Microsoft reports a large business email compromise campaign where criminals impersonated company executives and used fake vendor branding to pressure accounts payable teams into paying nearly $50,000. The emails looked more believable by embedding a fabricated forwarded email chain (including a fake interaction with ServiceNow) and by using highly consistent, template-driven content that Microsoft says appears AI-assisted.
Microsoft identified a business email compromise campaign spanning more than a million emails that targeted accounts payable teams. The emails impersonated a top company executive, typically the CEO, and pressured finance staff to process a vendor payment quickly. To make the request seem credible, attackers layered in a fabricated forwarded email thread showing the fake CEO supposedly communicating with ServiceNow about an invoice. The goal in each case was to trigger a fraudulent payment of nearly $50,000.
This campaign did not rely on a single lure. Instead it combined executive impersonation, vendor branding, a fabricated invoice, and a supporting email conversation into one unified narrative designed to reduce recipient skepticism. Each layer reinforced the others: the executive tone created urgency, the ServiceNow branding added legitimacy, and the forwarded thread gave the appearance of an independent paper trail. Microsoft also noted indicators consistent with AI-assisted template development, meaning the emails were highly uniform and well-formatted, though the company could not confirm exactly how much content was AI-generated.
Accounts payable, finance, procurement, and executive assistant teams are the primary targets of this type of scam, so they should be trained specifically on these tactics. Key defensive habits include:
Because this campaign layered multiple forms of social proof into a single message, the most effective defense is a consistent verification process that does not bend under pressure, regardless of how convincing the supporting details appear.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers impersonated a top executive and included a fabricated forwarded email thread that appeared to show a conversation with ServiceNow, making the payment request look verified and urgent.
Microsoft reported the campaign attempted to trigger fraudulent payments of nearly $50,000 per targeted organization.
Microsoft found indicators consistent with AI-assisted template development, though it could not confirm exactly how much of the content was AI-generated.
Verify urgent payment requests through a separate, trusted channel like a known phone number, and never treat a forwarded email thread as sufficient proof of a vendor request.
You get an email: “Urgent: Process ServiceNow invoice payment today”, and it’s from your CEO. It looks perfect: polished formatting, ServiceNow logo, even a forwarded thread where the ‘CEO’ talks with ‘ServiceNow’ about a $50,000 invoice. Microsoft saw over a million of these AI‑polished scams. Here’s the trick: they stack ‘proof’, CEO name, ServiceNow branding, and a long email chain, to rush you past your normal PO and vendor checks. The aha: that forwarded thread can be 100% fake. If you get an urgent CEO email about a ServiceNow or vendor invoice, stop and call or message them using a known contact method before you move a single dollar.
Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
Microsoft Threat Intelligence reports real campaigns where attackers impersonate popular AI tools (like ChatGPT, Copilot, DeepSeek, and Claude) to trick people into clicking links, installing fake software, or entering payment and login details. One campaign sent up to 100,000 emails in a day to…
Researchers say the “BigBear 2.0” phishing-as-a-service operation stole over 5,100 Microsoft 365 credential records across 461 organizations by capturing passwords and session cookies. The campaign used an adversary-in-the-middle setup to bypass MFA and maintain access, with stolen data sent to…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp”…
