A Dark Reading story published on 11 September 2026 says a single threat actor pumped out one million fraud emails in a three‑day window.
According to the article, cybercriminals are now using artificial intelligence to mass‑produce personalized phishing messages without losing credibility. (unconfirmed)
If the claim holds water, the sheer scale forces defenders to rethink how they triage inbound mail. Traditional filters that rely on volume spikes may miss a flood of individually crafted messages.
The alleged use of AI suggests attackers can vary subject lines, greeting names, and even mimic past correspondence, making each email look less like a generic blast.
Anyone who receives email from a business partner, vendor, or internal colleague could be a target. Small‑to‑medium enterprises in Indonesia often lack dedicated security teams, so a wave of believable scams could slip through unnoticed.
Practical steps
- Enable DMARC, SPF, and DKIM for all outbound domains; reject unauthenticated mail.
- Deploy anti‑phishing gateways that analyse language patterns, not just sender reputation.
- Run regular phishing simulations to keep staff sharp.
- Adopt a “verify‑before‑click” policy for any request involving credentials or payments.
- Monitor outbound email volumes for anomalous spikes.