Microsoft
2 items across 2 editions · appeared in the last 2 editions in a row. First seen Fri 11 Sep, last seen Sat 12 Sep.
- The Record reported on 11 September that the early-August campaign targeted more than one million users and solicited payments of roughly $50,000 each from accounts-payable departments, with about 88% of recipients in the United States.
- Microsoft says the campaign "layered executive impersonation, vendor branding, fabricated invoices, and supporting email conversations into a unified narrative intended to reduce recipient skepticism" — including fabricated correspondence from ServiceNow to build a false invoice chain.
- Microsoft identified markers "consistent with AI-assisted template development" — extensive HTML comments, structured section labelling and highly uniform template construction — but says it cannot definitively confirm the extent of generative AI use.
- This adds detail to yesterday's item on the same campaign. Microsoft's caveat is the point worth holding onto: the AI attribution here is inferred from template artefacts, not observed.
- Microsoft reported on 10 September a business email compromise campaign that sent more than 1 million phishing emails between 3 and 5 August, with 87.7% directed at users in the United States, targeting IT services, business advisory and consumer goods firms. Messages impersonated executives and requested ACH payments of nearly $50,000 per target.
- Microsoft attributes AI assistance to the template construction rather than to the sending infrastructure, citing extensive HTML comments, structured section labelling, verbose descriptive comments, em dashes, banner formatting and highly uniform templates whose invoice identifiers stayed constant while organisation details changed per target.
- Named indicators include the ServiceNow-impersonating domain service-nowinc[.]com and domainlify[.]net in reply-to addresses. Recommended mitigations are automatic attack disruption in Defender XDR, Zero-hour Auto Purge, and correctly configured SPF, DKIM and DMARC.
- Microsoft does not name a threat actor, and the AI evidence is stylistic inference from artefacts left in the templates rather than direct observation of a model in use. No losses are quantified.