Executive Summary
In early August 2026, a sophisticated financial fraud campaign dubbed 'Operation DoppelBrand' distributed over one million phishing emails in just three days, primarily targeting organizations in the United States. The attackers utilized generative AI to create highly personalized email templates that impersonated company executives and vendors, specifically ServiceNow, to request fraudulent ACH payments of nearly $50,000.
The technical execution involved registering lookalike domains, such as service-nowinc[.]com, and leveraging third-party email delivery infrastructure to bypass traditional filters. The lures included fabricated invoices and simulated internal email threads between executives to build false credibility. While the activity shows significant scale due to AI industrialization, the attack relies on established social engineering and BEC tactics.
This campaign reflects a growing trend where AI reduces the cost and time required for high-volume, personalized attacks. Affected sectors include IT services, consumer goods, and real estate. Organizations are advised to enforce strict email authentication and provide targeted training for finance personnel regarding out-of-band verification for large transactions.