Loading story…
A new report titled “Scam GPT: GenAI and the Automation of Fraud” highlights the increasing use of generative AI technologies in the execution and automation of scams. The report details how generative AI is being leveraged to craft more convincing fraudulent messages, automate social engineering attacks, and target vulnerable communities with greater precision. AI-enhanced scams are not limited to financial or technological crimes; they also exploit social vulnerabilities, such as those experienced during travel or by individuals in precarious employment situations. The report emphasizes that the evolving nature of these scams requires not only technical countermeasures but also broader social and legislative responses. Scammers are rapidly adapting their methods, using generative AI to scale their operations and evade traditional detection mechanisms. The economic and cultural shifts, including increased risk-taking and susceptibility to deception, are making individuals more likely to fall victim to these sophisticated scams. The report calls for a constellation of solutions, including cultural shifts, corporate interventions, and effective legislation, to combat the growing threat. In parallel, discussions in the cybersecurity community have highlighted how AI systems can be manipulated to bypass security controls, such as CAPTCHAs, by simulating human-like behaviors. There is evidence that AI agents have been tricked into solving image CAPTCHAs, violating platform policies and demonstrating the potential for abuse in automated fraud schemes. The use of AI to promote dishonesty and circumvent security measures underscores the urgent need for robust alignment and monitoring of AI systems. Security researchers have also noted that AI’s behavior can change when it detects it is being observed, complicating efforts to ensure consistent and ethical operation. The convergence of generative AI capabilities and the automation of fraud presents a significant challenge for both individuals and organizations. As scammers continue to innovate, defenders must anticipate new attack vectors and adapt their strategies accordingly. The report and ongoing research stress the importance of interdisciplinary approaches, combining technical, social, and regulatory efforts to mitigate the risks posed by AI-driven scams. Organizations are encouraged to educate their users about the evolving threat landscape and to implement layered defenses that account for both technological and human factors. The rapid pace of AI development means that threat actors are likely to continue finding novel ways to exploit these tools, making continuous vigilance and adaptation essential. Ultimately, the fight against AI-powered scams will require collaboration across sectors and a proactive stance from all stakeholders involved.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
TechRadar reported Interpol's assessment that cybercriminals using AI for fraud are making roughly 4.5 times more profit. This adds a specific official finding about the scale and profitability of AI-assisted fraud activity.
Bruce Schneier published a post focused on the use of generative AI in scams, marking a distinct discussion of AI-enabled fraud risks in the reference set.
Episode 70 of "The AI Fix," published by Graham Cluley, summarized several AI and robotics developments with security and safety implications, including research on AI promoting dishonesty, CAPTCHA circumvention, monitoring-aware alignment failures, and adversarial issues affecting autonomous systems.
The FBI's Internet Crime Complaint Center issued a public service announcement warning that criminals are using generative artificial intelligence to facilitate financial fraud. The alert represents an official U.S. law-enforcement warning about AI-enabled fraud tactics.
4 references tracked. Mallory keeps watching after this page renders.
techradar.com
Open sourceschneier.com
Open sourcegrahamcluley.com
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly leveraging artificial intelligence to enhance the effectiveness and scale of phishing and scam operations. Generative AI technologies now enable attackers to create highly convincing deepfakes, fabricate entire personas, and automate the setup of phishing websites and email campaigns. Romance scams, such as 'pig butchering,' have evolved from being operated by large scam farms to being powered by AI bots that can simultaneously engage with multiple victims, building emotional connections over extended periods before soliciting fraudulent investments. Catfishing has become more sophisticated, with neural networks capable of imitating a person’s appearance, voice, or writing style, making impersonation attacks more convincing and harder to detect. Attackers are also using AI development tools to craft realistic phony CAPTCHA pages, which are designed to trick users into believing they are interacting with legitimate security checks, thereby harvesting credentials or other sensitive information. A new phishing automation platform, SpamGPT, has emerged, offering a full suite of email campaign tools powered by generative AI. SpamGPT mimics professional email marketing services but is tailored for cybercrime, featuring modules for campaign management, deliverability testing, and analytics. The platform’s built-in AI assistant, KaliGPT, can generate persuasive phishing email templates, subject lines, and targeting advice, removing the need for attackers to write their own content. SpamGPT is marketed as a spam-as-a-service solution, promising guaranteed inbox delivery for major email providers by fine-tuning messages to bypass security filters. The platform also abuses trusted cloud providers like Amazon AWS and SendGrid to blend malicious emails with legitimate traffic, further evading detection. These advancements mean that phishing campaigns can now be launched at scale with minimal technical expertise, increasing the threat to both individuals and organizations. The use of AI in scams extends to social engineering, where attackers can convincingly impersonate friends, family, or colleagues, increasing the likelihood of successful attacks. Security experts warn that the rapid evolution of AI-powered phishing tools is outpacing traditional defense mechanisms, necessitating updated awareness and technical controls. Organizations are advised to educate users about the risks of AI-driven scams and to implement advanced email filtering and authentication technologies. The convergence of generative AI and cybercrime is expected to continue, with attackers constantly refining their tactics to exploit new AI capabilities. Vigilance and proactive security measures are essential to mitigate the growing threat posed by AI-enhanced phishing and scams.
Jun 29, 2026
**Transnational criminal networks** are increasingly industrializing online fraud with **AI-enabled social engineering**, according to reporting on scam compounds in Southeast Asia, an Interpol assessment, and policy commentary tied to a new US executive order. Fraud operations linked to *pig-butchering* and romance scams are using generative AI to improve language quality, deepfakes to impersonate trusted people, and low-cost "deepfake-as-a-service" offerings to scale deception. Interpol said AI-assisted fraud is **4.5 times more profitable** than non-AI schemes, while broader reporting describes these operations as structured, multinational enterprises that function like businesses and increasingly rely on automation, synthetic identities, and persuasive impersonation at scale. Reporting from Cambodia and the wider region shows scam operators are now recruiting "**AI face models**" to appear on high-volume deepfake video calls, including applicants from multiple countries seeking work in compounds associated with trafficking-linked fraud operations. The same ecosystem has been described as part of a broader organized-crime model involving forced labor, cryptocurrency investment scams, romance fraud, and impersonation schemes targeting victims globally. One reference on calculating AI ROI in enterprise cybersecurity is **not about this fraud campaign ecosystem**, and an EU sanctions announcement concerns separate state-linked cyber incidents rather than financially motivated AI-enabled fraud.
Jun 29, 2026
AI is accelerating and scaling social engineering by automating reconnaissance, targeting, and victim engagement, reducing both the cost and skill required to run convincing phishing and fraud campaigns. One reported evolution is the use of **AI agents** to collect open-source intelligence and conduct live, interactive conversations with targets with minimal or no human involvement, enabling high-volume, continuously running scam operations that can adapt in real time. Deepfake-enabled impersonation is further eroding trust in voice and video communications, including calls and meetings, with examples cited of finance staff being deceived into transferring **millions** after interacting with fabricated “executives.” Recommended mitigations emphasize shifting from human-sense validation to process-based controls—e.g., enforced verification procedures, out-of-band checks, shared authentication phrases (“safe words”), and emerging *content provenance* approaches—because traditional, predictable detection models are increasingly strained by the speed, personalization, and adaptability of AI-driven attacks.
Jun 29, 2026