A new financially motivated business email compromise (BEC) threat actor, TA2900, has been identified targeting individuals in France and occasionally Canada. The actor sends French language emails using rental payment themes, claiming that rental installments have not been received and instructing recipients to send payments to new bank accounts. The campaigns use compromised mailboxes from educational institutions and often include PDF attachments with logos related to property management. The actor frequently changes the International Bank Account Numbers (IBAN) provided, using accounts from French banks. The messages may be generated with AI assistance and are designed to create anxiety and prompt immediate action from recipients.