← 피드로
Email
1. Overview
- Source: Protecting organizations from AI-assisted executive impersonation and invoice fraud
- Publisher: Microsoft Security Research
- Published Date: 2026-09-10
- Updated Date: Not specified
- Severity: high
- Reason for Severity: A large-scale delivery of over 1 million emails combining executives, vendors, invoices, and email conversation history, with evidence of template generation consistent with generative AI usage.
- Related Resources: Microsoft Learn: Email authentication mechanisms and limitations
2. Executive Summary
Attackers sent over 1 million emails posing as company executives and vendors, asking accounts payable staff to make an ACH transfer of nearly 50,000 USD (a US interbank payment system). They combined fake ServiceNow invoices and email conversation history to make the fraud look like an approved payment.
3. Attack Flow
AI-Assisted Executive Impersonation and Fake Invoices: Over 1 Million ACH Fraud Emails
- Register similar domains and prepare accounts with third-party email delivery services.
- Create templates that include the target company executive name, ServiceNow branding, and destination bank account.
- Combine the executive approval text, fake invoice, and fabricated forward thread into a single email and send it to accounts payable staff.
- Prompt the staff to request a PDF version or execute an ACH transfer to the attacker’s account.
- Financial loss occurs when the transfer to the attacker’s account is executed. Approval or account registration alone does not mean the transfer is complete, and public articles do not show the actual number of successful transfers.
4. Attacker Position and Execution Location
- A remote attacker who researched target company executive and payment staff information, and can operate similar domains and email delivery infrastructure.
5. Visibility for Victims and Administrators
Victims
- Receive billing emails that look approved by an executive, detailed fake invoices, and plausible forward threads that contain contradictions in format or content.
Administrators
- Emails where the sender address or Reply-To does not match the executive display name, and email conversation history lacking normal forward headers or indentation.
6. Success and Failure Conditions
Success Conditions
- The email reaches the payment staff.
- The staff trusts the story combining the executive, vendor, invoice, and email conversation history.
- Process the ACH transfer without separate approval or account change verification.
Failure Conditions and Risk Mitigation
- Combine sender domain authentication using SPF, DKIM, and DMARC with the detection of impersonation using executive display names or similar domains. Successful email authentication does not guarantee the legitimacy of billing details or transfer destinations.
- Require callback to pre-registered contact details and multiple approvals for new or changed transfer destinations.
- Inspect the consistency of executive display names, Reply-To, billing accounts, and forward headers.
7. What Happens Upon Success
- Unauthorized ACH transfer to an attacker-managed account
- Business process compromise via executive and vendor impersonation
- Consumption of payment staff trust and response time
8. Observable Logs
Inference: Based on published attack behavior, we organize logs and collection conditions useful for investigation.
- Email header From, Reply-To, source IP, authentication results, Message-ID, recipient, and delivery/quarantine results. Distinguish fake forward headers in the body from actual delivery history.
Proxy / SWG / DNS
- DNS queries and web access when managed devices reference the relevant domain. Check domain registration dates using registration information such as RDAP rather than DNS logs.
Endpoint / EDR
- Malware execution on devices is not observed in this article. If there are reports such as opening an additional file received, check the record of that operation.
Identity / IdP
- Compromise of target company or ServiceNow accounts has not been confirmed in this case. Check sign-in and mailbox audit records if there are other signs such as sending from real accounts.
SaaS / Cloud
- Invoice reception/approval, registration/modification of transfer destination accounts, and creation/approval/execution results of payment instructions. Check bank and payment system processing results separately from accounting records.
Network
- When inducing transfers solely via email, recipient web access may not occur. The absence of relevant traffic in DNS and web logs does not rule out replies to emails or transfers.
9. Attack Success Determination
- Attack attempt observed (success unconfirmed): Microsoft detected over 1 million scam emails. The number of replies, invoice approvals, account registrations, and executed transfers is not shown. To determine transfer success within your organization, confirm not only approval records but also transfer destinations, amounts, and processing results using bank or payment system records.
10. Investigation Playbook
Inference: Below are investigation steps if a similar attack is suspected in your organization.
Starting Point
- Start with suspicious billing emails under executive names, consultations from payment staff, and registration or modification of unusual transfer destinations.
Initial Review
- Preserve the original email and headers, recipient, reception time, invoice number, amount, and transfer destination, and identify staff who received the same email or invoice.
- Do not use contact information listed in the email; verify the authenticity of billing and approval through pre-registered internal and vendor contacts.
Endpoint
- Check for replies, requests/receipt of PDFs, opening of files, or link interactions by the recipient. Add device investigations if there are signs of file execution.
Identity / Cloud
- Cross-check email delivery records with invoice approvals, account registrations, and payment instructions in accounting and payment systems. Add authentication and mailbox audits if unauthorized use of real accounts is suspected.
Subsequent Investigation
- Search for other recipients and past payment requests using the same Reply-To, transfer destination account, invoice number, and fake conversation content as clues.
Containment
- Quarantine and delete the relevant email, and ask accounting to hold unprocessed payment instructions and account changes. If already transferred, contact banks and payment providers immediately and initiate the organization’s unauthorized transfer response procedure.
Determination
- Record reception, reply, invoice approval, account registration, payment instruction, and transfer completion separately. Even if there are payment instructions, treat them as unsuccessful if they are unexecuted, rejected, or canceled.
11. Defense and Detection Ideas
Inference: Below are detection and mitigation proposals based on public information. Do not judge maliciousness based on a single match alone; cross-reference with normal business operations.
Single Event
- Check inconsistencies in the relationships between the executive display name, sender address, and Reply-To address, billing content disguised as ServiceNow, unregistered accounts, and fake forward threads. Consider legitimate delegated sending and separate use of reply-to addresses.
Time Series Correlation
- Correlate whether suspicious email arrivals are followed by replies, account registrations, approvals, and payment instructions corresponding to the same invoice and recipient.
Hunting
- Search emails starting with service-nowinc[.]com, domainlify[.]net, invoice numbers, and transfer destination accounts, and expand the investigation to similar emails combining executive approval text, fake invoices, and email conversation history.
Log Gaps
- Check retention periods for bodies and headers, post-delivery deletion records, and acquisition status of approvers, transfer destinations, and processing results. Retain information linking emails and accounting records, such as Message-ID, invoice number, user ID, and timestamp.
Priority Measures
- Combine sender domain authentication using SPF, DKIM, and DMARC with the detection of impersonation using executive display names or similar domains. Successful email authentication does not guarantee the legitimacy of billing details or transfer destinations.
- Require callback to pre-registered contact details and multiple approvals for new or changed transfer destinations.
- Inspect the consistency of executive display names, Reply-To, billing accounts, and forward headers.
12. Facts / Inference / Hypothesis
Facts
- Microsoft detected over 1 million scam emails sent to corporate users from multiple accounts of a third-party email delivery service between August 3 and 5, 2026.
- Attackers used the CEO, CFO, and president of target companies in sender display names, reply-to display names, and signatures, asking accounts payable staff for an ACH transfer of nearly 50,000 USD.
- Embedded fake ServiceNow invoices and fabricated forward threads making it look like target company executives and the ServiceNow president discussed purchases in the same email. Microsoft has not confirmed the compromise of legitimate organizations such as ServiceNow.
- Attackers used service-nowinc[.]com resembling ServiceNow as a fake contact and domainlify[.]net registered on the same day as the reply-to address.
- HTML contained indicators consistent with generative AI-assisted template development, such as excessive comments, regular section labels, em dashes, and delimiter banners, but Microsoft has not determined the scope of AI generation.
- Fake forward threads lacked normal forward headers or indentation, and discrepancies between sender addresses and display names and contradictions in conversation content remained.
Inference
- Observable logs, investigation playbooks, and defense/detection ideas are proposals based on published email scam procedures. Correlation between emails and payment/settlement records can distinguish between inducement and transfer execution.
Hypothesis
No additional hypotheses. Unconfirmed items are described in “Unresolved Issues and Further Investigation”.
13. MITRE ATT&CK Mapping
Inference: Mapping based on published behaviors.
- T1566 Phishing (Confidence: high): Deceives payment staff with emails posing as executives or vendors. Since email body analysis alone cannot identify the inducement to malicious links, it is not limited to Spearphishing Link.
- T1656 Impersonation (Confidence: high): Impersonates target company executives or vendors to influence payment decisions.
14. Unresolved Issues and Further Investigation
- Number of actual successful transfers and financial damage.
- Methods for acquiring third-party email delivery accounts.
- Specific scope of templates created or modified by generative AI.
15. Impact on SOCs and Organizations
Judging solely by generative AI-like writing styles is prone to false positives, and attackers can easily modify them. It is important to check the consistency of display names, senders, reply-to addresses, billing accounts, and approval workflows, and connect suspicious email detection to payment withholding. Although ACH itself is a US payment method, countermeasures against invoice scams disguised as approved are common to payment operations across countries. If SOC and accounting can share invoice numbers and transfer destinations, cases of reception only can be separated early from cases that proceeded to approval and transfer.
16. Summary by Target Audience
- SOC: Combine executive display names, similar domains, Reply-To, ACH terms, and fabricated forward formats to track post-delivery approval and transfer operations.
- Administrator: Set up DMARC and similar domain monitoring, and mandate confirmation to pre-registered contact details and multiple approvals for new accounts and account changes.
- User: Even for billing approved by executives, verify via official out-of-band contact details if the sender, reply-to address, or account is new.