A criminal quietly logs into a real mailbox, waits for the right invoice, and changes one line: the bank account. No virus. No strange link. Your team pays, as always — and the money is gone.
Figures: FBI Internet Crime Complaint Center (IC3), 2024 Internet Crime Report — reported US cases only.
Meet Doris from accounts. She is careful, her company has antivirus, a firewall and two-factor login. This is how a typical attack unfolds.
Doris signs in to what looks like her normal Microsoft page. It is a perfect copy that passes her login — and her two-factor code — to the attacker.
The attacker now holds her logged-in session. No password needed again, no second factor asked. He is inside her real mailbox.
He creates a mailbox rule with a harmless name like “..” that moves every email containing “invoice” or “payment” out of sight.
He replies in the real thread with an updated invoice. Same supplier, same wording — new bank account. Treasury pays.
Doris is a fictional example. The steps describe how real attacks of this kind work.
The attacker uses a normal web browser and a stolen login. There is nothing for antivirus to find.
Phishing kits that steal the logged-in session pass the two-factor step once — then they don't need it any more.
The fraudulent reply comes from the genuine account inside the genuine thread. To a filter, it is perfectly normal mail.
We look up your domain's public email protection (SPF and DMARC) live. Nothing is stored and nothing is sent to your company.
This check looks only at public DNS records. It cannot see inside your mailboxes — hidden rules and stolen sessions are what WireKnox is being built to catch.
It connects to Microsoft 365 or Google Workspace and watches for the three moments every one of these heists depends on.
IN DEVELOPMENT · EARLY ACCESS OPENRaises the alarm the moment a mailbox gets a rule that hides payment or invoice emails.
Compares the bank details in a new invoice with what that supplier used before. If they changed, finance hears about it before paying.
Any changed account needs a confirmation through a second, known channel — never by replying to the same email.
We are onboarding a small group of companies first. Write to us with your company name and how you pay suppliers.
