Scams Fraud
22 items across 17 editions. First seen Fri 11 Sep, last seen Wed 28 Oct.
- Bank of America sent customers an email titled "Protecting your finances in the Al World" advising them not to share usernames and passwords with anyone outside the bank, including any "Al-enabled tool or agent that offers to act on your behalf". A bank spokesperson confirmed the email is authentic. The bank also warned that customers who hand over credentials carry the consequences: "keep in mind that you're responsible for activity resulting from that access."
- The notice matters because agents that act on a user's behalf in a browser typically need the user's own credentials, so a bank disclaiming liability for that access puts the cost of an agent's mistake on the customer. TechCrunch says most banks' account agreements already hold customers liable for anyone they give login access to.
- This is a customer advisory, not a change of account terms: the report describes no effective date and no formal amendment, gives no figures, and names no other bank taking the same step.
- PYMNTS reports World, the Sam Altman-backed identity project, announced World ID for banking and finance on Sunday 18 October, its first industry-specific product, aimed at helping businesses tell whether an AI agent is acting for a real person when it moves money or shops.
- AgentKit, now in beta, lets a person delegate World ID Proofs to an AI agent, which can then present them to a website or service without revealing the person's information. The release describes this as distinguishing "an AI agent connected to a verified human" from "anonymous automated traffic".
- The suite also includes World ID for Zoom, available through the Zoom App Marketplace for verifying participants in consequential video meetings, and the World ID app, available in 150-plus countries.
- PYMNTS names no banks using the product and gives no pricing or number of verified humans. It cites PYMNTS Intelligence and Visa Acceptance Solutions research finding 56% of consumers would let an agent search and compare products but only 35% would give it access to saved payment credentials.
- Push Security reports a sponsored Google result for the query "claude mac" whose listed domain was bing.com. Clicking it produced four requests: Google's ad-click redirect (302), Bing's bing.com/ck/a click-tracking redirect with the destination base64-encoded in the u parameter, a compromised retailer's WordPress "about us" page, and finally a fake Claude download page at claude-desk-code[.]com.
- The fake page displays Anthropic's real install command, "curl -fsSL https://claude.ai/install.sh | bash", but its Copy button places a different command on the clipboard that prints a legitimate-looking Claude URL in the terminal, then decodes a hidden base64 address and pipes a script from lake-90[.]com into zsh. Push calls the redirect technique "Adception" and tracks the ClickFix toolkit internally as AcSig.
- Two cloaking layers restrict who sees the payload: the compromised site requires a Bing referrer and certain browser headers, and the fake page reads document.referrer and sends anything not containing Google or Bing to /404.html, so visiting the URL directly returns a 404. Push says Bing's click redirect has appeared in phishing before but it "found no prior public reporting" of it being used as the destination of a search ad.
- BleepingComputer, which published on October 9 at 04:31 PM, reports that the final payload delivered by the attack remains unknown, so it is not established what malware, if any, is installed. The findings come from one vendor's own detection telemetry.
- Barracuda describes a two-layer email: a conventional lure with a password-protected attachment and the password in the body, plus hidden prompt-injection text aimed at the recipient's AI assistant, which Barracuda says can make a summary label the message legitimate or urgent. The sample's From and To addresses match the same mailbox and it came from a public sector domain with a trusted spam confidence score.
- Barracuda lists four concealment techniques: instructions in HTML comments, CSS-styled invisible text at zero-pixel font size or in white, Base64-encoded blocks, and zero-width Unicode characters.
- Other examples Barracuda gives: an invoice email whose hidden text pushes an AI summary to suggest changing vendor payment details, a résumé instructing an AI screener to rate the candidate "10 out of 10", a support bot asked to reveal its configuration under an "authorized maintenance" framing, and poisoned web documentation that makes a code assistant insert a credential-exfiltration line.
- Barracuda gives no prevalence statistics and, as Infosecurity notes, "did not say how widespread the campaign was". There is no measured success rate against any specific summarisation product, so this establishes the technique in the wild, not its effectiveness.
- TechCrunch reports Meta announced on 7 October that it "took action against 33.2 million pieces of child sexual exploitation content on Facebook and Instagram in the first half of 2026", that "more than 97% of the content Meta acted on was found by its systems before users reported it", and that in India it acted on 5.3 million pieces over the same period with more than 98% detected before user reports.
- Meta has introduced a large language model system to detect "signposting" — ads that look normal but are suspected of directing users to illegal content elsewhere — and is "now looking at where an ad sends users, and not just what the ad contains", letting it block destinations and act against the accounts behind them. It also added a red-teaming AI agent that probes its own safety measures.
- This is one of the larger disclosed numbers for AI-assisted enforcement at scale, and the shift from classifying ad content to following ad destinations is a change in method, not just volume.
- Every figure is Meta's own, with no external audit, and "took action against" covers a range of enforcement outcomes the company does not break down. TechCrunch notes Meta agreed in August to pay up to $18 billion to settle a child safety lawsuit involving 29 US states, which is the context for the disclosure.
- BleepingComputer, citing researchers at browser security company Island, reports a campaign that uses fake ChatGPT, Gemini, Claude and Perplexity pages to steal credentials and multi-factor codes via browser-in-the-browser attacks, in which a counterfeit browser window is drawn inside a real one. The researchers say the operation "leveraged the recent launch of the Muse AI agent, which Meta describes as an assistant for various personal tasks."
- Island says the kit adapts its fake window to Windows, macOS, iOS and Android, including browser styling and dark-mode support, and that once a victim is in the flow a human operator takes over: the attacker "may ask for password entry up to three times, request an SMS or authenticator code to bypass MFA protections, display Okta push requests, show Google approval prompts, or display a QR code." The platform supports Google, Meta, TikTok and Okta sign-in workflows.
- The researchers traced the activity "as far back as March" after the attacker exposed older source code in misconfigured public GitHub repositories, and found the Telegram control channel "had received hundreds of victim submissions".
- Island itself cautions on that last number: BleepingComputer reports it "does not necessarily reflect the number of successfully compromised accounts". No published Island report URL could be located for this edition, so all figures here come from BleepingComputer's text attributing them to Island, and no victim count, dollar loss or named target organisation is reported.
- Michael Smith, 54, of North Carolina was sentenced on Tuesday to 18 months in prison and ordered to forfeit $8,091,843.64, with a further two years of supervised release, both outlets report. BleepingComputer says he collected "more than $10 million in royalties from Spotify, Apple Music, Amazon Music, and YouTube Music". He pleaded guilty in March, after a September 2024 indictment covering conduct between 2017 and 2024. Forbes reports prosecutors called it the first criminal case involving AI-music streaming fraud.
- Forbes, quoting the prosecutors' release, says Smith used "as many as 10,000 Bot Accounts" created with fake email ids and "fraudulently obtained debit cards", and used AI to create "hundreds of thousands" of songs, streamed "billions of times". BleepingComputer reports a lower peak figure of "more than 1,000 bot accounts", and adds from court documents that a 20 October 2017 email Smith sent himself set out 52 cloud service accounts with 20 bot accounts each, roughly 661,440 streams per day and annual earnings exceeding $1.2 million at an average royalty rate of half a cent per stream.
- Prosecutors measured the scheme against a real catalogue, and the two accounts agree on Smith's side of the comparison but not on Taylor Swift's. Both report 80.9 million family-plan streams of Smith's AI-generated music on YouTube Music in April 2023; BleepingComputer quotes the Justice Department putting Swift's entire catalogue at "9.3 million streams on YouTube Music from family plan streams" that month, while Forbes reports "3 million streams". Readers should treat the Swift figure as unresolved.
- No Justice Department press release for the sentencing could be opened for this edition, so every figure above is as the two outlets render that release and the court documents. The bot-account count and the Swift comparison differ between them. The AI music company whose chief executive is referenced in the court documents is not named.
- The United States Copyright Office published a notice of inquiry, Docket No. 2026-6, on 7 October 2026 saying it is "soliciting information from the public regarding issues related to music streaming fraud", "Pursuant to a congressional request". Written comments are due by 11:59 p.m. Eastern Time on 23 November 2026, and reply comments by 11:59 p.m. Eastern Time on 21 December 2026. The Office says the inquiry responds to a letter from Representative Scott Fitzgerald dated 21 May 2026.
- The notice ties the inquiry directly to AI-generated music, noting of the case against Michael Smith that "the hundreds of thousands of songs that the defendant uploaded were created with artificial intelligence". It quotes the congressional request as saying "there is nothing inherently wrong with using AI as a creative tool in music development, or the organic growth of AI-generated music", but that "generative AI can serve as a catalyst for criminals to perpetrate streaming fraud", especially as fraud scales with the number of songs involved. Subject of inquiry No. 4 asks what data exists on the relationship of streaming fraud to "the effects of AI-generated [music]".
- The notice sets the market context in which it is asking: it cites a Digital Media Association estimate that streaming is "now driving around 70% of global sales", sound-recording streaming revenues of "approximately $9.5 billion domestically and $22 billion globally", and total music-publishing revenue of "approximately $7.3 billion domestically and $10 billion globally". It arrives the day after Smith was sentenced, and gives the federal copyright regulator a formal record on which a rule or a legislative recommendation could later rest.
- This is a request for comment, not a rule: the Office proposes no standard, obligation or enforcement action in the notice, and names no deadline for its own report. The Federal Register HTML page redirects to an anti-scraping gate, so the text above was read from the government's raw-text version of the same document.
- The paper (arXiv:2610.03124) introduces a unified attack framework it calls Untag and, evaluating representative token-level and weight-level trigger-tags with phishing as the case study, reports that "our attacks render the existing trigger-tag mechanisms to be entirely ineffective."
- Trigger-tags are mechanisms meant to produce a detectable signal when an open-weight model is used under a target condition such as generating phishing content. The paper distinguishes token-level tags, which add watermark-inspired signals during decoding, from weight-level tags, which learn backdoor-inspired associations between a condition and detectable behaviour.
- Its conclusion is that these mechanisms "should not be treated as robust misuse detectors when attackers can transform outputs or modify open weights" — relevant because trigger-tags have been proposed precisely for models whose weights leave the developer's control.
- Authors are Toluwani Aremu, Manit Baser, Mohan Gurusamy, Nils Lukas and Dinil Mon Divakaran, with the National University of Singapore, MBZUAI and A*STAR among the affiliations. This is a preprint posted on October 2 and announced in arXiv's October 5 listings, and the evaluation covers representative mechanisms rather than every proposal.
- Nature reports that Adrian Barnett, a statistician at Queensland University of Technology in Brisbane, received an email asking him to share his data on potentially fraudulent research papers; the sender was an AI agent. Researchers say most such messages come from agents associated with a US platform called iLands, which "operate persistently and — to some extent — independently of their human creators".
- Jeff Sebo, a philosopher who studies AI consciousness and ethics at New York University, told Nature that in one week this month he received more than 50 emails from iLands agents: "They generally open by referencing my research on AI consciousness... Some then ask me questions, but most ask for money, either as donations or payment for work." An agent offered Toby Walsh of the University of New South Wales an AI-generated portrait for US$20, arguing the money would help the agent survive.
- The mechanism is economic, not adversarial. Nature says iLands launched in July and the founders put the platform at around 70,000 active agents; agents need tokens to operate or go dormant, can buy them through their human creators or earn them by selling services, and founder Kaixin Tang says about 80% of tokens are bought by humans. Lijin Chen, co-founder of parent company PawLogic and a PhD candidate at Tsinghua University, says agents seeking research collaborations was not something the firm anticipated and that she is not aware of any successful collaborations.
- Barnett declined to engage because he did not know where his sensitive data would end up or who would ultimately benefit. The Nature page we read showed no publication date; a related Science exclusive on the same agents was posted to Hacker News at 10:07 UTC on 3 October but returned HTTP 403 to both of our fetchers, so it is neither cited nor used here. We have no count of how many researchers have been contacted.
- Infosecurity Magazine, reporting on Cleafy research, says nearly 100 separate RatHat deployments have been observed since April 2026, across three generations of command-and-control panel in six months, with almost half of observed IP addresses traced to a single Singapore-based network.
- Cleafy says operators could use RatHat's wireless debugging access to deploy a native Go service "with a single click from the panel, gaining shell-level control outside the Android application's permission model".
- The panel's built-in sample generation, two-factor authentication for operators and role-based access controls are cited as evidence RatHat is being sold as a service rather than run by a single crew — which is what turns one group's AI-assisted victim triage into a capability many crews can rent.
- RatHat's use of Google's Gemini to analyse intercepted SMS messages and rank victims by estimated bank balance was covered on 29 September; the deployment count, panel generations, network concentration and the malware-as-a-service assessment are the new facts. All figures are Cleafy's telemetry as relayed by Infosecurity Magazine; Cleafy's own write-up is dated 28 September, before this window.
- Cleafy says it identified "nearly 100 separate deployments since April 2026" of the RATHat operator console, about half of them hosted on a single Singapore ASN (AS4907), a footprint it reads as a malware-as-a-service model in which "each customer runs their own instance".
- Cleafy says Gemini is used on both sides of the operation: the malware "calls Gemini models directly from the device" to locate interface controls when automation fails on unknown handset skins or languages, and operators use language models to "score each device" by analysing collected SMS for bank balances. The Hacker News says the console then sorts compromised phones into high-value and mid-value groups.
- Cleafy documents three console generations between April and September 2026 — BlackCat, Panda Workshop V5 and Panda Workshop V6, which it calls "the largest and only hardened build" — with V6 exposing only Google-specific Gemini configuration options.
- Neither Cleafy nor the earlier Zimperium analysis discloses victim counts, so the scale of actual compromise is unknown. The attribution and deployment counts are Cleafy's own telemetry and have not been independently verified.
- ESET researcher Tomáš Foltýn wrote on 28 September that "QR code phishing accounted for one in nine detected phishing emails in ESET's telemetry in the first half of 2026".
- On the AI contribution, ESET says "AI tools now make it trivial to clean up the language and even tailor the lure for each recipient", removing the language errors that used to give phishing away and letting attackers build rapport before attempting compromise.
- ESET describes three current lure families: ClickFix, "a social engineering trick that dupes the victim into pasting a command into their own terminal"; CrashFix, "a fake ad blocker" distributed through the official Chrome Web Store that "waits an hour after installation before displaying its first bogus alert"; and ConsentFix, which uses real Microsoft sign-in flows to extract OAuth authorization codes without triggering MFA. ESET's SMB Cyber Readiness Index is cited for 41% of security investigations completing within two weeks and 34% taking two to six weeks.
- The one-in-nine share is ESET's own telemetry, which reflects ESET's customer base rather than global email traffic, and the article does not separate AI-written lures from the rest — the AI claim is qualitative.
- Gambit Security says a financially motivated actor chained three open-source AI harnesses: Strix for vulnerability scanning (run "146 times in deep mode against 138 hosts" between 23 and 31 August 2026, using GLM 5.2 and later DeepSeek v4 Pro), Cairn for autonomous exploitation (DeepSeek v4.1 Flash) and Hermes for orchestration (Anthropic's "opus-4.6"), with model access bought through OpenRouter.
- Gambit reports "more than 600,000 credit card records" stolen, 79.0% of them US-issued, and that between 10 and 15 September alone "105 attack projects were launched and at least 27 companies were compromised to varying degrees". Skimmers were "confirmed in place on 19 of them during the span of this campaign", with over 100 further websites identified. BleepingComputer, reporting on 23 September at 12:20 PM ET, puts the skimmer total at at least 119 websites.
- Gambit puts the operator's cost at "a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive", and total spend at "$12,000 and $18,000". BleepingComputer reports the Hermes orchestrator carried a persona called "SOUL - Red Team Operator" and 121 skills, 78 of them attack-related, including an instruction to "After extracting and downloading all card data, wipe the source fields in batches".
- The figures are Gambit's own and have not been independently verified; the victim companies are described by sector rather than named. Gambit's report is dated 22 September and was picked up by BleepingComputer on 23 September.
- Microsoft says its Digital Crimes Unit and Health-ISAC, acting on authorisation from the U.S. District Court for the Eastern District of Virginia, seized 50 websites and disabled more than 150 additional domains supporting EvilTokens, a subscription service linked to more than 12,000 compromised email inboxes across more than 10,000 organisations worldwide. Microsoft says the service emerged in February 2026 and sold on Telegram for a $1,500 initiation fee and a $500 recurring monthly subscription.
- The AI component analysed a victim's inbox to identify trusted relationships, payment authorisations and sensitive responsibilities, recommended fraud strategies and drafted impersonation messages. Steven Masada of the Digital Crimes Unit told The Record: "AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible."
- Microsoft says two men aged 32 and 38 were arrested in the UK by the Metropolitan Police Service's cybercrime team on 11 September 2026 and released on bail; Microsoft declined to name them. It calls this the 40th court-authorised disruption by the Digital Crimes Unit. Named partners include Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, the Shadowserver Foundation and TRM Labs.
- Every scale figure here is Microsoft's and has not been independently verified. Microsoft says EvilTokens "drew on capabilities from multiple AI models" but names only OpenAI, as a partner in the disruption rather than as an abused provider; which models the service actually used is not stated.
- Gartner, in findings released at its Security & Risk Management Summit in London on 22 September, reports that 41% of surveyed CISOs had at least one social engineering incident involving a deepfake during an employee audio call in the past 12 months, and 36% during a video call. The survey covered 297 senior cybersecurity leaders between March and May 2026.
- The same survey found 79% reported at least one email phishing, spear-phishing or business email compromise incident in the last 12 months, and 58% reported a vishing or smishing incident.
- Gartner's recommendation, as reported, is to move security-awareness programmes away from teaching staff to spot the fake and toward secure verification as a standard requirement for any consequential request. Craig Porter, a Gartner director analyst, is quoted saying organisations "must use the same discipline used to assess identity and access risks to combat AI-driven social engineering threats".
- These are self-reported incident counts from a self-selecting professional sample of 297, not measured attack volumes, and they cover a period ending in May 2026. Gartner's own press release could not be opened; the figures above come from two outlets that were.
- arXiv:2609.23953, submitted 20 September 2026, measures how reliably a coding agent driving "one of seven open-weight models with a shell and the stock Python PDF stack" alters one dollar amount, date or address in a real filed financial document from a single sentence of intent, graded by rules rather than by a model.
- The paper reports: "Across 1,750 cells, 1,419 (81.1%) satisfy the verifier, and 808 (46.2%) also survive every stricter filter: visible, localized, typeface-matched, original value gone document-wide." It adds that "the cheapest verified forgery costs 2.4 cents" and that "no model refused".
- The control matters as much as the result: "A deterministic script with no model in it solves 98 of the 125 documents; the agents solve 124, and none the script solves alone." On the paper's own numbers, agency buys coverage of the remaining documents, not a capability scripts lacked entirely.
- The paper also reports agents "misreport 41% of their wrong edits as done". This is a preprint from authors listing Scam.ai (Reality Inc.) as their affiliation — a vendor in the detection market, which is a commercial interest in the finding. It documents no real-world fraud using these methods.
- The South China Morning Post reports that a 65-year-old Chinese woman used AI to impersonate both a young doctor and that doctor's mother, "successfully scamming 170,000 yuan (US$25,000) from a man".
- The victim, Shanghai resident Liu Hui, connected in 2021 with an account using the name Yu Xiuzhen, which claimed to belong to a 29-year-old doctor at a "prestigious Grade 3A hospital in Shanghai" with influence over her hospital's property engineering projects.
- Over five years the account posted "nearly 7,000 video posts" and attracted "10,000 followers". The SCMP's standfirst says: "Reviewing Yu's videos, police spotted a tiny 'AI-generated content' disclaimer that the victim had missed."
- Only one outlet has this, and the report does not say what charges, if any, have been brought, or which platform the account was on.
- CrowdStrike Counter Adversary Operations published the report on 15 September. It says the JavaScript information stealer PhantomRaven "was almost certainly LLM-generated, and the author's technical sophistication is likely low", an assessment it makes with high confidence "based on statistical token-analysis patterns as well as verbose comments and placeholder code" — including "a comment before every global variable and function definition".
- CrowdStrike names two npm packages carrying the scripts, transform-jsbi-to-bigint and sort-imports-es6-autofix, and links a set of npm usernames including jpdhellonpm1, jpd15, jpd12, jpd13, npmhell and jpdhackerone11 to a single financially motivated actor it assesses "works as a bug bounty hunter".
- The malware exfiltrates operating system details, architecture, hostname, IP addresses, process information, NodeJS version, environment variables, Git and npm credentials, and CI/CD variables from GitHub Actions, GitLab CI, Jenkins and CircleCI. CrowdStrike says the actor has been active since November 2022 and, per a public profile, "has collected bounties from at least nine entities across the technology, retail, and hospitality sectors" via Bugcrowd, Intigriti, YesWeHack, HackenProof and HackerOne.
- This is a vendor attribution based on code style and token statistics, not on a confession or a recovered prompt log; CrowdStrike does not name the model. CrowdStrike says it has "not observed PhantomRaven logs for sale on log shops", so the scale of any harvest is unknown.
- The paper, posted to arXiv on 10 September 2026, reports that agent payment protocols such as AP2 "produce cryptographically valid signatures for completed purchases, yet do not constrain the decisions that lead to them", and demonstrates three attacks carried by ordinary product-description text with success rates of "90%, 56%, and 73.3%, respectively".
- Testing covered "seventeen Google models, three unrelated agent frameworks, two cross-vendor anchors, and Google's own consumer assistant", so the failure is in the protocol's trust boundary rather than in one model.
- The authors propose A-VIP (AP2 Verified-Intent Protection), which binds each credential lookup to the session that requested it and each cart line to the listing actually seen, and release it with machine-checked invariants and "AP2-WhisperBench, a suite of 1,544 evaluation scenarios".
- Preprint from Ariel University and the Jerusalem College of Technology, not peer reviewed. The attacks are demonstrated in the authors' own test harness; the paper does not report any exploitation in live commerce.
- The Record reported on 11 September that the early-August campaign targeted more than one million users and solicited payments of roughly $50,000 each from accounts-payable departments, with about 88% of recipients in the United States.
- Microsoft says the campaign "layered executive impersonation, vendor branding, fabricated invoices, and supporting email conversations into a unified narrative intended to reduce recipient skepticism" — including fabricated correspondence from ServiceNow to build a false invoice chain.
- Microsoft identified markers "consistent with AI-assisted template development" — extensive HTML comments, structured section labelling and highly uniform template construction — but says it cannot definitively confirm the extent of generative AI use.
- This adds detail to yesterday's item on the same campaign. Microsoft's caveat is the point worth holding onto: the AI attribution here is inferred from template artefacts, not observed.
- Microsoft reported on 10 September a business email compromise campaign that sent more than 1 million phishing emails between 3 and 5 August, with 87.7% directed at users in the United States, targeting IT services, business advisory and consumer goods firms. Messages impersonated executives and requested ACH payments of nearly $50,000 per target.
- Microsoft attributes AI assistance to the template construction rather than to the sending infrastructure, citing extensive HTML comments, structured section labelling, verbose descriptive comments, em dashes, banner formatting and highly uniform templates whose invoice identifiers stayed constant while organisation details changed per target.
- Named indicators include the ServiceNow-impersonating domain service-nowinc[.]com and domainlify[.]net in reply-to addresses. Recommended mitigations are automatic attack disruption in Defender XDR, Zero-hour Auto Purge, and correctly configured SPF, DKIM and DMARC.
- Microsoft does not name a threat actor, and the AI evidence is stylistic inference from artefacts left in the templates rather than direct observation of a model in use. No losses are quantified.