AI Account Takeovers: When Your Copilot Account Gets Hijacked

Business email compromise (BEC) used to mean a spoofed or lookalike email address impersonating an executive. The newest variation is more dangerous, because there's no spoofing involved at all: attackers compromise a real, legitimate AI assistant account — like Microsoft Copilot — and use its genuine, trusted access to help authorize fraudulent requests. Recent security incidents have involved exactly this pattern: hijacked Copilot accounts used to help push through CEO-impersonation payment fraud, from an account your systems have no reason to distrust.

Why this is a meaningfully different problem

A phishing email arriving from an unfamiliar address can be caught by a filter, or spotted by a trained employee. An action taken from a legitimate, authenticated Copilot account tied to a real employee doesn't trigger the same defenses — because as far as your systems are concerned, it is a real employee. The compromise happens one step upstream: the attacker didn't fake the identity, they took over the account it belongs to.

How these account takeovers typically happen

• Reused or weak passwords on the underlying Microsoft 365 account, discovered through unrelated data breaches.
• Phishing targeting the credentials themselves — including AI-generated phishing emails specifically crafted to harvest Microsoft 365 logins.
• Missing multifactor authentication (MFA), which remains the single most common gap that turns a stolen password into full account access.
• Session token theft, where malware steals an already-authenticated session, bypassing the need for a password or MFA prompt entirely.
• Overly broad AI tool permissions, where an AI assistant has been granted more access — to email, files, or approval workflows — than its actual use case requires.

What makes AI assistants an attractive target specifically

AI assistants like Copilot are often deeply integrated — connected to email, calendar, documents, and sometimes approval workflows — specifically because that integration is what makes them useful. That same integration is exactly what makes a compromised AI account so valuable to an attacker: one takeover potentially grants visibility and action across several connected systems at once, rather than just a single inbox.

The account wasn't impersonated. It was taken over. That distinction is why traditional phishing defenses don't catch this pattern.

How to actually prevent this

• Enforce MFA on every Microsoft 365 and AI assistant account — no exceptions for "convenience" accounts.
• Use Conditional Access policies to block or flag logins from unfamiliar devices, locations, or impossible-travel patterns, even when the correct credentials were used.
• Scope AI assistant permissions deliberately. Grant access to what the tool actually needs, and review that scope periodically rather than accepting default permissions indefinitely.
• Require out-of-band verification for financial requests — regardless of which trusted internal system or account the request appears to come from.
• Monitor for anomalous account behavior, not just failed login attempts — a legitimate account suddenly accessing unusual files or approving unusual requests is a signal worth catching.
• Have a plan for account compromise specifically, not just device compromise — who gets notified, and how access gets revoked quickly, if an account is suspected to be taken over.

The bottom line

As AI assistants get more deeply integrated into daily business operations, the accounts behind them become higher-value targets — not because the AI itself is insecure, but because a compromised account now carries more trusted access than ever before. The fix isn't avoiding AI tools; it's securing the accounts and permissions behind them with the same discipline you'd apply to any other privileged access.