AI Didn't Make Hackers Smarter. It Made Them More Affordable.

Business email compromise claims rose roughly 30% in 2025. If you’re waiting for an explanation about sophisticated nation-state actors or advanced persistent threats, here’s the real story: a phishing kit with a monthly subscription now costs less than most of your SaaS tools.

That’s the finding from Coalition, a cyber insurer that draws on claims data from more than 110,000 policyholders. The jump in business email compromise (BEC), measured against the second half of 2024, covers attacks where criminals impersonate vendors, executives, or colleagues to redirect money or steal credentials. It didn’t happen because hackers got more sophisticated. It happened because the barrier to entry collapsed.

What Changed in Business Email Compromise?

For years, running a convincing BEC campaign required real skill. You needed to write believable emails, time them well, pick the right targets, and manage the logistics of actually extracting money. That kept smaller businesses relatively protected, not because attackers didn’t want their money, but because the effort-to-return ratio wasn’t worth it.

Agentic AI tools changed the math.

Coalition singled out a platform called EvilTokens: a phishing kit sold as a subscription, for a $1,500 initiation fee and $500 a month. That’s less than most business-grade accounting software. Victims were tricked into entering a code on Microsoft’s own, genuine sign-in page, which handed over their mailbox without ever revealing a password. Once inside, an AI assistant summarized and translated the mail, surfaced the conversations about money, mapped who did what, and drafted messages posing as trusted contacts.

EvilTokens compromised more than 12,000 inboxes across over 10,000 organizations worldwide before a coalition led by Microsoft Disrupted It on 22 September 2026. The service is gone. The business model it proved is not.

One detail is worth knowing even if you never meet EvilTokens: access gained this way could survive a password reset, unless the account’s active sessions were revoked too. That is the same pattern we covered in The Problem with MFA, and the reason “change the password” is not, on its own, the end of a cleanup.

Why Are Smaller Businesses Now the Target?

Coalition made a point worth sitting with: smaller businesses were previously considered too minor to target. When running a BEC operation required skilled human labor, attackers focused on larger organizations where the potential payoff justified the work.

When an AI tool can handle the prospecting, the writing, the delivery, and the initial data extraction on its own, the calculation inverts. Smaller businesses become attractive precisely because they often have fewer controls. No dedicated security team reviewing unusual email patterns. No wire transfer verification process beyond “my boss emailed me.” No flagging system for login attempts from an unusual location.

Average BEC losses in Coalition’s data remain under $30,000. That sounds like good news until you consider what $30,000 means to a business running on thin margins, and that an average hides a long tail: NetDiligence has documented a single BEC claim of $30 million. The FBI counted $3.05 Billion in BEC Losses in 2025 on its own.

What Most Coverage of AI and Cybercrime Misses

Most of the coverage on AI and cybercrime focuses on deepfakes and sophisticated impersonation: executive video calls that turn out to be fake, AI-cloned voice messages directing a finance team to approve a transfer. Those incidents are real and growing, and we’ve written about How They Work and the Habits That Stop Them. But they’re still relatively rare.

What’s not rare is AI automating the work that used to require a human. Coalition is careful about this distinction: BEC has already shifted, funds transfer fraud is poised to follow, and ransomware, which still needs hands-on network compromise and negotiation, shows no year-over-year change in claims frequency yet. It’s the same pattern Anthropic’s Research Found from the other side: AI lowering the skill an attacker needs.

That matters for how you think about the threat. This isn’t primarily a technology problem to solve with technology. It’s a volume problem. More convincing emails, at higher frequency, aimed at people who already don’t have time to scrutinize every message they receive.

The answer is the same one it’s always been, awareness and process, but the urgency around actually doing it has gone up.

What Should Your Business Check Now?

Your wire transfer and payment process. Most successful BEC attacks end with a payment. The most effective defense is a process that doesn’t rely on email alone to verify changes to payment instructions. A phone call to a known number, not a number in the email, before any change is processed is one of the highest-return controls you can add. It costs nothing, and it works even when the email is flawless.

Whether your team would catch a realistic test. Knowing About Phishing and Actually Pausing in the Moment are different things. A phishing simulation, sent without warning and followed by feedback rather than blame, is the most reliable way to know how your people would respond before an attacker finds out for you. That is exactly what our Phishing Testing service runs.

Whether your team knows what to do when something looks wrong. As we tell every customer, the biggest gap in most smaller organizations isn’t technical controls. It’s the 2.1 seconds between a suspicious email arriving and an employee clicking it or forwarding it to someone. Regular Awareness Training, the Seven Warning Signs worth pausing for, and a clear reporting process that doesn’t make people feel stupid for asking close that gap faster than almost anything else.

Coalition’s full briefing, How AI Is Impacting Cyber Risks, has the underlying data.

If you want to see how your own business is positioned, the Cybersecurity Readiness Checklist takes about five minutes and gives you a score against the controls that actually matter, including how you’re handling the human side of risk.

Sources: Coalition, Risk Intelligence Briefing: How AI Is Impacting Cyber Risks, October 2026, as reported by Risk & Insurance; Help Net Security on the EvilTokens disruption, 23 September 2026; FBI IC3 2025 Annual Report.