Two members of the US Air Force were handed multi-year prison sentences for running a business email compromise scheme that stole millions of dollars from several organisations. Chijioke Timothy Odimegwu, 25, received more than nine years and Harafat Mogaji, 26, received 6.5 years; both were sentenced on Friday and each will serve a three-year supervised release term. Odimegwu must pay $366,617 in restitution and Mogaji $995,680. According to court documents, the pair spent years sending phishing emails to businesses to steal login credentials for employee email accounts, then used the stolen credentials and spoofed addresses to redirect payments to bank accounts they controlled; both pleaded guilty in June to charges of wire fraud, identity theft and access device fraud. They were stationed at Dover, Delaware Air Force base when they conducted the scams, and prosecutors said they worked with others on attacks against additional victims. The case is a reminder that credential phishing remains the highest-yield criminal technique in the corpus and that the offenders are frequently employed, cleared and inside the perimeter — the same insider-adjacent profile the week's IT-worker scam reporting describes.

• Source article