Affected Systems

Over 1 million emails sent August 3-5 targeting enterprise finance/accounts payable departments, primarily in United States (87.7%). Campaign used third-party email delivery infrastructure to impersonate C-level executives (CEO, CFO, President) with fabricated ServiceNow invoices requesting ~$50,000 ACH transfers. All industries affected, with IT services, business advisory, and consumer goods most targeted.

Exploitation Status

Active campaign observed in August with over 1 million emails delivered. Threat actors using generative AI to craft convincing email templates with executive impersonation, fabricated invoices, and multi-layered social engineering. No technical exploitation involved—purely social engineering-based BEC attack.

Business Impact

Finance and accounts payable teams face elevated risk of fraudulent ACH payments up to $50,000 per incident. Campaign demonstrates AI-enhanced social engineering that increases email legitimacy and reduces recipient skepticism. Traditional email security controls may not detect these attacks as they use legitimate third-party email services and contain no malware. Organizations without strong payment verification processes are at highest risk. Potential for significant financial loss and reputational damage if payments are processed.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Implement mandatory out-of-band verification for all payment requests—require phone confirmation using known executive contact numbers (not from email) before processing ACH transfers or wire payments
  • Configure email security to flag external emails with executive display names and enable warnings when reply-to addresses do not match sender domains
  • Train finance and accounts payable staff to identify BEC indicators: missing email headers in forwarded threads, display name/sender address mismatches, urgency language, and requests to bypass normal approval workflows
  • Review and enforce separation of duties for payment processing—require dual authorization for ACH transfers above defined thresholds (e.g., $10,000)
  • Deploy Microsoft Defender for Office 365 with impersonation protection enabled for executives and enable advanced phishing detection rules for financial keywords (ACH, invoice, payment due)