Scams Fraud
3 items across 2 editions · appeared in the last 2 editions in a row. First seen Fri 11 Sep, last seen Sat 12 Sep.
- The paper, posted to arXiv on 10 September 2026, reports that agent payment protocols such as AP2 "produce cryptographically valid signatures for completed purchases, yet do not constrain the decisions that lead to them", and demonstrates three attacks carried by ordinary product-description text with success rates of "90%, 56%, and 73.3%, respectively".
- Testing covered "seventeen Google models, three unrelated agent frameworks, two cross-vendor anchors, and Google's own consumer assistant", so the failure is in the protocol's trust boundary rather than in one model.
- The authors propose A-VIP (AP2 Verified-Intent Protection), which binds each credential lookup to the session that requested it and each cart line to the listing actually seen, and release it with machine-checked invariants and "AP2-WhisperBench, a suite of 1,544 evaluation scenarios".
- Preprint from Ariel University and the Jerusalem College of Technology, not peer reviewed. The attacks are demonstrated in the authors' own test harness; the paper does not report any exploitation in live commerce.
- The Record reported on 11 September that the early-August campaign targeted more than one million users and solicited payments of roughly $50,000 each from accounts-payable departments, with about 88% of recipients in the United States.
- Microsoft says the campaign "layered executive impersonation, vendor branding, fabricated invoices, and supporting email conversations into a unified narrative intended to reduce recipient skepticism" — including fabricated correspondence from ServiceNow to build a false invoice chain.
- Microsoft identified markers "consistent with AI-assisted template development" — extensive HTML comments, structured section labelling and highly uniform template construction — but says it cannot definitively confirm the extent of generative AI use.
- This adds detail to yesterday's item on the same campaign. Microsoft's caveat is the point worth holding onto: the AI attribution here is inferred from template artefacts, not observed.
- Microsoft reported on 10 September a business email compromise campaign that sent more than 1 million phishing emails between 3 and 5 August, with 87.7% directed at users in the United States, targeting IT services, business advisory and consumer goods firms. Messages impersonated executives and requested ACH payments of nearly $50,000 per target.
- Microsoft attributes AI assistance to the template construction rather than to the sending infrastructure, citing extensive HTML comments, structured section labelling, verbose descriptive comments, em dashes, banner formatting and highly uniform templates whose invoice identifiers stayed constant while organisation details changed per target.
- Named indicators include the ServiceNow-impersonating domain service-nowinc[.]com and domainlify[.]net in reply-to addresses. Recommended mitigations are automatic attack disruption in Defender XDR, Zero-hour Auto Purge, and correctly configured SPF, DKIM and DMARC.
- Microsoft does not name a threat actor, and the AI evidence is stylistic inference from artefacts left in the templates rather than direct observation of a model in use. No losses are quantified.