Email Phishing Eng. · 6: BEC 3.0 Orchestration

This is Part 6 of the “Email Phishing Engineering” series. Earlier parts landed on protocol, content, credentials, and identity chains; this one shifts to where copy comes from, how it scales, and how it is woven with SMS/IM into mutual corroboration. When writing is no longer the human bottleneck, signatures and template fingerprints fail together—and a single-channel mail gateway no longer knows what to trust.

Semantic dilution, AI-assisted generation, and multi-stage/automated channels exist in the product as designs and partial implementations; full-chain LLM + automation orchestration is not yet a final state.

0x01 BEC 3.0#

What changes is how content is generated. A rough three-generation split helps align discussion; treat it as a framing device, not a strict chronology:

BEC 3.0 here carries two layers of meaning—not the shallow reading of “they used ChatGPT”:

Hoxhunt and others report a steep rise in AI-generated phishing share by late 2025; Microsoft and others report click rates for AI-assisted phishing several times those of traditional hand-crafted lures. A critical caveat: “AI-generated” is sometimes only “suspected AI polish,” and those are not the same thing.

0x02 Polymorphic generation: from placeholders to orchestration#

2.1 The ceiling of template engines#

What still dominates exercise platforms and attack kits is string substitution: {{.FirstName}}, {{.CompanyName}}. Variable dimensions are limited, structure is fixed, and no matter how many variants you mint, they spin inside the same syntax tree. For blue teams that is actually good news: structural fingerprints, paragraph skeletons, and fixed CTA phrasing can all be catalogued.

Once you enter “independent rewrite per message,” the signature path breaks. StrongestLayer and others have reported very low Jaccard similarity on QR-phishing batches (public materials often cite ~0.2 order of magnitude)—meaning pattern matching often simply does not fire. Highly targeted APT-style activity will be even lower.

2.2 Three-layer structure (adversary model / product goal)#

Engineering can be split into three layers, independent of whether you use a single LLM vendor.

(1) Context awareness Before send, assemble context so the system knows what business situation it is speaking into—not merely “write a phishing email.”

• Role: finance, R&D, HR, and executives have different vocabularies and tone;

• Timing: quarter-end audit, month-start KPIs, year-end performance, holiday benefits—the window decides the topic.

• Organization: LinkedIn public data, job postings, press releases, annual reports—projects and M&A.

A real case: during one phishing engagement we had long since owned an internal chat account and regularly watched group traffic. When the company was relocating, the lure used copy about that move. The post-mortem was entertaining; I will not expand here.

For TaiGong’s built-in AI, the system prompt requires the model to “write an internal notice that fits this scenario,” not to “write something that looks real.”

(2) Polymorphism constraints Swapping a few synonyms is not enough. Practical constraints can be written as:

Semantic conservation: business intent (click link / submit / wire confirmation) must be preserved
Individual difference: body similarity across recipients in the same batch pushed below a policy threshold
Structural mutation: paragraph count, sentence form, salutation, and sign-off randomized

As of today, an unconventional feature has been introduced for this scenario: suppose you have 80 exercise targets; under the old flow every recipient’s mail shared the same punctuation and skeleton. After 1.3.0 I added semantic rewrite: at send time the engine layer applies polymorphism-constraint orchestration so those 80 people receive bodies that are thematically similar but fully inconsistent in wording. The cost is higher delivery-status latency, because each LLM orchestration pass in the background can add 0–15s of delay. My newer scheme is batch master + individual fine-tune: one master per N recipients, then substitute name, department, project code. Masters can still be LLM-made; fine-tuning can stay on the template engine to save latency and cost.

(3) Failure and degrade API timeouts, rate limits, and content-moderation blocks are normal. Production orchestration needs backoff, fallback models, and caching of identical system prompts.

2.3 Industrial examples in the real ecosystem#

Fortra FIRE’s disclosure of Scripted Sparrow (public materials around early 2026) supplies a useful data set:

Two tactics are more instructive still:

• Omit the attachment to filter cooperators: do not dump an invoice first; wait for the other side to ask for an attachment, then enter a high-conversion dialogue.

• Forge a reply chain: make it look as if a few rounds have already been had with a consulting firm, lowering the guard on a cold first mail.

0x03 Semantic dilution#

Polymorphism solves “every message is different.” Semantic dilution solves something else: in the eyes of bag-of-words / Bayes / some NLP gateways, whether the mail should be treated as spam at all.

3.1 What it looks like#

SpamAssassin, Rspamd, and similar engines commonly use log-likelihood ratios at the content layer: exceed the threshold and the message tilts toward spam. The classifier consumes token distributions, not “what a human reads as meaning.” Inject enough ham-leaning tokens and you can drag that score down—this is mathematical adversarial craft, not mysticism.

Modern gateways also have intent classification, entity extraction, template fingerprinting, and other NLP layers. Dilution design usually moves on several dimensions at once, not merely stuffing keywords.

3.2 Three-dimensional injection (design view)#

TaiGong’s semantic-dilution approach splits the attack surface into:

Token dilution Inject business/meeting/budget ham words at a multiple of the malicious-token count, and hide them from humans—but leave them visible to some parsers—via HTML hiding, CSS offsets, font-size:0, and similar tricks.

Structure / intent poisoning Insert neutral sentences around the urgency + action window to break the “click here to verify” intent pattern; also mix in legitimate email addresses and legitimate domain entities as noise.

MIME-layer bifurcation In multipart/alternative, text/plain carries a benign meeting summary; text/html carries the lure.

Config-surface ideas include dilution level, a MIME-dilution switch, preview diffs, and so on, hanging off weaponization/evasion configuration. Whether any given customer build turns these on, and whether they are default-on, is governed by authorization and configuration.

0x04 Cross-channel: mutual corroboration is a cognitive problem and an orchestration problem#

After single-channel email has been ground down by training and gateways, adversaries stack SMS and enterprise IM. The principle is simple: people more readily believe “two channels said the same thing,” yet rarely verify whether both channels share the same controller.

4.1 A typical three-stage chain#

Stage1 email (upgrade/audit/payroll) ──12h no click──► Stage2 SMS nudge
                                                      │
                                                      ▼ still no conversion
                                                 Stage3 enterprise IM bot “todo reminder”

Stop follow-ups on click to avoid repeated bombardment. Windows that are too short look scripted; windows that are too long let people cool off—engineering typically uses a delay queue.

4.2 Engineering components (aligned with TaiGong)#

Cross-channel detection is beyond a single SEG: SIEM must correlate, within a short time window, same-theme email + SMS—plus the human, out-of-platform factors that no platform fully controls.

4.3 Exercise ethics#

Multi-channel significantly raises pressure and conversion, and more easily causes panic. Internal and external exercises should state channel scope, time windows, and exit mechanisms; external demos should avoid real wire-transfer scripts against finance roles.

0x05 2025–2026 ecosystem slices#

The following items are threat portraits only.

Scripted Sparrow (Fortra et al.) Targeted BEC, AI generation, hybrid generation and automated replies; deliberate omission of attachments to filter cooperators.

Phantom Squatting (Unit 42 et al.) Model hallucination invents non-existent domains → attackers register them → users or agents hit them. Implication for BEC: the LLM can become a distribution surface; employees trust the assistant’s recommendation more than a stranger’s From: line.

Deepfakes Voice/video impersonation of executives already has public loss cases; “deepfake-as-a-service” lowers the barrier. Email training will not stop a video meeting; finance processes must include out-of-band verification.

Public surveys often show a high share of organizations hit by AI-driven attacks in the past year.

0x06 Blue team: rewrite assumptions, not just lengthen rules#

What BEC 3.0 punches through is the thinness of any single trust chain.

6.1 Process: write out-of-band verification into the workflow#

For wires, permission changes, or export of sensitive data: confirmation must use a second independent channel (a phone number from the directory, a live enterprise-IM conversation with a real person). Never confirm by replying to the original mail.

6.2 Behavior: relationship graphs and path drift#

• A→B who have never communicated suddenly talk money;

• Send time, header format, Message-ID / X-Mailer / MIME habits mutate;

• SPF/DKIM/DMARC all green, but the path disagrees with history.

6.3 Training: process#

“Don’t click strange links” will not stop a colleague’s reminder in IM. Training should land on rehearsable actions: wires require second confirmation, how to report an anomalous bot, one-click report after a click. The exercise itself should use polymorphism and multi-channel to measure real gaps.

0x07 Closing#

Last time I said this was the last engineering piece. For exercise platforms like TaiGong, the value is making the threats above available as optional configuration—templates and AI assist, semantic-dilution design, multi-stage and SMS/IM—and honestly labeling in reports which evasions were used.

For those interested only in the platform implementation: we also take commercial employee-awareness exercises; feel free to leave a message for consults.

• Hoxhunt, Phishing Trends Report 2026. https://hoxhunt.com/lp/phishing-trends-report-2026 ↗

• Microsoft Digital Defense Report 2025. https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/microsoft-digital-defense-report-2025 ↗

• Fortra, Scripted Sparrow. https://www.fortra.com/resources/guides/scripted-sparrow-prolific-bec-threat-group ↗

• Palo Alto Networks Unit 42, Phantom Squatting. https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/ ↗

Series navigation

• Part 1: GoPhish’s Ceiling
• Part 2: Untraceable Infrastructure
• Part 3: Bayesian & NLP Content Adversarial
• Part 4: Parameter Polymorphism & Response Camouflage
• Part 5: Linkless Delivery & QR Codes
• Part 6: BEC 3.0 & Cross-Channel Orchestration ← this post