Protecting organizations from AI-assisted executive impersonation and invoice fraud

Strategic summary

Microsoft observed a campaign of over one million fraudulent emails using generative AI to impersonate executives and commit invoice fraud. The attackers impersonated CEOs to convince accounts payable departments to process ACH transfers of nearly USD 50,000, using fabricated email threads and invoices. The emails were sent via third-party infrastructure, mostly to users in the United States. Microsoft found no evidence that legitimate organizations, including ServiceNow, were compromised.

Key findings

• Over one million emails were sent between August 3 and 5 through multiple third-party accounts, with 87.7 percent targeting recipients in the United States.
• The attackers impersonated CEOs in display name, reply-to address, and signature, requesting ACH payments of nearly USD 50,000.
• Forwarded email threads and fabricated invoices between the CEO and ServiceNow were included to increase credibility.
• The campaign combined executive impersonation, vendor branding, fabricated invoices, and supporting conversations.
• There is no evidence of compromise of legitimate organizations, including ServiceNow.