Microsoft reports a real, large-scale email campaign that impersonated company executives and ServiceNow to pressure accounts payable teams into sending nearly $50,000 via ACH/bank transfer. The emails bundled a CEO “approval,” a fake ServiceNow-branded invoice, and a fabricated forwarded thread to make the request look routine and trustworthy.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: an email from your CEO, approving a ServiceNow invoice and asking you to push a $50,000 ACH today. This is a real AI-assisted CEO invoice scam. More than a million of these went out. The email spoofs your CEO in the display name, reply-to, and signature, then tacks on a fake “ServiceNow Platform, Annual Subscription” invoice and a fabricated forwarded thread to make it feel routine. Here’s the tell: the CEO name is everywhere, but the domain isn’t right. The “ServiceNow” invoice actually comes from a lookalike like service-nowinc.com, the forwarded thread has no real headers, and the invoice tells you to wire money to a bank account that doesn’t match your usual vendor details. If you ever get a short ‘approved, please pay via ACH’ email from an executive, stop. Don’t reply, don’t wire. Use a known phone number or chat to confirm the request out-of-band before you move a dollar.
Researchers say the “BigBear 2.0” phishing-as-a-service operation stole over 5,100 Microsoft 365 credential records across 461 organizations by capturing passwords and session cookies. The campaign used an adversary-in-the-middle setup to bypass MFA and maintain access, with stolen data sent to…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
The article describes how modern phishing can start with an email impersonation and then move into live deepfake video calls to pressure employees into sending money. It cites a widely reported case at engineering firm Arup where an employee, convinced by a deepfake video call featuring synthetic…
Researchers describe an active, widespread email campaign that tricks employees with voicemail-themed messages and steals Microsoft 365 login sessions (including MFA codes). After taking over accounts, attackers quietly search and collect payroll/HR/finance emails and identify people involved in…
Research from Cisco Talos and CrowdStrike says criminals are building AI into everyday operations, from writing malicious code to scaling fraud infrastructure. The reports describe real prompt logs where attackers use simple “authorized testing” claims to trick AI tools into helping them, plus…
Russian-linked threat actors sent generic-looking informational emails that required no clicking, but simply opening them in vulnerable Outlook Web Access (OWA) could trigger a hidden exploit. The campaign targeted government and multiple industries, then installed a stealthy browser-based implant…
