Protecting organizations from AI-assisted executive impersonation and invoice fraud

This Microsoft Threat Intelligence report details a mass executive-impersonation invoice-fraud campaign that used generative-AI-like templates and third-party email infrastructure to distribute over one million spearphishing emails targeting finance teams; attackers impersonated company executives and ServiceNow, included fabricated invoices requesting ACH transfers to attacker-controlled bank accounts, and registered lookalike domains and attacker-controlled replies — the report includes IOCs, MITRE mappings, detection coverage, and mitigation recommendations.