AI Executive Impersonation Invoice Fraud Campaign

Introduction

Microsoft has uncovered a large-scale financial fraud campaign that shows how generative AI is raising the sophistication of executive impersonation attacks. For IT and security teams, this matters because the campaign combined trusted-looking branding, fake email threads, and personalized invoice details to target accounts payable staff with convincing ACH payment requests.

What’s new

Between August 3 and 5, Microsoft detected more than one million scam emails sent through third-party email delivery services, with most targets located in the United States.

Key characteristics of the campaign included:

• Executive impersonation: Attackers spoofed CEOs, CFOs, and presidents in display names, signatures, and reply-to details.
• Fake invoice workflow: Emails included a fabricated invoice for a supposed ServiceNow annual subscription, often requesting nearly $50,000 via ACH transfer.
• Embedded fake conversations: Messages contained forged “forwarded” threads to make the payment request appear pre-approved.
• Lookalike domains: Microsoft observed domains such as service-nowinc[.]com and domainlify[.]net used to support the scam.
• Signs of AI-assisted creation: Microsoft found indicators such as verbose HTML comments, structured section labels, and highly uniform templates that suggest generative AI was used in template development.

Microsoft also emphasized that the legitimate brands referenced in the messages, including ServiceNow, were not compromised. The campaign relied on attacker-controlled infrastructure and impersonation content.

Why this matters for administrators

This campaign is a reminder that invoice fraud and business email compromise are evolving beyond simple phishing. AI-assisted content can make fraudulent emails look polished and internally consistent, which increases the chance that finance teams may trust them.

Security and IT administrators should pay close attention to:

• mismatched display names and sender addresses
• suspicious financial keywords in subjects
• missing or unusual forwarded-email headers
• requests to avoid copying others on payment approvals
• payment instructions that direct funds to unfamiliar bank accounts

Recommended next steps

Organizations should review both technical controls and business processes:

• Strengthen anti-phishing and impersonation protection in Microsoft Defender for Office 365.
• Enable user reporting and investigation workflows for suspicious finance-related emails.
• Train finance and accounts payable teams to verify invoice and ACH requests through a separate communication channel.
• Review domain monitoring for lookalike registrations tied to your brand or major vendors.
• Require secondary approval for high-value or unusual payment requests.

Final takeaway

The key lesson from this campaign is that AI is helping attackers scale and refine executive impersonation and invoice fraud. Defenders should combine email security, threat intelligence, and payment verification controls to reduce the likelihood of a costly fraudulent transfer.