Researchers at Microsoft have published analysis of a business-email-compromise campaign, observed in early August, that sent more than a million fraudulent emails in three days and impersonated senior executives to push accounts-payable departments into paying invoices of just under $50,000. The distinguishing feature is layering: rather than a single social-engineering lure, each message combined executive impersonation, ServiceNow vendor branding, a detailed fabricated invoice with credible line items and non-round amounts, and a forged email thread showing the executive asking a ServiceNow counterpart to forward the invoice on, all assembled into one narrative designed to reduce recipient scepticism. The attackers used several third-party services to dispatch the mail and customised templates with the real names of each target's chief executive, finance chief or president. Roughly 88% of the campaign's targets were in the United States. Microsoft's report identifies indicators it considers consistent with AI-assisted template development — extensive HTML comments, structured section labelling and highly uniform template construction — while stating explicitly that it cannot independently establish the extent to which AI generated the content. That caveat is worth keeping: the structural evidence supports assisted production at scale, not autonomous authorship, and the practical lesson for defenders sits in the quality and consistency of the forged thread rather than in the model question. The campaign is a scale and quality upgrade of a long-standing fraud category, and it follows the passkey and SSO social-engineering wave documented on 12 September as a second example this week of attackers investing in research and narrative before a single email is sent.

• Source article