Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments
A BEC campaign sent over one million fake CEO invoice emails, mostly to US firms, urging ~$50,000 ACH transfers to attacker accounts.
Microsoft analysts tracked a business email compromise campaign that sent more than one million messages between August 3 and 5, with 87.7% targeting US recipients. Emails impersonated CEOs, CFOs, and presidents and carried fake ServiceNow-branded subscription invoices directing accounts-payable staff to make ACH transfers of nearly $50,000 to attacker-controlled accounts. No malicious attachments or malware were used, and researchers observed signs consistent with AI-assisted template development. Lookalike domains such as service-nowinc[.]com and third-party delivery accounts were used, while named firms like ServiceNow showed no evidence of compromise.
- Over 1 million BEC emails sent August 3-5; 87.7% targeted US recipients
- Spoofed executives approved invoices with fake ServiceNow branding requesting ~$50,000 ACH payments
- Lookalike domain service-nowinc[.]com used in sender and reply-to addresses
- Structured templates and HTML comments suggest possible generative-AI assistance
- Microsoft found no evidence ServiceNow or named companies were compromised
- Vendors
- MicrosoftServiceNow
- Products
- ServiceNow
- Organizations
- MicrosoftServiceNow
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | domainlify.net | om Sender email address used to send campaign emails Domain domainlify[.]net Newly registered domain used in the Reply-To address Note |
| domain | eemusicclass.co.uk | address used to send campaign emails Email address contact@eemusicclass[.]co[.]uk Sender email address used to send campaign emails Email |
| domain | lifeones.com | ail address used to send campaign emails Email address info@lifeones[.]com Sender email address used to send campaign emails Domain |
| domain | lohnsteuerhilfe-aktuell-verein.de | ail address used to send campaign emails Email address info@lohnsteuerhilfe-aktuell-verein[.]de Sender email address used to send campaign emails Email a |
| domain | lumalisboa.com | address used to send campaign emails Email address no-reply@lumalisboa[.]com Sender email address used to send campaign emails Email a |
| domain | mctci.com | address used to send campaign emails Email address noreply@mctci[.]com Sender email address used to send campaign emails Email a |
| domain | nuf.co.jp | ail address used to send campaign emails Email address info@nuf[.]co[.]jp Sender email address used to send campaign emails Email |
| domain | service-nowinc.com | rs of compromise (IoCs):- Type Indicator Description Domain service-nowinc[.]com Domain impersonating ServiceNow Email address gomez@servi |
| domain | tivityhealth.com | ail address used to send campaign emails Email address info@tivityhealth[.]com Sender email address used to send campaign emails Email a |
| domain | tovimbatista.pt | ail address used to send campaign emails Email address info@tovimbatista[.]pt Sender email address used to send campaign emails Email a |
| domain | uinsure.co.uk | associated with a bank account Email address notifications@uinsure[.]co[.]uk Sender email address used to send campaign emails Email |
From the original article
4 min read at cybersecuritynews.com
A large email fraud campaign used fake CEO messages and invoices to push employees toward payments of nearly $50,000. The operation did not rely on a malicious attachment or software flaw. Instead, it used ordinary email to deliver a scam.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.