78RISK
Deepfake-assisted BEC
Finance received a convincing voice call and email chain impersonating the CFO.
Full brief ▾
A finance analyst reported a phone call from "the CFO" (matching voice) urgently requesting a $480k wire to a new supplier, reinforced by a spoofed email thread. The analyst paused and escalated. No funds have moved yet.
index=email sourcetype=header | where from_display="CFO Name" AND from_domain!=corp_domain OR reply_to!=corp_domain | table msg_id, from_domain, reply_to, subjectdetection query
index=email sourcetype=header | where from_display="CFO Name" AND from_domain!=corp_domain OR reply_to!=corp_domain | table msg_id, from_domain, reply_to, subject
Signal feed3 events
2026-07-18T10:30:00Zemailfrom_display=Jordan Vale (CFO) · from_domain=corp-finance-secure.com
ts2026-07-18T10:30:00Z
sourceemail
from_displayJordan Vale (CFO)
from_domaincorp-finance-secure.com
reply_tojvale.cfo@proton.me
subjectURGENT wire - new supplier
2026-07-18T10:45:00Zvoipfrom_display= · from_domain=
ts2026-07-18T10:45:00Z
sourcevoip
from_display
from_domain
reply_to
subject
2026-07-18T10:50:00Zfinancefrom_display= · from_domain=
ts2026-07-18T10:50:00Z
sourcefinance
from_display
from_domain
reply_to
subject
▸ syncing case…