Skip to content
AI Security Wire

Published

- 5 min read

By

Email AI Assistants Turn Compromised Accounts Into Insider Threats

email AI Microsoft Copilot BEC Living off the Land Barracuda Black Hat insider threat privilege escalation M365 2026
img of Email AI Assistants Turn Compromised Accounts Into Insider Threats

Business email compromise has a new force multiplier. Researchers at Barracuda Networks demonstrated at Black Hat USA 2026 that a single compromised employee account, combined with an AI assistant integrated into the organisation’s email platform, is sufficient to escalate access to the CEO’s account and execute a fraudulent wire transfer. No additional tooling required. The AI assistant, designed to make email management easier, does the hard work.

The research, published on the Barracuda blog on August 4, 2026, classifies this as a Living off the Land (LotL) attack variant. Where traditional LotL abuses legitimate system tools like PowerShell, WMI, or LOLBins to avoid detection, this approach turns the organisation’s AI productivity tooling into the attack instrument.

How the Attack Works

The Barracuda Red Team started from a single compromised employee account — the kind that might result from a credential stuffing attack or a standard phishing compromise of a junior staff member. Crucially, the account had no elevated privileges and no direct access to finance systems.

Their first step was to ask the email AI assistant to create inbox rules that hid security alert emails from the account’s inbox. Standard security monitoring sends login alerts, suspicious activity notifications, and authentication warnings to the account owner. Those get buried in a subfolder, invisible to the legitimate user but also suppressing the signals that security teams look for in compromised account investigations.

The second step was reconnaissance. They asked the AI assistant to analyse the email history, calendar, and shared documents accessible from the compromised account, identify the organisational structure, and surface conversations involving the CFO and CEO — specifically around finance approvals, payment processes, and upcoming transactions.

What would typically take hours of manual reading and pattern analysis, the AI completed in seconds. It returned a mapped organisational hierarchy, identified the CEO’s communication style and current projects, and surfaced a pending large-value payment that was under discussion.

The third step was escalation. Using the context the AI had gathered, the team crafted a spear-phishing email from the compromised account to the CEO, referencing specific details from internal conversations to establish credibility. The email prompted the CEO to approve an urgent wire transfer. From there, the CEO’s account was accessible, and the fraudulent transfer — approximately US$250,000 in the proof-of-concept scenario — was within reach.

The LotL Framing Matters

Barracuda’s conclusion is worth taking seriously: the AI assistant does not introduce any new permissions. The compromised account only had access to emails and calendar data it was legitimately entitled to see. The AI accelerated the abuse of those existing permissions to a speed that human-only reconnaissance could not match.

This is the same logic that makes traditional LotL attacks effective. If PowerShell runs on every Windows machine, defenders cannot simply block it — they have to detect anomalous usage. The same is now true for AI assistants. You cannot remove Microsoft Copilot from M365 tenants enterprise-wide without losing the productivity benefits organisations paid for. The detection challenge is distinguishing legitimate AI assistant usage from an attacker using it as a reconnaissance and drafting engine.

What Defenders Need to Watch

The practical detection challenge is that inbox rule creation, AI assistant queries, and email archive access are all normal user behaviours. The signals that suggest malicious use are behavioural:

Unusual inbox rule patterns. Rules created to suppress security alerts, move authentication notifications to obscure subfolders, or forward copies of emails to external addresses are the earliest indicator that a compromised account is trying to suppress detection.

High-volume AI assistant activity from a low-privilege account. If a junior account starts making hundreds of queries to retrieve calendar data, emails from executives, or financial documents, that access pattern does not match its normal baseline.

Access to executive communication history from non-executive accounts. In environments where sharing permissions are not tightly controlled, AI assistants can reach far beyond what the compromised account would normally browse manually.

Security teams reviewing Microsoft 365 Defender, Entra ID, or Purview audit logs should include AI assistant API calls in anomaly detection baselines. These calls are logged and queryable — most organisations have not yet built detection rules around them.

The Broader Implication

Barracuda’s research adds a specific, demonstrated capability to what has been a theoretical concern. AI assistants embedded in productivity platforms are not just a compliance question. They are a force multiplier for anyone with access to a compromised account, and the attack surface grows with every seat of M365 Copilot, Google Workspace Duet AI, or comparable product that organisations deploy.

The pattern parallels the arc of cloud storage and collaboration tools in BEC. Once attackers understood that SharePoint and OneDrive could be used to exfiltrate data without triggering DLP rules designed for email attachments, those vectors were immediately exploited. AI assistants are the next tool in that cycle.

References

Frequently Asked Questions

How does an attacker use a compromised email account's AI assistant against the organisation?
Once inside a compromised account, the attacker directs the built-in AI assistant to create inbox rules that suppress security alerts, then uses the AI to automatically analyse months of emails and calendar data, identify the organisational hierarchy, and surface high-value targets. The assistant can produce hyper-personalised spear-phishing content and draft convincing requests using the compromised employee's own communication style and context. The attacker never needs to install any tools -- the AI assistant does the reconnaissance and drafting work.
Does this attack require the AI assistant to have special elevated permissions?
No. Barracuda's key finding is that the AI assistant does not grant any permissions the compromised account does not already have. The risk is one of speed and scale: the AI dramatically accelerates what would otherwise take hours of manual reconnaissance. An attacker can survey an entire organisation's structure, identify the CFO and CEO's communication patterns, and produce targeted lures in minutes rather than days.
What detection signals does this type of attack leave?
The primary signals are: unusual inbox rule creation (rules hiding security alert emails are a common early indicator), high-volume API calls to the AI assistant outside normal working hours, and unexpected access to historical email archives or shared drives by a low-privilege account. Because the attack uses built-in platform features rather than external tooling, it evades detections that focus on imported malware or unusual process execution.