AegisAI Perspectives · 134
Crypto startups cut spear phishing risk for founders and key holders with security keys, a second channel check on new contacts and keys kept offline.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
Not ready for a demo? Check your domain (free, about 10 seconds).
A crypto startup cuts this risk with three rules: security keys for every key holder12, a second channel check on every new contact6, and wallet keys kept off internet-connected devices7. The FBI says North Korean fake scenarios often include offers of new employment or corporate investment1.
AegisAI investigates every email for what it is trying to do, and removes the ones that fail from every mailbox they reached19. If you run IT at a crypto startup of 20 to 500 people on Microsoft 365 or Google Workspace, with a lean IT or security team and no SOC, these are the settings and rules to put in place this week. The product side is on the inbound email security page. AI-written lures in general are in the best email security for AI-generated spear phishing. Testing your own executives with a safe lure is in how to run an AI spear phishing test on executives safely.
Spear phishing is a message written for one named person. The FBI says North Korean actors scout prospective victims before initiating contact, by reviewing social media activity, particularly on professional networking or employment-related platforms2.
The FBI recommends extra controls for companies with access to large quantities of cryptocurrency9.
List the people at your company who can sign a transaction, and treat them as the targets.
Short on time? Watch the explainer, or book a demo.
AegisAI research found that among AI spear phishing emails that evaded filters, 72.6 percent passed DMARC25.
Print these four lures and give them to every person who can sign a transaction or approve a payment.
Do these in order.
Put every person who can move funds or change settings in one group. In Google Workspace, set 2-Step Verification for that group to the option where users must set up a security key.
Allow passkeys where a hardware key is not practical. Google states that passkeys and security keys both have the same level of phishing protection13.
Enrol the highest-risk accounts in the Advanced Protection Program, which enforces the use of security keys or passkeys for sign-in14.
In Microsoft 365, register FIDO2 security keys for the same people. Microsoft recommends them for users with elevated privileges16.
In Gmail, turn on external images and links protection, so Gmail displays a warning when someone clicks a link to an untrusted domain15.
In Microsoft 365, turn on the first contact safety tip. Microsoft says it adds an extra layer of protection against impersonation and recommends turning it on18.
If your company holds large quantities of cryptocurrency, the FBI recommends company-wide controls: block devices on the company network from running files outside an approved list, and disable email attachments by default.
Finish steps 1 to 4 this week, because they need only admin settings and no new tool.
Key handling decides what that one bad click can reach.
Write these five rules on one page and have every key holder sign it.
| Lure or risk | Built-in settings and written rules | AegisAI |
|---|---|---|
| Phished password used to sign in | Security keys or passkeys | No edge. Sign-in policy is an admin setting you own |
| Fake investor or recruiter email | Second channel check | Investigates every email for what it is trying to do |
| Request to change account or payment details | Verify on a second channel | Reads the sender's history, the change asked for and where the reply goes22 |
| Fake meeting link or file | Link warning; attachments off by default | Follows every link and opens every file before anyone sees the email21 |
| Lookalike domain with valid records | First contact safety tip; it can still pass authentication | Investigates what the email is trying to do |
| Contact moved to a chat app | Verify on a separate channel | No edge. It reads mail through the Microsoft 365 or Google Workspace API |
| Keys on a laptop | Keys off connected devices | No edge. Key handling is a written rule |
The rows marked no edge stay your job whatever tool you add. Fill one copy of this table for your own team before the next raise or hire.
It investigates every email for what it is trying to do, and removes the ones that fail from every mailbox they reached. It follows every link, opens every file and decodes QR codes to the end, before anyone sees the email. It reads mail through the Microsoft 365 or Google Workspace API after delivery23. It runs in monitoring mode first24.
Illustrative example, figures are fictional: Northvale Labs (fictional), a 25-person crypto startup on Google Workspace, posts a job ad for an engineer. On Monday the CTO gets an email from a "partner" at an investment firm she has never spoken to, offering to lead the next round. On Wednesday the "partner" sends a meeting link, then writes that the video call is blocked in her region and attaches a script to fix it. The CTO checks the written rule: no scripts from new contacts, and every new contact is confirmed on a separate channel. She finds the firm's number on its own website and calls. The firm has no such partner. Her account needs a security key, and the treasury keys sit on a device that never reads email. She reports both emails and the team deletes them from every inbox.
Walk each key holder through one fake investor email and one fake meeting request like these before the next raise.
Track three numbers for 30 days, each from a log you already have.
To see what your current settings let through on your own mail, start a monitoring-mode trial. Put the three numbers side by side on day 30 and fix the weakest one first.
They require security keys for every key holder, confirm every new contact on a separate channel, and keep wallet keys off internet-connected devices. AegisAI adds a review of each email: it follows every link and opens every file before anyone sees the email.
The FBI warns about North Korean actors whose fake scenarios often include offers of new employment or corporate investment. They review social media activity, particularly on professional networking and employment sites, before the first contact.
Yes. The FBI lists requests to run a pre-employment test or debugging exercise with unknown packages, scripts or repositories as a warning sign. If the test needs code, use a virtual machine on a non-company device.
They protect sign-in. Google states that passkeys and security keys both have the same level of phishing protection. They do not stop a request to send funds or run a file, so keep the second channel check.
No. Impersonation can pass DMARC and the other authentication checks if the attacker created a lookalike domain and published valid DNS records. Pair DMARC with the first contact safety tip and a second channel check.
Disconnect the device from the Internet immediately. Then confirm every open request from that contact on a separate channel.
