Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments

Microsoft tracked a BEC campaign of over one million AI-assisted emails, sent August 3–5 with 87.7% targeting US recipients, impersonating executives and carrying fake ServiceNow invoices to induce ~$50,000 ACH payments to attacker-controlled accounts.

Microsoft analysts detected a business email compromise (BEC) campaign that delivered more than one million messages between August 3 and 5, with 87.7% of the volume targeting US recipients. The emails impersonated CEOs, CFOs, and presidents and embedded fabricated ServiceNow-branded subscription invoices directing accounts-payable staff to authorize ACH transfers of roughly $50,000 to attacker-controlled accounts. Attackers used lookalike domains such as service-nowinc[.]com — registered July 31, days before delivery — in sender and reply-to addresses, along with third-party delivery accounts. No malicious attachments or malware were used, and Microsoft found no evidence that ServiceNow or the named companies were compromised. Researchers inferred AI-assisted template creation from verbose HTML/CSS artifacts, structured templates, verbose HTML comments, uniform formatting, and inconsistent forwarded-message headers. Defenders were urged to verify payment requests out-of-band and enforce SPF/DKIM/DMARC.

• Over 1 million BEC messages detected by Microsoft, sent August 3–5
• 87.7% of campaign volume targeted US recipients
• Emails impersonated CEOs, CFOs, and presidents with fake ServiceNow-branded subscription invoices
• Fraudulent ACH payment requests were for roughly $50,000 to attacker-controlled accounts
• Lookalike domain service-nowinc[.]com, registered July 31, was used in sender and reply-to addresses; third-party delivery accounts were also used
• No malicious attachments or malware were used in the campaign
• Microsoft found no evidence that ServiceNow or the named companies were compromised
• AI-assisted template creation was inferred from verbose HTML/CSS comments, uniform formatting, and inconsistent forwarded-message headers