Microsoft’s threat researchers have documented a business email compromise (BEC) campaign that dispatched more than one million fraud emails in a matter of days, using AI-generated personalization and a multi-layer social-engineering approach to convince accounts-payable staff to authorize fake transfers of nearly $50,000 each. Spotted in early August and detailed in a Thursday report, the campaign impersonated senior executives at the targeted companies — tailoring each message to its recipient to make it read like a genuine internal communication rather than a form letter.
What separates this operation from older invoice fraud is the layering of deceptions in a single email thread. Instead of a lone spoofed message from a fake CEO, the attackers fabricated an entire email chain, including a forged back-and-forth between the executive and ServiceNow — a widely used enterprise workflow platform — complete with realistic-looking invoices and ServiceNow branding. The fabricated thread gave the payment request the appearance of an already-approved procurement process, reducing the recipient’s instinct to question it. Microsoft notes that about 88 percent of the campaign’s targets are American businesses, and that the “adoption of AI has enabled threat actors to improve their campaign templates and construct emails tailored to their recipients” in ways that were not practical at scale before generative AI tools became widely available. No software vulnerability is involved; the attack depends entirely on a human acting without independently verifying the request.