Why This Matters to Distributors: Microsoft detected a financial fraud campaign that sent more than one million emails in three days, using executive impersonation, fake invoices, and fabricated email conversations to try to trigger fraudulent electronic payments. Microsoft did not identify distributors as specific targets, but the scheme attacks a process central to distribution: approving and paying supplier invoices.
A massive financial fraud campaign detected by Microsoft is putting a spotlight on a potential cybersecurity vulnerability for distributors: accounts payable.
Microsoft Security Research said attackers sent more than one million emails targeting enterprise users from Aug. 3 through Aug. 5. The attackers impersonated company executives and attempted to convince accounts payable departments to make Automated Clearing House payments of $50,000. U.S. users received 87.7% of the emails in the campaign.
The scheme went well beyond a conventional phishing message. Attackers combined executive impersonation, vendor branding, fabricated invoices, and fake email conversations to create a legitimate business transaction that had already been reviewed and approved.
Microsoft researchers also found multiple indicators consistent with generative artificial intelligence being used to develop the email templates. Microsoft cautioned, however, that those indicators did not establish how much of the campaign content was generated by AI.
For distributors, the significance is the business process under attack. Instead of trying to shut down a warehouse or encrypt an enterprise resource planning system, the attackers attempted to manipulate accounts payable employees into voluntarily sending money to accounts controlled by the fraudsters.
Attackers Target Accounts Payable
The campaign was designed to convince finance employees that they were processing legitimate invoices approved by company executives.
Microsoft said the attackers impersonated senior executives, including CEOs, chief financial officers, and presidents. The identities appeared in several parts of the fraudulent messages, including sender display names, reply-to display names and email signatures.
The email body contained an executive’s approval of the invoice and encouraged recipients to request a PDF version if needed. Directly below the executive’s signature, the attackers inserted a professional ServiceNow annual subscription invoice.
The fabricated invoice included ServiceNow branding and logos along with an invoice number, issue and due dates, currency, amount due, payment method and itemized charges. Payment instructions directed recipients to make money transfers to accounts controlled by the attackers.
Microsoft said portions of the invoices were personalized for individual recipients. The billing section included the targeted company’s name and an executive’s name.
Attackers added another layer of deception by placing two fabricated forwarded emails below the invoice. The messages showed an executive at the targeted company and a ServiceNow executive discussing the purchase, implementation, and handling of the invoice.
Microsoft emphasized that ServiceNow was being impersonated. Researchers found no evidence that ServiceNow or the other legitimate organizations referenced in the fraudulent messages had been compromised or were involved in the campaign.
Why the Attack Matters to Distributors
Microsoft did not identify wholesale distributors as specific targets, and its research does not establish that distributors were among the organizations receiving fraudulent emails.
The attack method nevertheless has direct implications for distributors because it targets an everyday business function. Distributors routinely receive and pay invoices from manufacturers, freight carriers, technology companies, contractors and other suppliers, making invoice approval and electronic payment a key area for fraud prevention.
The Microsoft campaign demonstrates how attackers can build an entire false business transaction around a payment request. Instead of relying on a single fraudulent email, they created apparent executive approval, a professional-looking invoice and supporting correspondence intended to make the transaction appear legitimate.
That approach changes the challenge for accounts payable employees. The question is no longer simply whether an email looks suspicious. Employees may be confronted with a package of related documents and communications designed to create the impression that other people inside the organization have already reviewed the transaction.
Microsoft said the campaign deliberately combined multiple techniques into a unified narrative intended to reduce recipient skepticism.
Attackers Research Their Targets
The campaign also demonstrates how information about companies and executives can be used to make financial fraud more convincing.
Microsoft mapped the activity into several techniques in the MITRE ATT&CK framework and said threat actors collected publicly available information about targeted organizations, executives, finance personnel, vendors, and business relationships to construct invoice-fraud narratives.
Attackers also registered internet domains designed to impersonate trusted organizations. Microsoft found that a lookalike domain used to impersonate ServiceNow, was registered July 31, several days before Microsoft detected the campaign.
Another domain registered the same day was used in reply-to email addresses. Attackers then used multiple third-party email service accounts to distribute fraudulent messages.
The combination of reconnaissance and impersonation allowed attackers to customize portions of fraud for individual organizations while maintaining a common underlying template.
For distributors, which is an important distinction. Public information about executives, suppliers and business relationships can potentially become part of a social-engineering attack even when an attacker has not penetrated the company’s internal systems.
Microsoft Finds Signs of AI Assistance
Microsoft researchers found several characteristics consistent with generative AI being used to help develop fraudulent email templates.
Those indicators included extensive comments embedded in HTML code, structured section labels, and highly uniform template construction. Microsoft also found that invoice identifiers and the underlying narrative remained consistent across samples while organization-specific information changed among targets.
Microsoft was careful not to overstate what those findings proved.
“While these indicators suggest generative AI involvement, they do not independently establish the extent to which AI generated campaign content,” Microsoft said.
The distinction is significant. Microsoft’s research supports describing the campaign as showing signs of AI-assisted template development, but it does not establish that generative AI created all the emails or other fraudulent material.
Microsoft said AI adoption has enabled threat actors to improve campaign templates and construct emails tailored to recipients. In this campaign, researchers documented a combination of personalization, executive impersonation and fabricated business records deployed across more than one million emails in three days.
The Fraud Still Left Warning Signs
Despite the detail in the fraudulent messages, Microsoft found inconsistencies that could help recipients and security systems identify them.
The fabricated forwarded emails lacked data headers typically found in genuine, forwarded messages. Microsoft also identified mismatches between display names and sender addresses, suspicious wording and subject lines containing financial lure terms.
Researchers found formatting problems as well. Previous messages in legitimate email threads are normally indented or otherwise visually grouped, while the fabricated conversations examined by Microsoft were left aligned.
Microsoft also found an inconsistency in the conversation itself. An executive appeared to ask that an invoice be sent directly to the recipient without copying the executive, but the newest message then appeared to come from that executive and said the invoice had been approved.
Those details demonstrate that even a carefully constructed fraud can contain warning signs. The broader risk is that attackers are combining several pieces of legitimate business information to make recipients less likely to question the underlying payment request.
Payment Controls Become Cybersecurity Controls
Microsoft recommends multiple layers of protection against executive impersonation and invoice fraud, including properly configured email authentication, spoof protection, mail-flow controls, and advanced anti-phishing technology.
The company also recommends automated attack-disruption and post-delivery remediation capabilities that can identify, quarantine, or remove malicious messages. Its guidance includes configuring Sender Policy Framework, DomainKeys Identified Mail and Domain-based Message Authentication, Reporting and Conformance, commonly known as SPF, DKIM and DMARC.
For distributors, Microsoft’s findings also reinforce the connection between financial controls and cybersecurity. An attacker does not necessarily have to penetrate an enterprise resource planning system, disable a distribution center, or deploy ransomware to cause a financial loss.
A convincing invoice and legitimate executive approval may be enough if the payment request is not independently verified.
Microsoft’s research shows how far that deception can go. Attackers combined executive impersonation, vendor branding, personalized invoices, fabricated email conversations, and lookalike domains into a coordinated attempt to persuade accounts payable employees to send money to attacker-controlled bank accounts.
Microsoft detected more than one million of those emails in three days, with 87.7% sent to U.S. users. For distributors processing a continuous stream of supplier invoices and electronic payments, the findings make clear that accounts payable belong within the company’s cybersecurity defenses.
Do not miss any content from Distribution Strategy Group. Join our list.
Share this article:
