Microsoft AI-Assisted Executive Impersonation – Million-Message ACH Invoice Fraud Campaign

Threat Overview

Microsoft Security Research disclosed a high-volume financial fraud campaign that sent more than one million emails between August 3 and August 5, 2026. The actor used third-party email delivery infrastructure, lookalike domains, executive impersonation, fabricated ServiceNow-branded invoices, and forged forwarded-email threads to pressure accounts-payable personnel into sending ACH payments of roughly $50,000. Microsoft observed multiple indicators consistent with generative-AI-assisted template creation, but explicitly noted that those indicators do not independently prove how much content was AI-generated. The campaign was primarily directed at U.S. enterprise users and combined volume with recipient-specific personalization.

References

Microsoft Security Research, “Protecting organizations from AI-assisted executive impersonation and invoice fraud,” September 10, 2026: https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/
Dark Reading, “Threat Actor Generates 1M Personalized Fraud Emails in 3 Days,” September 11, 2026: https://www.darkreading.com/cyberattacks-data-breaches/1m-personalized-fraud-emails-3-days

Impacted Systems

Threat type: business email compromise / invoice fraud, not a software vulnerability. Primary platform: enterprise email, particularly Microsoft 365 environments with finance and accounts-payable users. Exposure condition: receipt of attacker-controlled inbound email from third-party delivery infrastructure or lookalike domains. Confirmed campaign domains: service-nowinc.com and domainlify.net. Microsoft published multiple sender addresses used in delivery. The legitimate ServiceNow organization was not compromised according to Microsoft. No product patch or affected software version applies.

Why this matters

This campaign demonstrates that targeted BEC-style fraud can now be personalized at bulk-email scale. It is broadly applicable to MSSP customers because almost any organization with finance personnel and public executive information can be targeted, and the campaign uses ordinary email rather than malware or a vulnerable Internet-facing service.

Exploitation Status

Confirmed campaign activity observed by Microsoft. More than one million emails were sent between August 3 and 5, with 87.7% of campaign volume directed to users in the United States. The actor attempted to induce fraudulent ACH transfers. Microsoft found no evidence that ServiceNow or other impersonated legitimate organizations were compromised.

What this hunt looks for

Published senders and domains, financial-lure subjects, newly seen sender domains, unusually high-volume delivery patterns, lookalike ServiceNow domains, URL clicks, endpoint connections, and delivered messages later identified as threats.

Required logs

Microsoft Defender for Office 365 email telemetry is the primary source, including EmailEvents and UrlClickEvents. DeviceNetworkEvents provides endpoint follow-up where Defender for Endpoint telemetry is available. These Defender XDR tables use their native Timestamp field.

First Pass – Published Sender and Domain Indicators

let SenderAddresses=dynamic(["gomez@service-nowinc.com","notifications@uinsure.co.uk","info@tivityhealth.com","no-reply@lumalisboa.com","noreply@mctci.com","info@nuf.co.jp","info@lohnsteuerhilfe-aktuell-verein.de","info@tovimbatista.pt","contact@eemusicclass.co.uk","info@lifeones.com"]);
let Domains=dynamic(["service-nowinc.com","domainlify.net"]);
EmailEvents
| where Timestamp >= ago(30d)
| where SenderFromAddress in~ (SenderAddresses) or SenderFromDomain in~ (Domains) or SenderMailFromDomain in~ (Domains)
| project Timestamp,NetworkMessageId,SenderFromAddress,SenderFromDomain,SenderMailFromAddress,SenderMailFromDomain,RecipientEmailAddress,Subject,DeliveryAction,ThreatTypes,DetectionMethods
| order by Timestamp desc

Financial Lure Subjects With Executive or Vendor Impersonation Themes

EmailEvents
| where Timestamp >= ago(30d)
| where Subject has_any ("ACH","invoice","annual subscription","due bill","payment","ServiceNow")
| where EmailDirection =~ "Inbound"
| project Timestamp,NetworkMessageId,SenderDisplayName,SenderFromAddress,SenderFromDomain,RecipientEmailAddress,Subject,DeliveryAction,ThreatTypes,DetectionMethods
| order by Timestamp desc

Newly Seen Sender Domains Delivering Financial Lures

let Baseline=EmailEvents
| where Timestamp between (ago(30d)..ago(2d))
| where EmailDirection =~ "Inbound"
| summarize by SenderFromDomain;
EmailEvents
| where Timestamp >= ago(2d)
| where EmailDirection =~ "Inbound"
| where Subject has_any ("ACH","invoice","annual subscription","due bill","payment")
| join kind=leftanti Baseline on SenderFromDomain
| summarize FirstSeen=min(Timestamp),LastSeen=max(Timestamp),Messages=count(),Recipients=dcount(RecipientEmailAddress),Subjects=make_set(Subject,30) by SenderFromDomain
| order by FirstSeen desc

High-Volume Inbound Sender Domains With Financial Lures

EmailEvents
| where Timestamp >= ago(7d)
| where EmailDirection =~ "Inbound"
| where Subject has_any ("ACH","invoice","payment","subscription","bill")
| summarize Messages=count(),Recipients=dcount(RecipientEmailAddress),Senders=dcount(SenderFromAddress),Subjects=make_set(Subject,30) by SenderFromDomain,bin(Timestamp,1h)
| where Messages >= 25 or Recipients >= 15
| order by Messages desc

Messages From Lookalike ServiceNow Domain

EmailEvents
| where Timestamp >= ago(30d)
| where SenderFromDomain has "service-now" or SenderMailFromDomain has "service-now"
| where SenderFromDomain !~ "servicenow.com" and SenderMailFromDomain !~ "servicenow.com"
| project Timestamp,NetworkMessageId,SenderDisplayName,SenderFromAddress,SenderFromDomain,SenderMailFromAddress,SenderMailFromDomain,RecipientEmailAddress,Subject,DeliveryAction
| order by Timestamp desc

Clicks to Published Campaign Domains

let Domains=dynamic(["service-nowinc.com","domainlify.net"]);
UrlClickEvents
| where Timestamp >= ago(30d)
| where Url has_any (Domains)
| project Timestamp,AccountUpn,Url,ActionType,NetworkMessageId,ThreatTypes,DetectionMethods
| order by Timestamp desc

Endpoint Connections to Published Campaign Domains

let Domains=dynamic(["service-nowinc.com","domainlify.net"]);
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteUrl has_any (Domains)
| project Timestamp,DeviceName,InitiatingProcessAccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort
| order by Timestamp desc

Delivered Financial-Lure Messages Later Flagged as Threats

EmailEvents
| where Timestamp >= ago(30d)
| where Subject has_any ("ACH","invoice","annual subscription","payment","bill")
| where DeliveryLocation =~ "Inbox/folder"
| where isnotempty(ThreatTypes) or isnotempty(DetectionMethods)
| project Timestamp,NetworkMessageId,SenderFromAddress,SenderFromDomain,RecipientEmailAddress,Subject,ThreatTypes,DetectionMethods,DeliveryAction,DeliveryLocation
| order by Timestamp desc

Detection Notes

The published sender addresses and domains are the highest-confidence pivots but should not be treated as complete coverage because the campaign used multiple third-party email services and payment destinations can change. Financial subject-keyword queries are intentionally broader and require context. The actor used display-name impersonation and fabricated thread content, which may not be fully represented as structured fields in all Sentinel email schemas. If Defender for Office 365 or equivalent email telemetry is not available, Sentinel visibility is limited.