AI-Assisted Executive Impersonation Campaign Targets ACH Invoice Payments

Microsoft detected an AI-assisted business email compromise and invoice-fraud campaign that sent more than one million emails from August 3–5, primarily targeting U.S. enterprise users. The attackers impersonated executives at victim organizations and ServiceNow, targeting accounts-payable personnel with fabricated invoices and forged email threads intended to prompt ACH transfers of nearly $50,000.

The campaign used third-party email-delivery accounts and newly registered lookalike domains to make the payment requests appear legitimate. Microsoft found no evidence that ServiceNow or any other organization impersonated in the lures had been compromised or participated in the activity. Campaign artifacts indicated AI-assisted development of phishing templates, though Microsoft could not conclusively determine the extent to which AI generated the messages; organizations should ensure anti-phishing controls and automated attack-disruption capabilities in Microsoft Defender XDR are configured to contain comparable BEC activity.