Loading story…
Attackers used WhatsApp impersonation and AI voice cloning to deceive Fideuram chairman Paolo Molesini into authorizing international transfers worth about €95 million. In the February 2026 fraud, the perpetrators posed as Intesa Sanpaolo CEO Carlo Messina in WhatsApp messages and then used a cloned voice impersonating Paolo Nastasi, managing partner of A&O Shearman Italia, to reinforce the request. Funds were primarily routed to accounts in China and Hong Kong; Intesa Sanpaolo said its IT systems were not compromised.
International banking cooperation and the Milan Public Prosecutor's Office froze and recovered roughly €59 million, but about €36 million remains missing after alleged conversion to cryptocurrency and redistribution through international channels. Authorities are pursuing mutual legal-assistance requests, while Intesa Sanpaolo CSO Antonio De Vita said the group had identified and removed approximately 5,000 deepfake videos using Messina's likeness since the beginning of 2026.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
In February 2026, attackers impersonated Intesa Sanpaolo CEO Carlo Messina via WhatsApp to contact Fideuram chairman Paolo Molesini. A follow-up call used an AI-cloned voice purporting to be A&O Shearman Italia managing partner Paolo Nastasi, leading Molesini to authorize roughly €95 million in international transfers, mainly to accounts in China and Hong Kong.
Intesa Sanpaolo stated that the CEO-fraud incident did not involve a compromise of its IT systems. Authorities were pursuing international mutual legal-assistance requests in multiple countries.
International interbank cooperation and the Milan Public Prosecutor's Office blocked and recovered approximately €59 million of the funds transferred in the Fideuram fraud. About €36 million remained unaccounted for, reportedly after conversion to cryptocurrency and redistribution through international channels.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered **Phantom Deal**, an M&A-themed business-email-compromise and advance-payment fraud campaign that impersonates executives and advisers to manufacture confidential acquisition transactions. In an attempted theft targeting Gen Digital's legal team, operators used WhatsApp, personal email, realistic corporate details, and a forged PwC-branded non-disclosure agreement to pressure Avast Software s.r.o. into wiring **€626,735.45** to a Hong Kong company. The targeted employee identified an inconsistency in the impersonator's voice and did not send funds. The attackers sought to isolate the employee from normal corporate channels, weaponizing deal secrecy to bypass legal, finance, treasury, compliance, and corporate-development review. During a controlled engagement, Gen researchers recorded repeated accesses to a canary-linked false payment confirmation; the fraudsters also requested SWIFT MT103 and UETR payment-tracking details. Analysis linked the operation to four additional targets and a reusable toolkit using PwC, KPMG, and Ogier branding, although investigators found no evidence that those firms were compromised or involved. Organizations should require independent out-of-band verification for executive-directed payments and confidential transaction requests.
Sep 4, 2026
Arup, the London-based engineering and design firm, confirmed that fraudsters stole about **HK$200 million** (roughly **US$25 million**) after targeting an employee in its Hong Kong office with a deepfake-enabled impersonation scheme. According to the company and Hong Kong police, the employee first received a message appearing to come from Arup’s UK office about a confidential transaction and initially suspected phishing, but later joined a video conference in which AI-generated voices and images convincingly mimicked the company’s CFO and other colleagues. Believing the meeting was legitimate, the employee transferred funds to multiple Hong Kong bank accounts before checking with headquarters and discovering the scam. Arup said it reported the incident to Hong Kong police in January, that the case remains under investigation, and that its internal systems were not compromised and business operations were unaffected. The theft has drawn attention to the growing use of **deepfake video, voice spoofing, and business email fraud** in corporate payment scams, with security experts warning that generative AI is making executive impersonation attacks more convincing and scalable.
Jun 29, 2026
The FBI has issued a warning about a new wave of AI-powered phishing campaigns that leverage deepfake voice technology to impersonate high-ranking officials. These attacks combine smishing (SMS phishing) and vishing (voice phishing) techniques, using cloned voices to convincingly trick victims—often senior U.S. officials or executives—into divulging sensitive information or transferring funds. The increasing accessibility of AI tools has made it easier for cybercriminals to create highly realistic audio deepfakes, raising significant concerns for organizations and national security. Whaling attacks, which specifically target top executives, are becoming more sophisticated by incorporating these AI-driven tactics. A recent example involved a hedge fund manager who was lured into a malware-laden Zoom meeting, resulting in the compromise of his email account and the fraudulent approval of $8.7 million in fake invoices. Senior executives are particularly attractive targets due to their authority, access to sensitive data, and tendency to bypass security controls, making the threat of AI-enhanced phishing and whaling attacks a critical concern for businesses and government entities alike.
Jun 29, 2026