Security1 publisher2 min readPublished
A million CEO-impersonation emails asked accounts payable to approve a nearly $50,000 ACH payment
Microsoft counted more than a million of them between August 3 and 5, each carrying a fabricated ServiceNow invoice and a staged executive email thread, with the attacker's beneficiary bank details changing between targets.
The Watch · Security desk
What happened
- Microsoft detected more than a million emails targeting enterprise users between August 3 and 5, sent through multiple third-party email service accounts rather than attacker-run mail infrastructure.
- The actor impersonated CEOs, CFOs and presidents of the targeted companies themselves, asking those companies' accounts payable staff to process an ACH payment of nearly $50,000.
- Each message carried a fabricated ServiceNow annual subscription invoice with logos, invoice numbers and line items, personalized with the recipient's company name and executive name in the BILLED TO field.
- Payment instructions pointed to attacker-controlled bank accounts, and Microsoft saw multiple financial institutions across samples, so destinations may differ from target to target.
- Microsoft put 87.7 percent of the campaign's volume against recipients in the United States.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Rotating beneficiary accounts across financial institutions strips the value out of sharing a mule account number after the fact, because the next target in the send list may be shown a different bank.
- exposure Any finance function that can act on an emailed approval bearing an executive's display name is reachable here without a single credential being stolen or a single internal mailbox being compromised.
- decision When delivery borrows the reputation of legitimate email services and the invoice is inline HTML with no attachment, tuning the mail gateway buys less than adding an out-of-band callback on payee bank details.
- capability Per-recipient tailoring at seven-figure volume was previously a labour cost; templating removes it, so the marginal cost of personalizing a lure to another company's CEO approaches zero.
The delivery path is what makes this hard to filter. The emails went out through multiple third-party email service accounts [2], so the sending infrastructure carried somebody else's reputation. The fake invoice rendered inside the message body, with no attachment, and the text approved the "invoice below" while telling recipients to request a PDF version if they needed one [7]. Parts of the invoice were personalized, with the recipient's company name and executive name in the BILLED TO field [6].
More than a million emails across the three days from August 3 to 5 is roughly 333,000 a day [15]. At 87.7 percent US-bound [3], that is about 877,000 messages landing with American recipients [16]. One accounts payable department paying once returns nearly $50,000 [4], which is a success rate of about one in a million [17].
Microsoft observed multiple financial institutions across samples and said payment destinations may vary between targets [9]. Blocking a beneficiary account after one attempt does nothing for the next company in the send list. The deterministic check sits at the payment step: verify the payee bank details out of band, against a number the clerk did not take from the email, before the ACH file is released.
The sender display name, the reply-to display name, and the email signature all carried the impersonated CEO's name [5], so a clerk reading the message sees the same executive identity at every point. Below the invoice sat two more forwarded emails staging a conversation between the spoofed customer executive and a spoofed ServiceNow President about the purchase and its implementation [13]. Microsoft's framing is that the campaign layered executive impersonation, vendor branding, fabricated invoices and supporting conversations into one narrative meant to reduce recipient skepticism [12].
The AI part is described carefully in the source. Microsoft says the emails displayed multiple indicators consistent with the use of generative AI during email template creation [11], and that the impersonation technique itself is not new, with AI improving campaign templates and per-recipient tailoring [10]. The fraud itself hasn't changed; what changed is how many tailored variants can ship in three days.
The chain before delivery is ordinary: register impersonation domains, send executive-themed payment requests through trusted infrastructure, embed the fabricated invoice and conversation, work on finance staff to initiate the transfer [14]. Microsoft found no evidence that the legitimate organizations referenced in the lures, ServiceNow included, were compromised or involved, and attributed the activity to fraudulent domains and content built to mimic trusted brands and individuals [8].
What to watch
- Whether the same templates reappear after August 5 with a different vendor brand in place of ServiceNow.
- Whether the third-party email services used for delivery suspend the sending accounts, and where the campaign moves next.
- Any published recovery or seizure figures for the beneficiary accounts at the financial institutions Microsoft observed.