Microsoft Detects Million-Email BEC Wave Using Layered AI Templates and ServiceNow Impersonation

The emails forwarded a fabricated internal thread in which a fake CEO appeared to have already approved ServiceNow invoices, then directed payment. Attackers routed the messages through multiple third-party services while embedding uniform HTML structures and section labels that Microsoft flagged as consistent with generative-AI template generation. Eighty-eight percent of targets were US firms, showing deliberate geographic focus rather than spray-and-pray distribution.

Traditional BEC relied on one social-engineering hook; this operation stacked four elements—CEO spoofing, vendor branding, invoice attachment, and prior email chain—into a single narrative. The uniformity of the HTML comments and labeling across a million messages points to automated template reuse rather than hand-crafted lures, a pattern also visible in recent Proofpoint and Abnormal Security reports on AI-assisted credential-harvesting kits.

ServiceNow’s own brand was co-opted without the company’s knowledge, illustrating how attackers now treat enterprise workflow platforms as trust anchors. No independent technical attribution ties the campaign to any named group, yet the scale and reuse of infrastructure suggest professionalized crews rather than lone operators.

Defensive controls that still key on single indicators will miss these narratives. Organizations must move to thread-level verification and payment-approval workflows that cannot be satisfied by email alone; otherwise the same template factory will simply rotate vendors and amounts in the next quarter.