[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frmCM2rUUmnFNAlPLHR8WGDHCGtQB6WyWuHMDeW6IgC8":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"bbd24bbe-12a4-4d1f-9933-29fcb620b613","3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million","3-charged-in-scheme-to-use-ai-to-impersonate-ceos-and-attorneys-to-steal-129-mil-6dfbaa","The trio, who have nicknames that include “Rocky Balboa,” “Superman Cash” and “Fat Boy,” often targeted the companies’ accounting departments. The post 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million appeared first on SecurityWeek.","Three individuals have been indicted on charges of wire fraud and aggravated identity theft for allegedly using AI to impersonate corporate executives and attorneys, defrauding thousands of companies worldwide out of approximately $129 million. The scheme involved voice and image deepfakes to convince employees to wire funds to accounts that were then used to purchase cryptocurrency, obscuring the origin of the money. The FBI highlighted this case as an example of how advanced technology is being weaponized for large-scale fraud.","Three individuals indicted for using AI to impersonate CEOs and attorneys to steal $129 million.","https:\u002F\u002Fwww.securityweek.com\u002F3-charged-in-scheme-to-use-ai-to-impersonate-ceos-and-attorneys-to-steal-129-million\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-11-06T03:03:29+00:00","2026-11-06T04:00:13.336658+00:00",8,[17,20,22,24],{"name":18,"type":19},"Rocky Balboa","threat_actor",{"name":21,"type":19},"Superman Cash",{"name":23,"type":19},"Fat Boy",{"name":25,"type":26},"AI","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":27,"icon":29,"name":30,"slug":31},null,"Nation-state","nation-state",[33,35,40],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":48,"vendors":127},[49,76,101],{"slug":50,"name":51,"problem":52,"products":53},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":71,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":71,"url":74,"description":75},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"slug":39,"name":77,"problem":78,"products":79},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":97,"product_name":98,"url":99,"description":100},"boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"slug":102,"name":103,"problem":104,"products":105},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[106,112,119],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":107,"product_name":108,"url":110,"description":111},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":102,"product_name":116,"url":117,"description":118},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[],{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":140},"ai-deepfakes-used-to-impersonate-ceos-and-steal-129m-via-wire-fraud","AI Deepfakes Used to Impersonate CEOs and Steal $129M via Wire Fraud","Fraudsters leveraged AI-generated voice and image deepfakes to convincingly impersonate corporate executives and attorneys, manipulating employees into authorizing large wire transfers totaling $129 million. The root cause is a critical gap in security awareness: employees lacked the training, verification protocols, and skepticism needed to detect sophisticated social engineering attacks enhanced by synthetic media. This case demonstrates that as AI lowers the barrier to creating convincing impersonations, human verification procedures and authentication controls must evolve to match the threat. Organizations that rely solely on voice or visual cues to authenticate high-value financial requests are dangerously exposed in the age of generative AI.",[133,134,135,136,137,138,139],"CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","GDPR Article 32","CIS Control 17: Incident Response Management",{"GDPR Article 32":141,"MITRE ATT&CK T1566: Phishing":142,"NIST SP 800-53 SI-2: Flaw Remediation":143,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":144,"CIS Control 17: Incident Response Management":145,"CIS Control 14: Security Awareness and Skills Training":146,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":147},"To the extent that personal data of thousands of defrauded companies and individuals was processed as part of the scheme, GDPR Article 32 requires appropriate technical and organizational measures — including authentication controls — to prevent unauthorized processing and financial harm.","The scheme is a direct example of spear-phishing via voice and video (vishing\u002Fdeepfake), and ATT&CK T1566 guidance on detecting and mitigating phishing-based impersonation directly applies to preventing such social engineering attacks.","While not a software flaw, SI-2's broader principle of identifying and remediating weaknesses applies here — the procedural 'flaw' of lacking verified authentication for executive wire requests needed to be identified and corrected before exploitation.","ISO 27001 requires organizations to ensure staff are competent to handle information security risks; employees authorizing large transfers without deepfake awareness training were not adequately prepared for this emerging threat vector.","A tested incident response plan that includes procedures for rapidly halting and reversing wire transfers upon detection of fraud would have limited financial losses once early indicators of the scheme were identified.","Employees who received funds-transfer requests lacked training to recognize AI-enhanced social engineering; structured awareness programs covering deepfake and vishing threats would have equipped staff to challenge and verify suspicious requests.","The fraud succeeded because employee identity verification of the requestors relied on easily faked voice and image cues; strong out-of-band authentication controls for high-value actions would have blocked unauthorized transfers."]