A million CEO-impersonation emails asked accounts payable to approve a nearly $50,000 ACH payment

The delivery path is what makes this hard to filter. The emails went out through multiple third-party email service accounts ^[2], so the sending infrastructure carried somebody else's reputation. The fake invoice rendered inside the message body, with no attachment, and the text approved the "invoice below" while telling recipients to request a PDF version if they needed one ^[7]. Parts of the invoice were personalized, with the recipient's company name and executive name in the BILLED TO field ^[6].

More than a million emails across the three days from August 3 to 5 is roughly 333,000 a day ^[15]. At 87.7 percent US-bound ^[3], that is about 877,000 messages landing with American recipients ^[16]. One accounts payable department paying once returns nearly $50,000 ^[4], which is a success rate of about one in a million ^[17].

Microsoft observed multiple financial institutions across samples and said payment destinations may vary between targets ^[14]. Blocking a beneficiary account after one attempt does nothing for the next company in the send list. The deterministic check sits at the payment step: verify the payee bank details out of band, against a number the clerk did not take from the email, before the ACH file is released.

The sender display name, the reply-to display name, and the email signature all carried the impersonated CEO's name ^[5], so a clerk reading the message sees the same executive identity at every point. Below the invoice sat two more forwarded emails staging a conversation between the spoofed customer executive and a spoofed ServiceNow President about the purchase and its implementation ^[12]. Microsoft's framing is that the campaign layered executive impersonation, vendor branding, fabricated invoices and supporting conversations into one narrative meant to reduce recipient skepticism ^[11].

The AI part is described carefully in the source. Microsoft says the emails displayed multiple indicators consistent with the use of generative AI during email template creation ^[10], and that the impersonation technique itself is not new, with AI improving campaign templates and per-recipient tailoring ^[9]. The fraud itself hasn't changed; what changed is how many tailored variants can ship in three days.

The chain before delivery is ordinary: register impersonation domains, send executive-themed payment requests through trusted infrastructure, embed the fabricated invoice and conversation, work on finance staff to initiate the transfer ^[13]. Microsoft found no evidence that the legitimate organizations referenced in the lures, ServiceNow included, were compromised or involved, and attributed the activity to fraudulent domains and content built to mimic trusted brands and individuals ^[8].