Business email compromise (BEC) has become the most common type of cyber-attack affecting South African organizations. Most local companies have either suffered such an attack or received messages from compromised accounts amid an unprecedented surge in incidents.[1]
Interpol’s Cyberthreat Assessment Report 2026 stated that 70% of BEC detections in Africa originated in South Africa. Despite rampant growth, Interpol said the method used to initiate a BEC attack has remained the same over the last few years. “Initial reconnaissance to identify payroll or procurement personnel, followed by account compromise via phishing or credential stuffing,” Interpol said. “AI-generated emails are then sent to finance departments, impersonating senior executives, often with urgent requests to “correct” payment details.”
The law enforcement authority said that using free email services such as Gmail and Outlook to bypass domain-spoofing detection makes traditional email security measures increasingly ineffective. South African cybersecurity organization Certra said business email compromise (BEC) had become the most common cyber incident affecting local organizations. It attributed the rise partly to AI tools, which have made these attacks easier to carry out and enabled cybercriminals to operate more efficiently.
Andre Henwood, co-founder and director at Certra, said that threat actors were weaponizing AI to craft more convincing social engineering and analyses compromised inboxes at scale. More concerning was that many of these BEC attacks resulted in financial losses, with criminals using social engineering to trick victims into transferring money to bank accounts they control.
One common scenario was where criminals compromised with a CEO’s email account and used it to instruct the finance department to transfer funds to a fraudulent bank account. “There’s been a significant increase in business email compromise leading to fund transfer fraud,” said Henwood. “It’s the most frequent incident we see, and the same trend is reflected in global incident reports. We predict it’s only going to get worse, and a lot of that is due to AI.”
The most common cyber incident in South Africa - MyBroadband receives emails from compromised accounts near weekly, with impacted companies rarely sending warnings to affected receivers.
A recent example took the form of an email from Kanonkop, a Stellenbosch wine estate which supports an online wine storefront. A reader received a notification from the estate about a BEC attack. “Kanonkop’s email system was briefly compromised today, and an email with the subject “!!URGENT!! Majestic Wine Club tender Doc from Kanonkop” was sent from our account without authorization,” it said. “Please do not open any attachment or click any link in that email — delete it if you haven’t already.” The notification stated that the issue had been identified and resolved, with no action required of receivers other than to disregard the email. It also urged users to change their email passwords as soon as possible if they had clicked the email and opened the attachment.
An ICT provider for Kanonkop told MyBroadband that they could not comment further on the incident, as they were not authorised to do so. We reached out to Kanonkop directly. However, the business had not provided feedback by the time of publication. We will update this article if we receive it.
In this case, it was likely that the BEC attack was used as a malware delivery method, which is a method to insert ransomware or infostealers into a system. Lwando Cwane, product head of cyber underwriting at iTOO Special Risks, said that the threat of BEC attacks was universal. “AI is playing more and more of a role, enabling attackers to better craft their social engineering attacks. If they gain access to communications, they can filter through those a lot better,” said Cwane.
This article used AI to craft the contents and is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://mybroadband.co.za/news/security/671057-email-accounts-taken-over-in-south-africa.html
Comments