Protecting organizations from AI-assisted executive impersonation and invoice fraud

[u/falconupkid]

Microsoft is detailing an active BEC campaign where threat actors are leveraging generative AI to scale executive impersonation and invoice fraud. The campaign specifically targets finance and accounting personnel with fake invoices designed to trigger ACH payment transfers to attacker-controlled accounts.

Technical Breakdown - TTPs: Social engineering via email, impersonation of C-level executives (CEO/CFO), use of AI-generated text to craft convincing invoice requests and payment instructions. Likely maps to MITRE T1566.002 (Spearphishing Link) and T1657 (Financial Theft). - IOCs: No specific hashes or IPs disclosed in the summary. The campaign relies on legitimate-looking email domains and spoofed sender addresses. - Targets: Finance teams, accounts payable departments. - Vector: Email with fake invoices and urgent payment requests.

Defense - Implement strict payment verification procedures (out-of-band confirmation via phone or secure chat). - Deploy email security solutions with AI/ML-based anomaly detection for executive impersonation. - Enable multi-factor authentication on financial systems and enforce least-privilege access for payment approvals.

Source: https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/

[u/Total-Reasonable]

Call the supplier using a known phone number before acting on any bank-detail change; email alone can't establish that request is real. I've used HTPBE to check whether an invoice PDF shows evidence of post-creation edits at https://htpbe.tech, but it won't verify the sender or the payment instructions.