The 3-Million Email Siege: Inside Scripted Sparrow’s Global Industrialized BEC Machine

A new report by Fortra Intelligence and Research Experts (FIRE) has unmasked Scripted Sparrow, a massively automated, globally distributed Business Email Compromise (BEC) collective that targets corporate finance departments. Researchers say the group “sends upwards of 3 million highly targeted email messages each month,” with a focus on Accounts Payable teams who receive what appears to be a mundane invoice for professional development services.

They cultivate authenticity by including a spoofed reply chain between a fictitious consultancy and an executive, prompting finance staff to believe the expense was already approved. The attackers’ tactics have evolved to bypass email filters, sometimes sending messages with no attachments, and they rely on forcing victims to initiate replies to create a trusted dialogue.

Fortra notes the operation spans three continents, with members identified in Nigeria, South Africa, Türkiye, Canada, and the United States, and highlights that the attacks peaked in September 2025. The report recommends organisations strictly verify expenses and not rely on reply chains from external sources.