Microsoft Reports Million-Email BEC Campaign Using Executive Impersonation and Fake Invoices
Summary
Microsoft reported a BEC campaign of more than one million emails that impersonated executives and ServiceNow to solicit nearly $50,000 in fake payments. Signs suggested AI-assisted templates, but Microsoft could not confirm AI’s role.
Key points
- Microsoft found the campaign in early August; it sent more than one million emails, about 88% of which targeted people in the United States.
- Attackers impersonated company executives and pressured accounts payable teams to send fraudulent payments of nearly $50,000.
- Messages impersonated ServiceNow and included fabricated invoices and forwarded email threads to make the requests appear legitimate.
- Microsoft identified extensive HTML comments, structured section labels, and uniform templates as signs consistent with AI-assisted development, but said it could not independently establish how much AI generated the content.
- The campaign combined executive impersonation, vendor branding, fabricated invoices, and supporting email conversations in a single narrative.
Article Details
- Event Type
- Business email compromise campaign using executive and ServiceNow impersonation, fabricated invoices, and forged email threads.
- Impact
- More than one million fraudulent emails targeted users, mostly in the United States. The attackers sought nearly $50,000 in fake payments from accounts payable teams.
MITRE ATT&CK
People
Vendors
MicrosoftMicrosoft researchers reported a large wave of fraudulent business email compromise emails that used AI-like templates, executive impersonation, and fabricated invoice threads to deceive accounts payable teams.ServiceNowrecipients, and impersonated executives and ServiceNow to push nearly $50,000 in fake payments.SwimlaneAttackers are using AI to make established fraud schemes “more sophisticated and scalable, according to Nick Tausek, lead security automation architect at Swimlane, a security automation and response platform.