# A million CEO invoices in three days

2026-09-18

Microsoft caught more than a million GenAI-shaped CEO impersonation mails in 72 hours, each asking AP for about $50,000. Polish is no longer a tell.

Canonical: https://www.fabiocti.com/notes/million-ceo-invoices/
Author: Fabio Correia

The old filter for business-email compromise was tone.

Broken English. Wrong letterhead. A CEO who never says “kindly.” Finance used that. It was never a control. As of August it is also not a heuristic.

Between 3 and 5 August 2026, Microsoft logged more than a million scam emails impersonating CEOs, CFOs, and presidents at the target companies. 87.7% of them went to the United States. The ask was an ACH of roughly $50,000. The pretext was a ServiceNow invoice, plus a fabricated forwarded thread that made it look as if the company’s own executives had already discussed the purchase with ServiceNow’s leadership.

Microsoft says ServiceNow was not compromised. The names and the invoice were assembled from public company information. The HTML showed the usual generative-AI fingerprints — uniform section labels, leftover comments, the delimiter banners models leave in templates. Microsoft is careful: consistent with AI-assisted drafting, not a courtroom proof of which model. The volume is the point. A million tailored executive mails in three days is not a guy in a café writing each one.

## What the thread is doing

The payload is not the invoice. The payload is the *forward*.

Accounts payable is trained to distrust a cold vendor. They are not trained to distrust a chain that already contains their CEO approving it. The actor put the CEO in the display name, the reply-to, and the signature, then attached a conversation that never happened.

That is the same psychology as the hotel-video mail, pointed at money instead of shame. Specificity is cheap now. So is fluency. “It reads like him” is what the model is for.

## What not to do with it

Do not call the number in the thread. Do not reply-all to “confirm.” Do not open the PDF on the CEO’s laptop “to see if the letterhead is real.” Export the `.eml`. Look at the actual From, the return-path, the domain age on the lookalike. Microsoft noted those domains were registered days before the blast.

If AP already sent the ACH, that is a wire problem and a counsel problem. The CTI question is narrower: is this a one-off template hitting your finance alias, or did they also have a live mailbox to sit in and send the next one from inside.

A million-message campaign is spray. An internal send from a captured executive mailbox is a different incident. Do not mix them because both say “CEO” in the From.

## The tell that still works

Out-of-band. A second channel the invoice does not control. Voice to a number you already have, not the one in the mail. A purchase that is not in the system is not a purchase.

Pass the headers to someone who reads BEC for a living if the amount cleared, if the thread looks too inside, or if the same display name is now landing on the CEO’s personal Gmail as well. The model wrote the prose. It did not register the domain, and it did not invent a purchase order that exists.