Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
12 IOCs

Protecting organizations from AI-assisted executive impersonation and invoice fraud

Microsoft Threat Intelligence
Microsoft Threat Intelligence
Published September 10, 2026Original Report

Excerpt

In this article Attack chain overview Email Delivery Domain registration Generative AI usage Mitigation and protection guidance Microsoft Defender detections Microsoft Security Copilot Threat intelligence reports MITRE ATT&CK Techniques observed Indicators of compromise (IOC) Learn More Threat actors are increasingly improving their tactics to make suspicious emails look like legitimate email notifications to potential victims, deploying techniques that impersonate…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREservice-nowinc.comdomainlify.netCAPABILITYunknownVICTIMunknown
Adversary
Infrastructure(2)
Capability
Victim

Indicators of Compromise

Open the mindmap →

12 indicators

TypeIndicatorConfidenceScoreFirst Seen
Emailinfo@lohnsteuerhilfe-aktuell-verein.deHighScore 58/100First seen
Emailinfo@tivityhealth.comHighScore 58/100First seen
Emailnoreply@mctci.comHighScore 58/100First seen
Emailgomez@service-nowinc.comHighScore 58/100First seen
Emailinfo@lifeones.comHighScore 58/100First seen
Emailno-reply@lumalisboa.comHighScore 58/100First seen
Emailinfo@nuf.co.jpHighScore 58/100First seen
Domainservice-nowinc.comHighScore 58/100First seen
Domaindomainlify.netHighScore 58/100First seen
Emailcontact@eemusicclass.co.ukHighScore 58/100First seen
Emailinfo@tovimbatista.ptHighScore 58/100First seen
Emailnotifications@uinsure.co.ukHighScore 58/100First seen

IOC Relationship Graph

Building graph…