Aging-Report BEC Scam Hits 42,000 Companies | Las Vegas

What Happened: A Business Email Compromise Campaign at Industrial Scale

On June 1, 2026, Microsoft’s Defender Research team caught something unusual moving through inboxes across the United States. Between 2:08 p.m. and 4:52 p.m. UTC — a window of less than three hours — an automated business email compromise (BEC) operation reached more than 67,000 people at over 42,000 organizations, almost entirely inside the U.S. There was no ransomware payload, no malicious attachment, and no link for a spam filter to flag. Just email, sent at a volume and speed that only automation can produce.

The targeting wasn’t limited to one industry. Retail and consumer goods companies made up 17% of the organizations hit, technology and software firms 15%, and financial services 14% — with the remainder spread across dozens of other sectors, including the professional services, hospitality, and healthcare businesses that make up much of the Las Vegas economy. The campaign used three lure types to open the conversation: impersonated executive messages, requests for an “aging report” (the internal finance document that lists which invoices are overdue and from whom), and payroll-diversion requests aimed at HR and finance staff.

This wasn’t an isolated blip. Microsoft’s own Q2 2026 threat report puts the June 1 blitz inside a much bigger pattern: 7.6 billion phishing emails detected across April, May, and June alone, with monthly volume actually declining slightly even as individual campaigns grow more automated and more convincing. In other words, attackers are sending fewer emails overall but engineering each wave to convert at a far higher rate — and a three-hour campaign that hits 42,000 organizations without tripping a single malware filter is exactly what that shift looks like in practice.

Why This Attack Works: Inside the Aging-Report Scam

Most email security tools are built to catch malware and malicious links. This campaign used neither. That’s what makes the aging-report angle so effective — it’s a social engineering play dressed up as a routine finance request, and it slides past the filters most Las Vegas businesses rely on as their only line of defense. The sender address is often a lookalike domain, one or two characters off from the real vendor or executive’s address, close enough that a busy accounts-payable clerk won’t catch it on a quick read.

• Executive impersonation: The attacker spoofs or closely mimics a CEO, CFO, or owner’s display name and email address, then opens with a message that sounds like a normal request from leadership.
• The aging-report request: The email asks accounting staff for the company’s accounts receivable aging report — a document that lists every customer with an open balance. Once the attacker has it, they know exactly which vendors and customers to impersonate next.
• Payroll diversion: A separate version of the campaign goes straight to HR or payroll, requesting a “routine” update to an employee’s direct deposit information — redirecting a paycheck to an account the attacker controls.
• Automated scale: Because the entire operation runs through scripted, automated sending infrastructure, one operator can hit tens of thousands of organizations in a single afternoon rather than hand-crafting a handful of targeted emails.

• ⚠Wire transfers and ACH payments sent to a fraudulent account are almost never recoverable once they clear.
• ⚠A diverted paycheck doesn’t just cost an employee their pay — it creates a payroll compliance and trust problem for the business.
• ⚠Hospitality, gaming vendors, law firms, dental practices, and construction companies in Clark County all handle the exact mix of vendor payments and payroll requests this scam targets.
• ⚠Cyber insurance carriers increasingly deny BEC-related claims when a business can’t show it had payment-verification controls in place.
• ⚠Because no malware is involved, standard antivirus and spam filtering will not stop this attack on their own.

Defending Las Vegas with CMIT Solutions

CMIT Solutions of Las Vegas works with businesses across Clark County to close exactly this kind of gap — email authentication, verified payment workflows, and 24/7 monitoring that catches the request before the wire goes out. This attack didn’t need to breach a single firewall to succeed. It just needed one employee to trust a routine-sounding email. That’s a policy and process problem as much as a technology one, and it’s one we help local businesses fix every week.