Ghost Executive: The Impersonation That Gets Past the Inbox

Deepfakes get the headlines, but another attack is getting past the inbox. After analyzing 597 payment fraud incidents in the first half of 2026, we’re giving it a name.

Ghost Executive (noun): an attack that fakes an executive’s approval, in the email thread or on the invoice, so the payment looks like a decision that’s already been made. We saw it in roughly 255 incidents, nearly half of those we tracked.

In this episode we take apart one real Ghost Executive attempt.

You Learn:

• Why authentication passes an email with a fabricated thread
• Why a malware scan passes the invoice when the file has been edited
• What most controls miss about a Ghost Executive attack, and what catches it