Protecting organizations from AI-assisted executive impersonation and invoice fraud | Microsoft Security Blog
AI-assisted BEC campaign sent over 1 million emails impersonating CEOs and ServiceNow to trick accounts payable departments into processing ~$50,000 ACH payments to attacker-controlled bank accounts. Threat actors registered lookalike domains and used third-party email infrastructure to send over a million executive-impersonation phishing emails on August 3-5, targeting finance personnel. Emails contained fabricated ServiceNow invoices and spoofed executive email threads with AI-generation artifacts in the HTML. The goal was fraudulent ACH transfers of approximately $50,000 to attacker-controlled accounts at GO2BANK.
Detection / Hunteropenrouter
Immediate Actions
- Block service-nowinc.com and domainlify.net in email gateway and DNS filters
- Quarantine emails with executive display names sent from external third-party domains
- Alert finance teams about ACH fraud campaigns targeting accounts payable
Key Takeaways
- Over 1 million emails sent Aug 3-5; 87.7% targeted US enterprise users
- Fraudulent invoice requested $49,465.90 via ACH transfer to GO2BANK
- AI indicators include HTML comments with emoji artifacts and structured section labels
- Lookalike domain service-nowinc.com registered July 31, days before campaign
- Top targeted sectors: IT services (10.7%), consumer goods (9.3%), real estate (8.2%)
Attack Chain
- Reconnaissance: Actor gathers public info on target executives, finance personnel, and vendor relationships
- Resource Development: Actor registers lookalike domains and creates third-party email service accounts
- Initial Access: Over 1 million phishing emails sent targeting accounts payable departments Aug 3-5
- Execution: Emails contain fabricated ServiceNow invoices and spoofed executive email threads with AI artifacts
- Impact: Victims instructed to process ~$50,000 ACH transfers to attacker-controlled GO2BANK accounts
Affected Systems
- Accounts payable and finance departments
- Enterprise email users, primarily US-based
- Third-party email delivery infrastructure
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Attack is email-based social engineering; no endpoint execution required for success. |
| Network Visibility | Medium | Email flow visible via mail gateway; third-party infrastructure complicates attribution. |
| Detection Difficulty | Moderate | AI-generated content reduces language anomalies; header analysis and domain age still detectable. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Emails with display names matching internal executives but sent from external or third-party domains (T1656) | Email gateway logs with sender display name vs. address | Initial Access | Medium — legitimate external vendors may use executive names |
| Newly registered domains appearing in Reply-To headers of executive-themed payment request emails (T1583.001) | WHOIS age data correlated with mail flow logs | Resource Development | Low — new domains in Reply-To for payment emails is rare |
| HTML email templates containing LLM artifact characters or structured section labels in comments (T1036) | Email body HTML source from mail gateway or quarantine | Initial Access | Medium — some legitimate marketing platforms use templated HTML |
Required Log Sources
- Email gateway logs
- SPF/DKIM/DMARC authentication logs
- Mail flow transport logs
- Threat intelligence feeds
- Email header analysis data
Key Behavioral Indicators
- Display name mismatch with sender address in executive-themed emails
- Forwarded email threads lacking standard forwarding headers
- Reply-To address on newly registered domain differing from sender
- HTML comments containing emoji artifacts or LLM section labels
- Invoice payment instructions directing to non-standard bank accounts
- Subject lines containing financial keywords like 'due bill' or 'ACH Parment'
Control Gaps
- Email authentication may pass for third-party sending infrastructure
- Content filters may miss AI-generated personalized lures
- Display name spoofing not blocked without anti-impersonation policies
- DMARC enforcement on third-party connectors may be misconfigured
False Positive Assessment
Medium — legitimate forwarded invoice threads from vendors share structural similarities with the lures, and third-party email services are commonly used for bulk business communications.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enable Enhanced Filtering for Connectors on third-party email routes
- Enforce DMARC reject policy for all owned organizational domains
- Configure mail flow rules to tag external emails impersonating executives
- Enable Zero-hour Auto Purge for retroactive malicious email removal
User Protection
- Enable anti-phishing policies in Microsoft Defender for Office 365
- Deploy mailbox-level impersonation detection for C-suite executives
- Configure automatic attack disruption in Microsoft Defender XDR
Security Awareness
- Train finance personnel to verify payment requests via out-of-band channels
- Establish dual-authorization for ACH payments above threshold amounts
- Brief accounts payable staff on AI-generated phishing indicators
MITRE ATT&CK Mapping
Reconnaissance
Resource Development
Initial Access
Execution
Stealth
Impact
Plain-Language Summary
Criminals sent over a million fake emails pretending to be company CEOs and the software company ServiceNow, asking finance staff to pay a fake invoice of about $50,000. The emails used artificial intelligence to look more convincing and included made-up email conversations between executives. The criminals registered copycat website addresses to impersonate ServiceNow and directed payments to their own bank account. Finance teams should verify any unexpected payment requests by calling the executive directly before transferring money.
Additional IOCs
- Domains:
uinsure[.]co[.]uk- Sender domain used in campaign emailstivityhealth[.]com- Sender domain used in campaign emailslumalisboa[.]com- Sender domain used in campaign emailsmctci[.]com- Sender domain used in campaign emailsnuf[.]co[.]jp- Sender domain used in campaign emailslohnsteuerhilfe-aktuell-verein[.]de- Sender domain used in campaign emailstovimbatista[.]pt- Sender domain used in campaign emailseemusicclass[.]co[.]uk- Sender domain used in campaign emailslifeones[.]com- Sender domain used in campaign emails
- Other:
[email protected]- Sender email address used in campaign[email protected]- Sender email address used in campaign[email protected]- Sender email address used in campaign[email protected]- Sender email address used in campaign[email protected]- Sender email address used in campaign[email protected]- Sender email address used in campaign[email protected]- Sender email address used in campaign[email protected]- Sender email address used in campaign[email protected]- Sender email address used in campaign
- domaindomainlify[.]netNewly registered domain used in Reply-To address
- domaineemusicclass[.]co[.]ukSender domain used in campaign emails
- domainlifeones[.]comSender domain used in campaign emails
- domainlohnsteuerhilfe-aktuell-verein[.]deSender domain used in campaign emails
- domainlumalisboa[.]comSender domain used in campaign emails
- domainmctci[.]comSender domain used in campaign emails
- domainnuf[.]co[.]jpSender domain used in campaign emails
- domainservice-nowinc[.]comLookalike domain impersonating ServiceNow, registered July 31
- domaintivityhealth[.]comSender domain used in campaign emails
- domaintovimbatista[.]ptSender domain used in campaign emails
- domainuinsure[.]co[.]ukSender domain used in campaign emails
- emailgomez[@]service-nowinc[.]comEmail address tied to fraudulent GO2BANK account