Loading story…
Laurent Giovannoni, a principal software engineer at Filigran, has developed ScamBuster, an open source AI-driven system that responds to phishing and scam emails by impersonating believable victims rather than deleting the messages. The inbound-only platform conducts extended conversations with scammers to gather operational details including bank account information, IBANs, phone numbers, payment methods, and malicious payment domains, with the aim of exposing the infrastructure and financial channels behind fraud campaigns.
ScamBuster converts the collected data into structured threat intelligence formats including STIX 2.1 and MISP, allowing security teams, researchers, and law enforcement to correlate related scam activity and support investigations. Giovannoni said the model-agnostic tool has been running in production since late 2025, can operate on lower-cost models such as GPT-4o-mini, and is expected to be formally unveiled at Black Hat USA 2026 with its code released under the MIT license; future versions are planned to expand beyond email into vishing and smishing.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Laurent Giovannoni said the AI-driven anti-phishing system ScamBuster has been in production since November 2025. The platform engages phishing and scam operators through believable victim personas and extracts indicators for structured threat intelligence.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly leveraging artificial intelligence to enhance the effectiveness and scale of phishing and scam operations. Generative AI technologies now enable attackers to create highly convincing deepfakes, fabricate entire personas, and automate the setup of phishing websites and email campaigns. Romance scams, such as 'pig butchering,' have evolved from being operated by large scam farms to being powered by AI bots that can simultaneously engage with multiple victims, building emotional connections over extended periods before soliciting fraudulent investments. Catfishing has become more sophisticated, with neural networks capable of imitating a person’s appearance, voice, or writing style, making impersonation attacks more convincing and harder to detect. Attackers are also using AI development tools to craft realistic phony CAPTCHA pages, which are designed to trick users into believing they are interacting with legitimate security checks, thereby harvesting credentials or other sensitive information. A new phishing automation platform, SpamGPT, has emerged, offering a full suite of email campaign tools powered by generative AI. SpamGPT mimics professional email marketing services but is tailored for cybercrime, featuring modules for campaign management, deliverability testing, and analytics. The platform’s built-in AI assistant, KaliGPT, can generate persuasive phishing email templates, subject lines, and targeting advice, removing the need for attackers to write their own content. SpamGPT is marketed as a spam-as-a-service solution, promising guaranteed inbox delivery for major email providers by fine-tuning messages to bypass security filters. The platform also abuses trusted cloud providers like Amazon AWS and SendGrid to blend malicious emails with legitimate traffic, further evading detection. These advancements mean that phishing campaigns can now be launched at scale with minimal technical expertise, increasing the threat to both individuals and organizations. The use of AI in scams extends to social engineering, where attackers can convincingly impersonate friends, family, or colleagues, increasing the likelihood of successful attacks. Security experts warn that the rapid evolution of AI-powered phishing tools is outpacing traditional defense mechanisms, necessitating updated awareness and technical controls. Organizations are advised to educate users about the risks of AI-driven scams and to implement advanced email filtering and authentication technologies. The convergence of generative AI and cybercrime is expected to continue, with attackers constantly refining their tactics to exploit new AI capabilities. Vigilance and proactive security measures are essential to mitigate the growing threat posed by AI-enhanced phishing and scams.
Jun 29, 2026
Threat actors are using legitimate and open-weight AI tools to expand phishing, malware delivery, reconnaissance, and fraud operations. Proofpoint observed tens of thousands of malicious Lovable AI website-builder URLs per month in email traffic from February 2025, including pages impersonating Microsoft, UPS, banks, and Aave. Campaigns deployed Tycoon AiTM phishing kits, cryptocurrency wallet drainers, and malware chains involving **DOILoader** and **zgRAT**; some sites used CAPTCHA filtering and sent harvested data directly to Telegram. Lovable’s free hosting and remixable public projects enabled rapid cloning of malicious templates, though the provider removed at least one phishing cluster and introduced real-time detection and daily scanning in July 2025. Recorded Future reported that groups including The Gentlemen ransomware operation have used Chinese AI models for payload generation, analysis, and personally identifiable information triage, while the EvilTokens phishing-as-a-service platform combines AI-generated lures, target research, account validation, and customizable infrastructure intended to evade login-time protections. AI-assisted lures have not consistently outperformed conventional phishing, so layered email and authentication defenses remain effective; however, synthetic media creates a more acute identity threat through executive impersonation, high-value fraud, and biometric-injection attacks capable of defeating live identity-verification checks.
Sep 30, 2026
**Transnational criminal networks** are increasingly industrializing online fraud with **AI-enabled social engineering**, according to reporting on scam compounds in Southeast Asia, an Interpol assessment, and policy commentary tied to a new US executive order. Fraud operations linked to *pig-butchering* and romance scams are using generative AI to improve language quality, deepfakes to impersonate trusted people, and low-cost "deepfake-as-a-service" offerings to scale deception. Interpol said AI-assisted fraud is **4.5 times more profitable** than non-AI schemes, while broader reporting describes these operations as structured, multinational enterprises that function like businesses and increasingly rely on automation, synthetic identities, and persuasive impersonation at scale. Reporting from Cambodia and the wider region shows scam operators are now recruiting "**AI face models**" to appear on high-volume deepfake video calls, including applicants from multiple countries seeking work in compounds associated with trafficking-linked fraud operations. The same ecosystem has been described as part of a broader organized-crime model involving forced labor, cryptocurrency investment scams, romance fraud, and impersonation schemes targeting victims globally. One reference on calculating AI ROI in enterprise cybersecurity is **not about this fraud campaign ecosystem**, and an EU sanctions announcement concerns separate state-linked cyber incidents rather than financially motivated AI-enabled fraud.
Jun 29, 2026