The invoice looked right. ServiceNow branding, an invoice number, issue and due dates, itemised lines for an annual platform subscription, a total of nearly $50,000, and a BILLED TO block naming the recipient's own company and their own chief executive. Underneath it sat a short forwarded email thread in which that chief executive and a ServiceNow president discussed the purchase and agreed the bill should be paid.
All of it was fabricated. Microsoft Security Research reports that between 3 and 5 August it detected a campaign of more than a million emails aimed at enterprise users, 87.7% of them at recipients in the United States, sent through multiple third-party email service accounts. The goal in every case was the same: get an accounts payable team to push an ACH transfer to a bank account the sender controlled.
Microsoft is explicit that the impersonated companies were victims of the lure rather than participants in it. It found no evidence that any of the organisations referenced, ServiceNow included, were compromised or involved. The campaign ran entirely on attacker-controlled infrastructure and lookalike domains.
Four lies stacked into one message
Executive impersonation in a payment request is an old trick, and on its own it is one most finance teams have been trained to spot. What is notable here is the layering. The target company's chief executive was impersonated in the sender display name, in the reply-to display name and again in the signature block. The email body did nothing more than approve "the invoice below" and offer a PDF on request. Below the signature came the fake ServiceNow invoice. Below that came two more forwarded messages, a small manufactured conversation between the spoofed executive and a spoofed ServiceNow president, quietly answering the question a suspicious reader would ask next.
The domains were registered days ahead. A ServiceNow lookalike, service-nowinc[.]com, was set up on 31 July and used for the spoofed president's address and as the contact address printed on the invoice. A second domain registered the same day, domainlify[.]net, carried the reply-to.
The AI evidence, stated carefully
Microsoft observed several indicators consistent with AI-assisted development of the email templates: extensive HTML comments, structured section labelling and highly uniform template construction across samples, along with verbose capitalised section headers, banner separators and em dashes in the markup. It also notes that invoice identifiers and narrative structure stayed largely consistent from sample to sample while the organisation-specific details changed, which is what template-based generation looks like.
Microsoft then draws the line most write-ups skip: those indicators suggest generative AI involvement, but they do not independently establish how much of the content AI produced. That caution is worth preserving. The trend it fits is real, and we have tracked the same shift in business email compromise, but a verbose HTML comment is a fingerprint of a code generator, not a confession.
The formatting is what gives it away
For defenders, the useful part of the report is that the fakery failed at the level of layout rather than language. Genuine forwarded threads carry date headers; the ones stitched into these messages did not. Real quoted replies are indented or otherwise visually grouped; these were left aligned. The narrative contradicted itself, with the chief executive asking not to be copied on the invoice in one message and then apparently sending it himself in the next. And the headers carried the usual mismatches, a display name that does not match the sending address, and subject lines built around payment keywords.
Microsoft's guidance is the layered kind: properly configured SPF, DKIM and DMARC, spoof protection and correctly configured mail-flow connectors with enhanced filtering, Zero-hour Auto Purge to claw back messages found malicious after delivery, and automatic attack disruption to contain a campaign already in progress. Brand-impersonation lures like this one keep working because the surrounding paperwork looks ordinary, a pattern we saw again when genuine Docusign notifications were bent into a phishing kit's delivery path. The practical control is unchanged and unglamorous: a payment instruction that arrives by email gets verified through a channel that is not email, no matter whose name is on it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.