[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fT_0_-qC-7FQlrgDN8eo6DiGvKZQejTCrYe_eMeaxi3U":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"cc651962-7e30-4d32-a94e-3237e439156e","CEO-spoofing scammers used AI to help steal more than $100 million, feds say","ceo-spoofing-scammers-used-ai-to-help-steal-more-than-100-million-feds-say-ba6414","The U.S. is working on extraditing three suspects from Europe in a case involving more than $100 million in fraud from CEO impersonations.","The U.S. Justice Department has indicted three individuals for orchestrating a sophisticated fraud scheme that leveraged AI to impersonate CEOs and lawyers, resulting in the theft of over $100 million from various companies. The suspects, arrested in Europe, face significant prison time for charges including money laundering and wire fraud. This case highlights the growing exploitation of AI in large-scale financial crimes.","Three suspects indicted for using AI in CEO-spoofing scams that stole over $100 million.","https:\u002F\u002Ftherecord.media\u002Fceo-spoofing-scammers-charged","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fman_suit_benjamin_r_unsplash_53f6376f90.jpg","2026-11-06T14:30:00+00:00","2026-11-06T15:00:11.328158+00:00",8,[17,20,22,24],{"name":18,"type":19},"Jacob Soall","threat_actor",{"name":21,"type":19},"Sharon Hazan",{"name":23,"type":19},"Guy Sheetrit",{"name":25,"type":26},"artificial intelligence","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[],[],{"controls":46,"vendors":130},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":77,"name":78,"problem":79,"products":80},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"slug":106,"name":107,"problem":108,"products":109},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[110,117,124],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":106,"product_name":114,"url":115,"description":116},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":121,"url":122,"description":123},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":126,"url":128,"description":129},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":143},"ai-powered-ceo-impersonation-scams-steal-100m","AI-Powered CEO Impersonation Scams Steal $100M+","Fraudsters used AI-generated voice and identity spoofing to impersonate CEOs and lawyers, tricking employees into authorizing large wire transfers totaling over $100 million. This case illustrates how AI is lowering the barrier for sophisticated social engineering attacks, making traditional verification methods dangerously inadequate. Employees who lacked training in verifying financial instructions through secondary channels became unwitting accomplices in the fraud. The scale of the theft underscores that without strong human verification protocols and authentication procedures, even large, sophisticated organizations are vulnerable to impersonation-based fraud.",[136,137,138,139,140,141,142],"CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST SP 800-53 SI-2: Flaw Remediation","GDPR Article 32","NIS2 Article 21(2)(b)",{"GDPR Article 32":144,"NIS2 Article 21(2)(b)":145,"MITRE ATT&CK T1566: Phishing":146,"NIST SP 800-53 SI-2: Flaw Remediation":147,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":148,"CIS Control 14: Security Awareness and Skills Training":149,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":150},"To the extent personal and financial data was processed, Article 32 requires appropriate technical and organizational measures, including controls that would have flagged anomalous high-value data transfers initiated via unverified channels.","NIS2 mandates incident handling and human-risk management measures; a formal policy and training program addressing AI-enabled social engineering would satisfy this requirement and could have prevented the fraud.","The AI-driven CEO impersonation scheme is a direct evolution of spear-phishing, exploiting trusted identities to manipulate targets — a technique explicitly covered under this ATT&CK technique and its sub-techniques.","While procedural rather than technical, this control's principle of systematically addressing known weaknesses applies — here the 'flaw' was the absence of verified communication protocols for financial authorization.","Organizations are required to ensure staff have the competence to recognize security threats; the absence of training on AI-generated fraud directly enabled this attack to succeed.","Employees who received no training on AI-powered impersonation and social engineering lacked the skills to identify and challenge fraudulent executive requests before authorizing transfers.","Robust identity verification and multi-party authentication for high-value financial actions would have prevented fraudsters from successfully impersonating executives without legitimate credentials or callbacks."]