Microsoft security researchers recently identified a significant surge in fraudulent emails, highlighting an evolving trend in business email compromise (BEC) scams. These campaigns demonstrate how threat actors are leveraging artificial intelligence to refine their tactics and create more convincing, tailored communications.
In early August, Microsoft detected a campaign comprising over a million emails targeting its users, primarily in the United States, which accounted for approximately 88% of the targets. The attackers utilized several third-party services to dispatch these emails, impersonating senior executives to instruct accounts payable departments to process fraudulent payments, some approaching $50,000.
A notable development in these scams is the use of multiple deceptive tactics within a single email to enhance its perceived authenticity. For instance, the fraudulent emails included a fabricated forwarded email thread, purportedly from the fake CEO to ServiceNow, a cloud-based enterprise platform. This thread fabricated a scenario where the phony CEO had received invoices, also supposedly from ServiceNow, which itself was being impersonated.
Unlike traditional invoice scams that typically rely on a single social engineering lure, this campaign layered executive impersonation, vendor branding, fabricated invoices, and supporting email conversations into a unified narrative. This multi-faceted approach was designed to reduce recipient skepticism.
Microsoft's analysis revealed several indicators consistent with AI-assisted template development. These included extensive HTML comments, structured section labeling, and highly uniform template construction. While these elements suggest the involvement of generative AI, Microsoft's report stated that it could not independently establish the full extent to which AI generated the campaign content.
Security experts note that AI is enabling attackers to make established fraud schemes more sophisticated and scalable. This necessitates a corresponding evolution in safeguards, with increased attention to how AI models can be exploited to generate deceptive content at volume. There is also a recognized need for policymakers to consider how quickly useful AI capabilities can be adapted for malicious purposes once they are in the hands of attackers.
