Threat Actors Abuse Trusted Accounts and Internal Tools to Launch Convincing BEC Attacks
KnowBe4, Monday, October 5th, 2026
Rapid7's Douglas McKee describes 'calendar warfare' and other BEC tactics using compromised trusted accounts.
KnowBe4 summarizes research by Rapid7's Douglas McKee on how attackers refine business email compromise by abusing trusted tools and accounts.
In what he calls 'calendar warfare,' attackers silently modify or delete meetings, flip RSVP status to manipulate leadership decisions, or plant an 'Emergency Board Meeting' with a believable organizer and a malicious Zoom link.
Compromised trusted accounts also let attackers send legitimate-looking messages that victims may not think to question.