Microsoft says attackers sent more than 1 million fraudulent invoice emails that pretended to come from company executives and from ServiceNow, targeting accounts-payable staff for fake payments of nearly $50,000. The early August 2026 campaign used third-party mail-sending services and layered CEO impersonation, vendor branding, fake invoices, and fabricated forwarded email threads. Microsoft said template features such as uniform structure and extensive HTML comments were consistent with AI-assisted content creation, though it could not confirm how much of the content was AI generated.
Why it matters: This is a high-volume payment-fraud campaign aimed at getting companies to wire money, especially in the U.S. Organizations should warn finance teams now to verify invoice changes and urgent payment requests through separate channels, even when the email appears to include a believable internal thread and a known vendor.
2026.09.11
100% relevant
This article establishes a distinct, named campaign with concrete scale, target profile, and tradecraft rather than updating an already tracked incident.
← Back to all stories