Loading story…
Arup, the London-based engineering and design firm, confirmed that fraudsters stole about HK$200 million (roughly US$25 million) after targeting an employee in its Hong Kong office with a deepfake-enabled impersonation scheme. According to the company and Hong Kong police, the employee first received a message appearing to come from Arup’s UK office about a confidential transaction and initially suspected phishing, but later joined a video conference in which AI-generated voices and images convincingly mimicked the company’s CFO and other colleagues.
Believing the meeting was legitimate, the employee transferred funds to multiple Hong Kong bank accounts before checking with headquarters and discovering the scam. Arup said it reported the incident to Hong Kong police in January, that the case remains under investigation, and that its internal systems were not compromised and business operations were unaffected. The theft has drawn attention to the growing use of deepfake video, voice spoofing, and business email fraud in corporate payment scams, with security experts warning that generative AI is making executive impersonation attacks more convincing and scalable.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Arup confirmed that it was the company targeted in the Hong Kong deepfake fraud case and said fake voices and images had been used to deceive an employee. The company reiterated that its systems were not compromised and that the matter remained under police investigation.
Hong Kong police revealed that a multinational company had lost about HK$200 million after an employee was deceived by AI-generated video and voice impersonations during a conference call. The disclosure brought wider attention to the scale and sophistication of deepfake-enabled business fraud.
Arup notified Hong Kong police in January after discovering the fraudulent transfers. The case was opened for investigation, and Arup later said its operations and financial stability were unaffected and that no internal systems were compromised.
A finance employee in Arup's Hong Kong office received a message about a confidential transaction and then joined a video conference featuring AI-generated impersonations of the company's CFO and other staff. Believing the participants were legitimate, the employee transferred about HK$200 million (roughly US$25 million) to fraudsters across multiple Hong Kong bank accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourcecfodive.com
Open sourcecnn.com
Open sourceedition.cnn.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Gartner found that AI-enabled deepfake impersonation is making social-engineering attacks more convincing across phone calls, video conferences, email, and text messages. Of 297 senior cybersecurity leaders surveyed, **41%** reported a deepfake-related employee audio-call incident and **36%** reported a video-call incident in the preceding 12 months; **79%** encountered phishing, spear-phishing, or business-email-compromise activity. A prominent example was the 2024 fraud against engineering firm Arup, where video-call impersonations of colleagues persuaded an employee to transfer more than **$25 million** to criminal-controlled accounts. Gartner urged organizations to replace training focused on spotting fakes with mandatory, out-of-band verification for sensitive requests. CISOs should apply phishing-resistant and risk-based identity controls to high-value workflows, correlate suspicious communications with identity, device, privilege, and payment activity, and extend incident-response plans to cover multimodal impersonation and compromised AI agents.
Sep 25, 2026
AI is accelerating and scaling social engineering by automating reconnaissance, targeting, and victim engagement, reducing both the cost and skill required to run convincing phishing and fraud campaigns. One reported evolution is the use of **AI agents** to collect open-source intelligence and conduct live, interactive conversations with targets with minimal or no human involvement, enabling high-volume, continuously running scam operations that can adapt in real time. Deepfake-enabled impersonation is further eroding trust in voice and video communications, including calls and meetings, with examples cited of finance staff being deceived into transferring **millions** after interacting with fabricated “executives.” Recommended mitigations emphasize shifting from human-sense validation to process-based controls—e.g., enforced verification procedures, out-of-band checks, shared authentication phrases (“safe words”), and emerging *content provenance* approaches—because traditional, predictable detection models are increasingly strained by the speed, personalization, and adaptability of AI-driven attacks.
Jun 29, 2026
**Transnational criminal networks** are increasingly industrializing online fraud with **AI-enabled social engineering**, according to reporting on scam compounds in Southeast Asia, an Interpol assessment, and policy commentary tied to a new US executive order. Fraud operations linked to *pig-butchering* and romance scams are using generative AI to improve language quality, deepfakes to impersonate trusted people, and low-cost "deepfake-as-a-service" offerings to scale deception. Interpol said AI-assisted fraud is **4.5 times more profitable** than non-AI schemes, while broader reporting describes these operations as structured, multinational enterprises that function like businesses and increasingly rely on automation, synthetic identities, and persuasive impersonation at scale. Reporting from Cambodia and the wider region shows scam operators are now recruiting "**AI face models**" to appear on high-volume deepfake video calls, including applicants from multiple countries seeking work in compounds associated with trafficking-linked fraud operations. The same ecosystem has been described as part of a broader organized-crime model involving forced labor, cryptocurrency investment scams, romance fraud, and impersonation schemes targeting victims globally. One reference on calculating AI ROI in enterprise cybersecurity is **not about this fraud campaign ecosystem**, and an EU sanctions announcement concerns separate state-linked cyber incidents rather than financially motivated AI-enabled fraud.
Jun 29, 2026