Between August 3-5, threat actors distributed over one million phishing emails primarily targeting US organizations (87.7%) using generative AI to enhance financial fraud campaigns. The attacks impersonate high-level executives (CEOs and CFOs) and use fabricated ServiceNow invoices requesting ACH payments of approximately $50,000. Indicators of AI assistance include extensive HTML comments, structured section labeling, and consistent template construction. Attackers registered lookalike domains such as 'domainlify.net' and 'service-nowinc.com' and created forwarded email threads between spoofed executives to increase credibility. The fraudulent invoices feature detailed branding and personalized recipient information with payment instructions directing funds to attacker-controlled bank accounts. The campaign employs multiple layered social engineering techniques to reduce recipient skepticism and increase success rates.

The campaign poses a significant financial fraud risk to targeted organizations, primarily in the United States, by tricking employees into authorizing large ACH transfers based on convincingly spoofed executive communications and fraudulent invoices. The use of AI-generated content and lookalike domains increases the sophistication and potential success of the attacks. No known exploits or vulnerabilities in software are involved; the threat is social engineering and phishing-based.

No official patch or fix applies as this is a social engineering and phishing campaign rather than a software vulnerability. Organizations should increase awareness of AI-assisted phishing tactics, verify payment requests through independent channels, and implement strict controls for ACH transfers and invoice approvals. Monitoring for lookalike domains such as 'domainlify.net' and 'service-nowinc.com' can help detect related phishing attempts. Vendor advisories or official guidance should be consulted for evolving mitigation strategies.