Cybercriminals are using AI to identify valuable accounts in stolen employee data. For finance teams, that could mean more targeted payment fraud attempts, including fraudulent requests sent from genuine email accounts.
A stolen password isn't always the most valuable thing on a compromised employee's device. Their email history, browser sessions and access to financial systems can tell criminals much more about where to strike.
New research from cybersecurity firm BI.ZONE suggests attackers are using AI to analyse this stolen information and identify victims with access to valuable business accounts.
The development could make it easier for criminals to find employees involved in payment processes, increasing the risk of business email compromise (BEC) and fraudulent bank account changes.
How AI is changing the market for stolen credentials
Infostealers are a type of malware that collect saved passwords, session cookies and other information from infected devices. Criminals package the stolen data into files known as "logs," which can then be sold on underground marketplaces.
These infections aren't limited to personal devices. Research from Flare examining more than 33,000 infostealer logs found that 30% of the compromised systems were enterprise-licensed devices.
Traditionally, criminals buying these logs had to examine the contents themselves to determine which accounts might be valuable.
AI is beginning to automate that work.
Researchers at BI.ZONE identified two infostealer products that use automated analysis to build profiles of their victims:
- Bee Stealer: A Windows-targeting infostealer advertised for US$300. It uses a neural network to analyse stolen information and generate profiles of victims' likely professions and interests.
- AVENGER: A macOS infostealer that examines information including email and browsing history to identify a victim's employer, banks and cryptocurrency exchanges.
According to BI.ZONE, this information allows criminals to categorise stolen logs by their potential value, including labels such as "developer access" or "financial access."
Instead of purchasing large collections of unsorted credentials, buyers could identify accounts relevant to a particular attack.
BI.ZONE's head of threat intelligence, Oleg Skulkin, cautioned that only isolated examples have been identified so far. However, the emergence of several products using similar techniques suggests AI-assisted profiling could become more common in the market for stolen credentials.
Why this matters for B2B scam risks
For finance teams, the concern isn't simply that criminals can steal more information. It's that they might become better at identifying accounts that provide opportunities for payment fraud.
Consider an employee whose email account contains supplier invoices, payment approvals and correspondence about bank account changes. If criminals can identify that account within a collection of stolen credentials, they may be able to target it specifically.
Stolen session cookies can sometimes allow attackers to access an account without entering a password or completing a new multifactor authentication challenge.
Once inside a legitimate mailbox, an attacker may be able to review invoice conversations, identify upcoming payments and learn how the organisation approves changes to supplier banking information. They can then impersonate the account holder or insert fraudulent payment instructions into an existing email conversation.
This is particularly difficult for accounts payable (AP) teams because the request may come from a genuine colleague or supplier email address. That means there's unlikely to be a suspicious domain or unfamiliar sender, so why would anything raise a concern?
BI.ZONE also predicts that future infostealers could automate more of the attack process, including launching targeted phishing campaigns directly from compromised accounts. Of course, this is just a prediction rather than an established capability of the products identified, but it highlights why finance teams need to consider the payment fraud implications of compromised employee accounts.
The gap between IT security and payment controls
An infostealer infection will typically trigger an IT security response. The immediate priorities may include securing the affected device, resetting credentials and revoking active sessions.
Those actions are important, but they don't necessarily address the financial risk created while an account was compromised. For example, an attacker may have already used a stolen email session to request a change to a supplier's bank details.
IT could successfully secure the account without knowing that AP has received or processed a fraudulent payment instruction. The problem is that cybersecurity incidents and payment fraud are often handled by different teams. In other words, if information about compromised accounts doesn't reach finance quickly, suspicious payment requests may continue through normal approval processes.
How finance teams can reduce the risk
BI.ZONE recommends that organisations respond to compromised accounts by terminating active sessions, revoking security tokens and resetting credentials.
Finance teams should understand how quickly these actions happen and whether IT alerts AP when a compromised account may have been involved in payment-related communications. Just as importantly, payment controls need to work even when an email appears to come from someone the business knows and trusts.
Four measures can help:
- Verify changes using trusted contact details. Call a supplier using a phone number already held in your records, rather than contact information supplied in the payment change request.
- Independently verify bank account ownership. Confirm that the nominated account belongs to the intended supplier before updating payment records or releasing funds.
- Require additional approval for high-risk changes. Use a second approver for changes to supplier bank details and first payments to new accounts.
- Connect IT incident response with AP. Establish a process for notifying finance when an employee or known supplier contact has been compromised, so relevant payment requests can be reviewed.
These controls reduce reliance on email authenticity as evidence that a payment instruction is legitimate.
A genuine email doesn't guarantee a genuine payment request
AI-assisted analysis of stolen credentials is still an emerging technique. But its potential impact on payment fraud is clear: criminals may find it easier to identify accounts with access to valuable financial information and payment processes.
For finance leaders, the response isn't to assume every email is fraudulent. It's to make sure payment verification doesn't depend on trusting the sender alone.
An attacker may control a legitimate email account. Independent bank account verification and clear approval processes can help prevent that access from becoming a fraudulent payment.
Read more about financial controls and how to improve your own.
