Scripted Sparrow Sends Millions of BEC Emails Each Month

Fortra researchers uncovered 'Scripted Sparrow', a global BEC collective active since at least June 2024 that reportedly sends an estimated 4–6 million highly targeted emails per month, impersonating executive coaching firms to trick Accounts Payable into fraudulent ACH/wire transfers. The report documents the group's infrastructure (at least 119 domains, 245 webmail addresses, 256 bank accounts), TTPs (spoofed reply chains, invoice and W-9 PDFs, omission tactics to elicit resends, RDP usage, location spoofing), geographic links to multiple countries, and advises enforcing strict payment verification protocols.