Microsoft Copilot Accounts Compromised for CEO Impersonation and Fraud

A proof-of-concept by Barracuda’s Red Team has shown that compromised Microsoft 365 accounts with Copilot access can facilitate business email compromise (BEC). Attackers can impersonate CEOs, leading to significant financial theft, exemplified by a $247,500 wire transfer. The research, published on August 4, 2026, highlights the rapid escalation from a single compromised employee account to a full CEO account takeover. This vulnerability poses a serious risk to organizations using Microsoft 365, particularly those relying on AI tools like Copilot for email management. The incident underscores the need for enhanced security measures to protect high-level accounts from unauthorized access.

Key Points: • Compromised Microsoft 365 accounts with Copilot access enable CEO impersonation. • A single account compromise can lead to significant financial theft, as seen with $247,500 stolen. • Organizations using Microsoft 365 must enhance security measures to protect against BEC.