Listen to the episode
TLDR
Threat actors are sending over a million AI assisted emails impersonating CEOs and CFOs to trick accounts payable staff into processing fraudulent ACH payments of nearly $50,000. The campaign blends executive impersonation, vendor branding...
How it works
Threat actors are sending over a million AI assisted emails impersonating CEOs and CFOs to trick accounts payable staff into processing fraudulent ACH payments of nearly $50,000. The campaign blends executive impersonation, vendor branding...
Red flags
- Email signature, display name, and reply to all impersonate an internal executive who never sends payment approvals by email A forwarded thread plus a detailed invoice PDF are attached to add false legitimacy Pressure to process an urgent ACH wire to a new or unfamiliar beneficiary
What to do
- 1Verify any executive payment request out of band (phone call on a known number) before initiating any transfer Enable DMARC, SPF, and DKIM on your domain and warn staff about lookalike domain spoofs Require multi person approval and dual control workflows for ACH payments above a low threshold
Source
microsoft-security
Source reviewed by Mythos Forensic Team
https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/FAQ
Is AI Assisted CEO Impersonation Targets Accounts Payable With Fabricated Invoices a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Email signature, display name, and reply to all impersonate an internal executive who never sends payment approvals by email A forwarded thread plus a detailed invoice PDF are attached to add false legitimacy Pressure to process an urgent ACH wire to a new or unfamiliar beneficiary
What should I do first?
Verify any executive payment request out of band (phone call on a known number) before initiating any transfer Enable DMARC, SPF, and DKIM on your domain and warn staff about lookalike domain spoofs Require multi person approval and dual control workflows for ACH payments above a low threshold
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.