Microsoft reports a large business email compromise campaign where criminals impersonated company executives and used fake vendor branding to pressure accounts payable teams into paying nearly $50,000. The emails looked more believable by embedding a fabricated forwarded email chain (including a fake interaction with ServiceNow) and by using highly consistent, template-driven content that Microsoft says appears AI-assisted.
Microsoft identified a business email compromise campaign spanning more than a million emails that targeted accounts payable teams. The emails impersonated a top company executive, typically the CEO, and pressured finance staff to process a vendor payment quickly. To make the request seem credible, attackers layered in a fabricated forwarded email thread showing the fake CEO supposedly communicating with ServiceNow about an invoice. The goal in each case was to trigger a fraudulent payment of nearly $50,000.
This campaign did not rely on a single lure. Instead it combined executive impersonation, vendor branding, a fabricated invoice, and a supporting email conversation into one unified narrative designed to reduce recipient skepticism. Each layer reinforced the others: the executive tone created urgency, the ServiceNow branding added legitimacy, and the forwarded thread gave the appearance of an independent paper trail. Microsoft also noted indicators consistent with AI-assisted template development, meaning the emails were highly uniform and well-formatted, though the company could not confirm exactly how much content was AI-generated.
Accounts payable, finance, procurement, and executive assistant teams are the primary targets of this type of scam, so they should be trained specifically on these tactics. Key defensive habits include:
Because this campaign layered multiple forms of social proof into a single message, the most effective defense is a consistent verification process that does not bend under pressure, regardless of how convincing the supporting details appear.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers impersonated a top executive and included a fabricated forwarded email thread that appeared to show a conversation with ServiceNow, making the payment request look verified and urgent.
Microsoft reported the campaign attempted to trigger fraudulent payments of nearly $50,000 per targeted organization.
Microsoft found indicators consistent with AI-assisted template development, though it could not confirm exactly how much of the content was AI-generated.
Verify urgent payment requests through a separate, trusted channel like a known phone number, and never treat a forwarded email thread as sufficient proof of a vendor request.
You get an email: “Urgent: Process ServiceNow invoice payment today”, and it’s from your CEO. It looks perfect: polished formatting, ServiceNow logo, even a forwarded thread where the ‘CEO’ talks with ‘ServiceNow’ about a $50,000 invoice. Microsoft saw over a million of these AI‑polished scams. Here’s the trick: they stack ‘proof’, CEO name, ServiceNow branding, and a long email chain, to rush you past your normal PO and vendor checks. The aha: that forwarded thread can be 100% fake. If you get an urgent CEO email about a ServiceNow or vendor invoice, stop and call or message them using a known contact method before you move a single dollar.
Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…
Surfside Beach, South Carolina lost $545,598.30 after staff wired money to a fraudulent account based on emails from a lookalike domain. The forensic review found no compromise of the town’s internal systems or Microsoft 365, attackers simply registered a near-identical domain and used it to…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
Microsoft says it disrupted “EvilTokens,” an AI-powered phishing-as-a-service operation used to break into email accounts at scale. The service automated device-code login phishing end-to-end, helping criminals steal authentication tokens and enable business email compromise across more than 10,000…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
Microsoft disrupted “EvilTokens,” a subscription cybercrime service that stole Microsoft account access using device-code phishing and then used AI-style automation to rapidly mine victims’ inboxes for payment and org-chart details. The goal was to quickly craft believable payment-fraud messages…
