AI-Enabled Attacks: 12 Controls That Matter in 2026

AI-enabled attacks did not invent invoice fraud or executive impersonation. They made the packaging faster, more consistent, and harder to dismiss on style alone — polished email, fabricated threads, and cloned voices that can sound like someone you know.

Source: Microsoft Security Blog, Sept. 10, 2026 — AI-assisted executive impersonation and invoice fraud campaign.

On September 10, 2026, Microsoft described a campaign of more than a million financial-fraud emails (87.7% of targets in the United States). Actors impersonated company executives, embedded a fabricated vendor invoice and a fake forwarded conversation, and pushed accounts payable to process an ACH of nearly $50,000 — with indicators consistent with generative-AI help on the templates. Microsoft found no evidence the real vendors named in the lures were compromised; it was impersonation on attacker-controlled infrastructure.

The same week’s threat picture includes voice and text. The FBI has warned that malicious actors are using smishing and AI-generated vishing — text and voice messages that claim to come from trusted officials — to build rapport and steal access. Ars Technica’s reporting on Mandiant / Group-IB research shows how short public voice samples can feed cloning engines, and why a callback on a known number plus a shared code phrase matter more than “it sounded like them.”

Related reading on this site: business email compromise — invoice redirects, MFA gaps, and payment verification habits that still apply when the lure is AI-assisted.

How AI-enabled attacks work now

Expect layered narratives, not a single awkward email.

• Email — Executive display names, lookalike domains, “approved” invoices, and fake internal threads that reduce skepticism (Microsoft).
• Voice / video — Cloned speech from short samples; urgency that bypasses normal prompts (FBI; Mandiant red-team exercise summarized by Ars Technica).
• Documents — Detailed fabricated invoices and vendor branding that look operationally real (Microsoft).
• Urgency — ACH today, confidential, don’t loop anyone else — the same pressure pattern BEC has used for years, now with better packaging.

Detection of synthetic media helps, but it is not enough on its own. NIST AI 100-4 (doi:10.6028/NIST.AI.100-4) surveys technical approaches to content transparency — provenance, labeling, watermarking, and detection. Treat those tools as complementary to process controls: dual approval, out-of-band verification, and refusal to move money from a voice or video request alone.

Defense in depth against AI-enabled attacks

No single product stops an AI-assisted payment scam. Stack identity, mail, endpoint, perimeter, and finance process so one missed click does not become a wire.

CISA’s #StopRansomware Guide and Cybersecurity Performance Goals emphasize the same idea for related threats: reduce exposure, authenticate email, use phishing-resistant MFA, deploy EDR or allowlisting, and train people who can move money. That is defense in depth for AI-enabled attacks as well.

The sections below unpack each control with primary-source backing — keep them together as one stack, not a menu of one-offs.

Reduce public exposure and attack surface

Close what attackers can see and reach. StopRansomware guidance is concrete: do not expose services such as RDP on the open internet; disable unused ports and protocols; patch internet-facing systems; prefer managed remote access with MFA over ad-hoc exposure. Regular vulnerability scanning of internet-facing assets reduces the surface AI-assisted social engineering can later expand into after a foothold.

• Inventory internet-facing hosts and close unused services.
• Require managed remote access (VPN or equivalent) with MFA — not raw RDP to the world.
• Prioritize known-exploited vulnerabilities on anything public.

Secure the perimeter

Firewall rules, egress control, and Protective DNS sit upstream of the inbox and the endpoint. StopRansomware recommends Protective DNS to block known-malicious destinations and gateway filters that catch malicious indicators before users interact. Perimeter does not replace payment process — it shrinks how far a successful lure can go.

Advanced email protection

Microsoft’s campaign guidance stresses layered mail defenses: authentication, spoof protection, advanced anti-phishing that inspects messages and links, and post-delivery remediation when new intelligence arrives. Pair that with gateway filtering and external-mail banners so finance staff see “this came from outside” before they treat a message as internal.

For Microsoft 365 tenants, harden connectors and mail-flow rules carefully so spoofed “executive” mail cannot masquerade as internal. See also LTS Microsoft 365 and cybersecurity services when you want that stack operated, not just configured once.

SPF, DKIM, and DMARC (aim for p=reject)

Authenticate your domains so receivers can reject forged mail that claims to be you. CISA’s CPG Email Security (2.M) calls for STARTTLS, SPF, DKIM, and DMARC set to reject on corporate email infrastructure. BOD 18-01 explains why p=reject is the enforcement goal after monitoring with p=none. StopRansomware likewise recommends DMARC with SPF/DKIM and flagging external emails in the client.

• Publish SPF and DKIM for every sending domain.
• Move DMARC from monitor → quarantine → p=reject once legitimate senders are inventoried.
• Enable external email banners and show full SMTP addresses.
• Filter at the gateway for known-bad subjects, attachments, and indicators.

EDR is required

AI-enabled attacks often start as social engineering and end as malware execution or living-off-the-land abuse after trust is abused. CISA’s StopRansomware Guide recommends endpoint detection and response (EDR) and/or application allowlisting on assets so unauthorized software is blocked and suspicious behavior is visible. EDR is not optional if you want visibility after a deepfake-assisted download or a malicious payload that follows a convincing call — Mandiant’s exercise (via Ars Technica) showed voice trust bypassing browser and SmartScreen prompts.

Application allowlisting and ASR where practical

Where operations allow it, allowlist approved applications (WDAC / AppLocker or equivalent) rather than trying to deny every bad file. StopRansomware specifically recommends allowlisting and enabling Attack Surface Reduction (ASR) rules such as the LSASS credential-theft rule. Start with high-impact rules in audit, then enforce where business impact is understood.

Phishing-resistant MFA and dual approval

Any MFA beats passwords alone; phishing-resistant MFA (FIDO/WebAuthn or PKI-based) is what CISA calls the gold standard in Implementing Phishing-Resistant MFA. Prioritize admins, executives, and anyone who can move money or change remittance details. StopRansomware and the CPGs align: phishing-resistant MFA for email, VPN, and critical systems.

Technical MFA does not replace finance process:

• Dual approval for wires, ACH changes, and high-risk admin or bank-detail changes.
• Written thresholds so “urgent” never overrides the second approver.
• Vendor remittance changes treated as high-risk events, not routine email updates.

Verification rituals for voice and video

When the channel is a call, a voice memo, or a video meeting, assume cloning is possible. FBI guidance: independently identify a phone number and call back to verify authenticity; create a secret word or phrase with trusted contacts; do not send money based only on an online or phone request. Ars Technica / Group-IB and Mandiant point the same direction: end the call and call back on a known number, and require a pre-agreed phrase — ideally both.

• Out-of-band callback on a number already on file — never the number in the message or caller ID alone.
• Code phrases for executives and AP for payment or credential requests.
• Never wire or ACH from voice or video alone — confirm in a second channel and through dual approval.

External attack-surface scanning

Schedule recurring external scans (or use a managed service) to find forgotten ports, expired certificates, and shadow IT. Close what you do not need; put what you do need behind managed remote access with MFA. This is the continuous version of “reduce public exposure” — and it is how you keep AI-enabled attacks from pairing social engineering with an open remote desktop.

Synthetic-media awareness and process controls

Train people that polished grammar and a familiar voice are not proof of identity. NIST AI 100-4 describes technical approaches for labeling and detecting synthetic content; use them where available, and keep process controls as the primary brake on payments and high-risk changes. Detection is complementary — not a silver bullet when models improve faster than detectors.

User training and AP / finance tabletops

CISA’s CPGs call for basic cybersecurity training that covers phishing and related social engineering; StopRansomware adds training on advanced social engineering. Extend that explicitly to AI impersonation: executive email that “sounds right,” deepfake vishing, and urgency that demands secrecy.

• Include AI-impersonation examples in annual and new-hire training.
• Run a tabletop with accounts payable and finance: fake CEO ACH, vendor bank change, and a cloned-voice approval.
• Practice the callback and dual-approval steps until they are muscle memory under pressure.

Practical checklist

How LTS can help

LTS helps Kern County organizations layer the controls AI-enabled attacks actually test: Microsoft 365 identity and mail hardening, cybersecurity monitoring with EDR, and co-managed IT alongside your internal team — so email, endpoint, and finance process move together.

For a practical review of DMARC, MFA coverage, attack-surface exposure, and AP verification workflow, speak with an engineer.

Related: Managed IT · Microsoft 365 · Business email compromise