Microsoft said it observed an AI-assisted business email compromise campaign that sent more than a million scam emails between August 3 and 5, using third-party delivery accounts to target enterprise users. The messages impersonated CEOs and other executives and tried to push finance teams toward an ACH payment of nearly $50,000.
Microsoft said the emails did not rely on a single lure. They combined a fake invoice, a forwarded thread, vendor branding, and executive-style signatures, so the request looked like an ordinary internal payment approval chain instead of an obvious outside phishing note.
That matters for any accounts payable process that treats sender reputation as a proxy for trust. If payment approval happens over email, the exposure sits in the business process itself: layered pretext and trusted delivery can make a fraud request look routine even when the mailbox defenses are working as designed.
Microsoft sees some new wrinkles in invoice-scam emails
Researchers analyzed a flood of fraudulent business emails and found that the threat actors had doubled-up on tactics to make them appear legitimate, including help from AI.
Protecting organizations from AI-assisted executive impersonation and invoice fraud | Microsoft Security Blog
Microsoft examines an AI-assisted business email compromise campaign that used executive impersonation and fake invoices to target finance teams with ACH payment fraud.