Microsoft describes an observed campaign using AI-assisted executive impersonation and fraudulent invoices. The attackers posed as internal leaders and as a known vendor, used convincing invoice content, and targeted finance teams. For small and midsize businesses, this matters now because these messages do not look like classic malware. They look like internal approval, a supplier invoice, and a normal payment workflow.
What Microsoft observed
Microsoft Threat Intelligence reports a campaign in early August 2026 in which more than one million fraudulent emails were sent through third-party delivery infrastructure. The messages impersonated CEOs, CFOs, or presidents of the targeted companies. According to Microsoft, the goal was to persuade accounts payable teams to process an ACH payment of nearly USD 50,000. Microsoft also lists several indicators consistent with generative AI being used during template creation, while not making a final claim about the exact extent of AI involvement.
- Spoofed sender and reply-to display names appeared to match executives.
- A fabricated ServiceNow invoice was used to make the payment request credible.
- An alleged forwarded thread attempted to simulate internal approval.
Why this is risky for SMBs
For companies with 10 to 250 workplaces, the attack is especially difficult because payment workflows often depend on only a few people. Add holiday cover, urgency, or delegated approvals, and a single email can become a real business risk. Microsoft states that the legitimate organizations referenced in the lures were not compromised based on the available evidence. The issue is therefore not limited to one vendor. It is about lookalike domains, fabricated content, and abused trust.
The lure also does not ask the recipient to perform an obviously technical action. It asks for what looks like a normal commercial decision. That is why awareness alone is not enough. If every case is handled as a debate about whether an invoice “looks real,” valuable time is lost. A fixed combination of technical detection, payment approval rules, and a documented escalation path is safer.
Which Microsoft protections help
Microsoft points to several layers in Microsoft Defender. Defender for Office 365 can detect fraudulent emails, links, and files; Zero-hour Auto Purge retroactively removes phishing, spam, or malware messages identified after delivery from cloud mailboxes. In the campaign write-up, Microsoft also refers to automatic attack disruption in Defender XDR, which is designed to contain attacks in progress, and to Threat Analytics in the Defender portal for current intelligence and recommended actions. Microsoft Security Copilot can support investigation and response, according to Microsoft, through custom prompts or prebuilt promptbooks.
The order of controls matters. Email authentication and connector review influence whether a message receives trust in the first place. Impersonation protection, Safe Links, and Safe Attachments examine content, link targets, and files. ZAP then shortens the exposure window if a delivered message is identified as malicious later. Defender XDR connects signals across identity, mailbox, and endpoint activity.
Deadlines and urgency
Microsoft does not name a migration deadline or retirement date for this campaign. The urgency comes from the observed abuse pattern: the campaign was already active in August 2026, and Microsoft published its analysis on 10 September 2026. Organizations should therefore not wait for a product deadline, but review their payment and email controls soon. The most important mailboxes are finance, executive assistance, management, and anyone who can initiate or confirm payment approvals.
What companies should review now
- Review SPF, DKIM, and DMARC as well as Exchange connectors so third-party mail flows do not receive unchecked trust.
- Check whether ZAP is effective in the relevant anti-spam, anti-phishing, and anti-malware policies.
- Review impersonation protection, mailbox intelligence, and policies for executive and domain impersonation.
- Define a second channel outside email before new bank details or unexpected invoices are approved.
- Use Defender XDR incidents and Threat Analytics to connect related lures, domains, and affected users.
A Microsoft Security Assessment should not treat these points as a technical checklist only. What matters is whether protection policies, payment workflow, and responsibilities work together. Only then can the organization recognize not just one suspicious message, but the full chain of sender, link, attachment, identity, and potential payment.
Official Microsoft sources
- Microsoft Security Blog: Protecting organizations from AI-assisted executive impersonation and invoice fraud
- Microsoft Learn: Zero-hour auto purge in Microsoft Defender for Office 365
- Microsoft Learn: Configure automatic attack disruption in Microsoft Defender XDR
If you want to know whether your Microsoft 365 environment would detect these invoice and executive-impersonation lures in time, we review Defender, mail flow, and escalation paths with you — get in touch.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
