blog/dropbox-circleci-phishing-2022 Thu, 05 Nov 2026 00:00:00 GMT In October 2022 emails posing as CircleCI led Dropbox engineers to a fake login. The attacker used their GitHub access to copy 130 code repositories. credential phishing developer tools lookalike domain MFA https://antilure.com/blog/boulder-county-vendor-impersonation-2022 https://antilure.com/blog/boulder-county-vendor-impersonation-2022 Thu, 05 Nov 2026 00:00:00 GMT In September 2022 a fake vendor email redirected a $237,241.18 payment. The county got all of it back and now flags lookalike domains. payment fraud vendor impersonation lookalike domain local government https://antilure.com/blog/eagle-mountain-thread-hijack-2022 https://antilure.com/blog/eagle-mountain-thread-hijack-2022 Thu, 05 Nov 2026 00:00:00 GMT In August 2022 someone slipped into an ongoing email conversation about a major infrastructure project and persuaded the city to send one payment to the wrong account. payment fraud thread hijacking vendor impersonation local government https://antilure.com/blog/portland-housing-bureau-mailbox-2022 https://antilure.com/blog/portland-housing-bureau-mailbox-2022 Thu, 05 Nov 2026 00:00:00 GMT In April 2022 someone with access to a Portland Housing Bureau email account posed as a nonprofit builder and redirected a $1.4 million construction draw. payment fraud compromised mailbox local government housing https://antilure.com/blog/cottage-grove-sewer-contractor-2021 https://antilure.com/blog/cottage-grove-sewer-contractor-2021 Thu, 05 Nov 2026 00:00:00 GMT In late 2021 an impostor wrote to the city as its sewer contractor's president, from a domain with "inc" added, and said the company had moved its banking. payment fraud lookalike domain vendor impersonation local government https://antilure.com/blog/peterborough-nh-bec-2021 https://antilure.com/blog/peterborough-nh-bec-2021 Thu, 05 Nov 2026 00:00:00 GMT In the summer of 2021 a town of about 7,000 people paid its school district and a bridge contractor into fraudsters' accounts after emails that imitated both. payment fraud vendor impersonation lookalike address local government https://antilure.com/blog/nobelium-usaid-constant-contact-2021 https://antilure.com/blog/nobelium-usaid-constant-contact-2021 Thu, 05 Nov 2026 00:00:00 GMT In May 2021 the Russia-based Nobelium group took over a USAID account at Constant Contact and mailed thousands of officials a Special Alert that led to malware. state actor spear-phishing compromised sender government https://antilure.com/blog/hse-ireland-conti-phishing-email-2021 https://antilure.com/blog/hse-ireland-conti-phishing-email-2021 Thu, 05 Nov 2026 00:00:00 GMT A phishing email opened in March 2021 gave Conti ransomware its way into Ireland's Health Service Executive. It detonated on 14 May and shut down the national health IT. ransomware attachment healthcare public sector