What Microsoft found
Between 3 and 5 August, an unnamed attacker sent more than a million emails to enterprise users in an attempt to get finance teams to pay a fake invoice, Microsoft said in a security blog post published on 10 September. The messages impersonated members of a targeted company’s executive team, such as its CEO, CFO or President, and asked the accounts payable department of that same company to process an Automated Clearing House (ACH) payment of nearly $50,000.
The United States received 87.7% of the campaign, according to Microsoft. The attacker sent the emails through multiple accounts at third-party email services, and Microsoft’s industry breakdown lists IT services and business advisory and consumer goods among the sectors targeted. Microsoft did not name the actor behind the campaign, and its post does not say whether any payments were made.
How the lure worked
The executive’s name appeared in three places: the sender display name, the reply-to display name and the email signature. The body carried a short approval of the “invoice below” and invited the recipient to ask for a PDF version if needed. Subject lines used financial lure keywords such as “due bill”.
To make the request look routine, the attacker added a forwarded email thread between the impersonated executive and ServiceNow, which was also impersonated, along with a fabricated invoice for an annual ServiceNow platform subscription. Microsoft also identified a look-alike domain, service-nowinc[.]com, registered on 31 July, shortly before the activity was observed. It supplied the spoofed address of ServiceNow’s President and appeared in the fake invoice as a contact email. A second domain, domainlify[.]net, was used in the reply-to address.
The AI markers
Microsoft said it observed several indicators consistent with AI-assisted template development: extensive HTML comments, structured section labelling and highly uniform template construction. One example it published is a verbose HTML comment describing a section of the email, a characteristic Microsoft says is commonly observed in AI-generated code. It also listed the use of em dashes and long banners of equals signs as traits that have become associated with AI use.
Microsoft is careful about what that evidence shows. The indicators suggest generative AI involvement, the company wrote, but they “do not independently establish the extent” to which AI generated the campaign content. In other words, this is Microsoft’s assessment of how the emails were built, based on artefacts in their code, not a finding about which tool was used or by whom.
A week of AI in attacks
The report follows two others this week that describe attackers using AI. On 8 September Google’s threat intelligence team described a suspected financially motivated actor using an autonomous multi-agent framework to run a credential-harvesting campaign in under six hours. A day later, GreyNoise reported that an attacker used hundreds of AI agents to compromise 395 organisations through flaws in PaperCut print management software.
Microsoft’s report does not describe exploits or agents. What it describes is an old fraud, executive impersonation aimed at the people who pay the bills, sent at a volume of more than a million messages with templates that bear signs of AI help.
What Microsoft recommends
Microsoft’s guidance centres on email controls, much of it in its own Defender products. It advises organisations to configure automatic attack disruption, turn on Zero-hour auto purge, invest in advanced anti-phishing protection, and configure mail flow with connectors. It also recommends setting up SPF, DKIM and DMARC email authentication.
Petri reported the findings on the same day, drawing on Microsoft’s post. The two domains Microsoft named give security teams something concrete to search mail logs for, and the pattern it describes, an executive’s approval sitting above a forwarded vendor thread, is one accounts payable staff can learn to recognise.
