Ankura CTIX FLASH Update – September 15, 2026

Malware Activity

AI-Assisted Invoice Fraud and Passkey Phishing Target Enterprise Cloud Accounts

Microsoft detailed two (2) large-scale social engineering campaigns targeting enterprise organizations through financial fraud and cloud identity compromise. In the first, threat actors sent more than one million emails between August 3 – 5, 2026, primarily targeting U.S. companies by impersonating CEOs and using AI-assisted messaging, forged email threads, fabricated ServiceNow invoices, and lookalike domains to convince accounts payable personnel to make fraudulent ACH transfers. A separate campaign active since May uses passkey-, MFA-, and SSO-themed vishing and phishing, with attackers posing as IT help desk personnel and directing employees to counterfeit Microsoft login pages or malicious device-code authentication flows. After compromising Microsoft 365 identities, attackers establish persistence by registering their own MFA methods, then use Microsoft Graph APIs and other cloud