Threats · 47 days ago
Microsoft said it observed an AI-assisted business email compromise campaign that sent more than a million scam emails between August 3 and 5, using third-party delivery accounts to target enterprise users. The messages impersonated CEOs and other executives and tried to push finance teams toward an ACH payment of nearly $50,000.
Microsoft said the emails did not rely on a single lure. They combined a fake invoice, a forwarded thread, vendor branding, and executive-style signatures, so the request looked like an ordinary internal payment approval chain instead of an obvious outside phishing note.
That matters for any accounts payable process that treats sender reputation as a proxy for trust. If payment approval happens over email, the exposure sits in the business process itself: layered pretext and trusted delivery can make a fraud request look routine even when the mailbox defenses are working as designed.
3 sources covering this story
Threat Actor Generates 1M Personalized Fraud Emails in 3 Days
Cybercriminals behind malicious email campaigns no longer have to compromise volume for credibility, or vice versa, thanks to AI.
The Record from Recorded Future
Microsoft sees some new wrinkles in invoice-scam emails
Researchers analyzed a flood of fraudulent business emails and found that the threat actors had doubled-up on tactics to make them appear legitimate, including help from AI.
Microsoft examines an AI-assisted business email compromise campaign that used executive impersonation and fake invoices to target finance teams with ACH payment fraud.
Part of the PlainSec briefing for 2026-09-14