Large-Scale AI-Assisted Business Email Compromise Campaign

Between August 3 and August 5, 2026, threat actors launched a large-scale business email compromise (BEC) campaign targeting enterprise accounts payable departments. The campaign, which reached over one million emails, leverages generative AI to create highly personalized, professional-looking email templates. By impersonating company executives (CEOs, CFOs) and mimicking reputable third-party vendors such as ServiceNow, the attackers construct a multi-layered narrative to bypass skepticism. The emails include fabricated invoices and simulated email threads between executives to create a sense of operational urgency. The objective is to coerce employees into processing unauthorized Automated Clearing House (ACH) payments, typically valued at nearly $50,000 per request. The activity spans multiple third-party email delivery platforms and utilizes lookalike domains to increase legitimacy. Defenders should note that while the campaign relies on high-quality visual impersonation, the email structures frequently contain technical inconsistencies, such as missing headers in forwarded threads.

Attack Chain

1. The actor registers domains designed to impersonate legitimate organizations or the target company.
2. The actor sets up accounts on third-party email service providers to facilitate mass delivery.
3. The actor crafts personalized email templates using generative AI, tailored to the target company's specific accounts payable role.
4. The email is sent to the target, appearing to originate from a senior executive (CEO, CFO, or President) of their own organization.
5. The email body contains a fabricated "approval" for an attached invoice and urges the recipient to process an urgent ACH payment.
6. The message includes a visually sophisticated, but forged, invoice with custom details (e.g., recipient company name) to establish credibility.
7. The actor embeds simulated "forwarded" email threads between the impersonated executives and the impersonated vendor (e.g., ServiceNow) to provide false supporting context.
8. The targeted employee, deceived by the narrative, initiates the fraudulent ACH payment to attacker-controlled bank accounts.

Impact

The campaign targets large enterprises, particularly in the IT services, business advisory, and consumer goods sectors, with the primary objective of direct financial theft. By successfully impersonating authority figures and mimicking standard procurement processes, the attackers aim to circumvent manual financial controls. Each successful engagement results in the loss of approximately $50,000 via ACH transfers. The campaign's breadth (over one million emails) and use of personalization significantly increase the likelihood of success for the attackers.

Recommendation

1. Implement strict email authentication protocols (SPF, DKIM, and DMARC) across the organization to minimize the success of domain spoofing.
2. Configure email security solutions to flag or quarantine messages that display common BEC artifacts, such as discrepancies between "From" headers and display names or mismatched reply-to addresses.
3. Establish a mandatory out-of-band verification process for all payment requests received via email, specifically those involving urgent ACH transfers or high dollar amounts.
4. Provide targeted security awareness training to finance and accounts payable teams regarding the signs of sophisticated invoice fraud, specifically the presence of fabricated email threads and suspicious invoice details.
5. Use security platforms to perform automated analysis of email content to identify common social engineering lures, such as the phrases and formatting styles identified in the "forwarded" threads of this campaign.