LIVE · cybersecurity feed
Live wire
U.S. urges critical infrastructure orgs to secure refrigeration systems ASAP after EU supermarket and blood bank attacksCISA Announces Enhanced Reporting Form for Cyber IncidentsCVE-2026-19868 · CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible ExploitationCVE-2026-119757 · BTCPay Server Insufficiently Protected Credentials Flaw Exploited Upon DisclosureCVE-2026-118066 · LatePoint Improper Authentication Vulnerability Exploited Upon DisclosureCVE-2026-120534 · ACF Extended Advanced Custom Fields PRO Flaw Exploited Upon DisclosureCVE-2026-109884 · Elementor Website Builder Flaw Exploited Same Day As DisclosureCVE-2026-19868 · SonicWall SonicOS SSLVPN Vulnerability Exploited On Day Of DisclosureCVE-2026-103898 · Wpmet wp_social_login_and_register_social_counter Flaw Exploited Upon DisclosureCVE-2026-116512 · weDevs wp_project_manager Flaw Exploited Before CVE Publication
ai

Authorities accuse trio of using AI deepfakes to defraud $129M from businesses

The United States Department of Justice has unsealed an indictment charging three men with orchestrating a sophisticated, years-long fraud scheme that utilized artificial intelligence to impersonate corporate executives and legal professionals. Authorities allege that Jacob Soall, Sharon Hazan, and Guy Sheetrit successfully defrauded various businesses of at least $129 million between July…

ZeroDay News ·

Source: CyberScoop

The United States Department of Justice has unsealed an indictment charging three men with orchestrating a sophisticated, years-long fraud scheme that utilized artificial intelligence to impersonate corporate executives and legal professionals. Authorities allege that Jacob Soall, Sharon Hazan, and Guy Sheetrit successfully defrauded various businesses of at least $129 million between July 2024 and February 2026. The accused individuals are currently facing seven counts, including conspiracy to commit wire fraud, money laundering, and aggravated identity theft, which collectively carry a maximum potential sentence of 104 years in prison.

According to the indictment, the operation targeted thousands of victims by specifically identifying accounting staff members who possessed the authority to execute large wire transfers. The process typically began with an email sent via an e-signature platform. In these communications, the perpetrators posed as a company CEO, claiming they were involved in a confidential financial transaction that required the employee to sign a non-disclosure agreement. Once the victim engaged, the attackers used AI-generated deepfakes to impersonate both the CEO and attorneys from major global law firms, creating a false sense of legitimacy around the requested financial transfers.

The scale of the financial impact was broad, affecting a variety of sectors across the United States. Confirmed victims include a United Kingdom-based fintech firm that lost $11.6 million, a Florida pet food company that lost $5.2 million, and a Missouri hospital system that lost $4.8 million. Other significant losses were reported by a Massachusetts mutual fund, a California hospital system, a New York investment firm, and a Rhode Island bank, with individual losses ranging from $2.7 million to $4.6 million.

Investigators allege that the illicit funds were routed through bank accounts controlled by co-conspirators in several countries, including Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia, China, and the United States. Once the money reached these accounts, it was reportedly converted into cryptocurrency and distributed among the participants.

The three defendants were apprehended in different jurisdictions over the course of several months. Jacob Soall, 41, was arrested in Spain on June 17, 2026, and is accused of primarily impersonating U.K.-based attorneys while utilizing prepared scripts to deceive targets. Sharon Hazan, 54, was taken into custody in Spain on August 5, 2026. Prosecutors noted that Hazan has a prior 2008 conviction for bank fraud in the Southern District of New York and allegedly claimed to have laundered over $400 million in the previous three years. Guy Sheetrit, 42, was arrested in the United Kingdom on September 7, 2026, and is accused of playing a central role in laundering the proceeds of the scheme.

Federal authorities have highlighted this case as a prime example of how emerging technologies are being weaponized to facilitate large-scale criminal activity. The investigation underscores a growing trend where sophisticated AI tools are used to bypass traditional security measures by mimicking the voices and appearances of trusted authority figures.

While the Department of Justice has provided these details through the unsealed indictment, the case remains in its early legal stages. The charges represent the government's formal allegations against the trio, and the defendants are entitled to the presumption of innocence until proven guilty in a court of law. The FBI and the U.S. Attorney’s Office for the Southern District of New York continue to investigate the broader network of co-conspirators involved in the operation.

ai
ShareXLinkedInWhatsAppFacebook

More News

view all →
vulnerability

Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes

Anthropic has officially released Claude Mythos 5.2 and Claude Fable 5.2, the latest iterations of its AI models designed for specialized security and general-purpose tasks. While both models share the same underlying architecture, they differ significantly in their operational guardrails. Mythos 5.2 is an access-restricted model intended for vetted organizations participating in Anthropic’s…

nation-state

IRISSCON 2026 puts preparedness for cyberattacks and hybrid threats in focus

Ireland faces a critical need to bolster its national security infrastructure to counter a rising tide of sophisticated cyberattacks and hybrid threats. Ahead of the IRISSCON 2026 conference held at Dublin’s Aviva Stadium, experts have characterized the current state of national readiness as potentially inadequate. The discourse centers on the necessity of moving beyond isolated defensive…

security

Default Admin Password Let Researchers Unlock and Start Cars

Security researchers Shubham Shah and Sam Curry have disclosed a series of vulnerabilities that allowed them to remotely unlock and start vehicles by compromising the identity management infrastructure of two unnamed automotive brands. The researchers detailed their findings in separate reports published in early November 2026, noting that the flaws affected customer accounts across the United…

CVE-2026-123218

IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive for federal agencies to remediate two critical vulnerabilities currently being exploited in the wild. The agency added CVE-2026-123218, affecting IBM Aspera Faspex, and CVE-2026-116779, impacting SignalWire FreeSwitch, to its Known Exploited Vulnerabilities (KEV) catalog. Under the requirements of…

breach

Binance Investigates ShinyHunters Breach Claims

Binance is currently investigating claims made by the threat actor group ShinyHunters, which alleges it has successfully breached the cryptocurrency exchange’s systems. On November 4, 2026, the group posted an advertisement on the PwsForums platform, asserting that it had obtained approximately 335.9 million records. The attackers are demanding a payment of $900,000, threatening to leak the…

security

France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites

The French government has formally attributed a cyberattack targeting refrigeration controllers across approximately 700 retail locations to a cyber unit associated with Iran’s Islamic Revolutionary Guard Corps (IRGC). The incident, which occurred on the night of October 11, involved unauthorized access to industrial control systems used to manage temperature settings in commercial food…