US charges three with AI deepfake CEO and attorney impersonation BEC scheme that stole at least $129M

Linha do tempo

1. olhardigital.com.br ↗ · pub. 08/11/2026 10:59 · coletado 08/11 13:00

   US DOJ charges three men over $129M deepfake BEC scheme impersonating CEOs and law firm attorneys

   ler a análise desta fonte ocultar

   The U.S. Department of Justice unsealed an indictment in the Southern District of New York charging three foreign nationals — Jacob Soall (41), Sharon Hazan (54) and Guy Sheetrit (42) — with running an international business email compromise (BEC) scheme that used AI-generated deepfakes of corporate executives and impersonated attorneys to divert at least US$129 million (about R$710 million) from hospitals, banks and other companies. Prosecutors say the operation targeted thousands of companies worldwide and focused on accounting and finance staff authorized to approve large wire transfers, with proceeds converted into cryptocurrency. The indictment was unsealed on Thursday by the U.S. Attorney's Office in Manhattan, which says the men posed as executives and lawyers on calls and laundered the money through crypto (thenextweb.com). Soall was arrested in Spain on 17 June 2026, Hazan in Spain on 5 August 2026 and Sheetrit in the United Kingdom on 7 September 2026, with extradition requests pending (townhall.com). This is a law-enforcement and fraud story rather than a technical vulnerability: there is no CVE, malware family or IOC, but the tradecraft is directly relevant to payment-approval controls.

   Technical Details

   The approach typically began with an email apparently sent by the company president requesting help with a confidential transaction; in one case a non-disclosure agreement was attached to lend credibility. Targets were then moved to phone or video calls with a person posing as an outside attorney, where AI was used to reproduce the voice and, in some cases, the appearance of real executives. The fake lawyer explained the supposed deal and supplied the destination accounts. Prosecutors describe roughly a year and a half of cloning voices and faces of real executives to push corporate finance teams into wiring funds (startupfortune.com). Each defendant faces seven counts including wire fraud and aggravated identity theft (aiweekly.co); Soall allegedly played the attorney role while Hazan and Sheetrit handled laundering. Soall allegedly worked from a handwritten script titled "Lawyer Call" (newscord.org). Named losses include a Missouri hospital network (~US$4.83M, November 2024), a Rhode Island bank (~US$2.68M, November 2024), a California hospital network (~US$2.97M, December 2024), a UK fintech (~US$11.58M, March 2025), a Massachusetts investment fund (~US$4.64M, April 2025) and a Florida animal-feed maker (~US$5.24M, June 2025). A ~US$2.85M payment authorized at a New York investment bank in October 2024 was stopped by the institution's operations team. Hazan was previously convicted in 2008 of conspiracy to commit bank fraud in the same district.

   Remediation

   Enforce out-of-band callback verification to known-good numbers for any payment-instruction change or "confidential deal" request, require dual authorization for high-value wires, and treat urgency, secrecy and NDAs as fraud indicators. Train finance and accounting staff that voice and video on a live call are no longer proof of identity, and rehearse rapid wire-recall procedures with the bank.

2. cyberscoop.com ↗ · pub. 06/11/2026 14:20 · coletado 06/11 15:00

   DOJ charges three men over AI deepfake BEC scheme that defrauded companies of at least $129M

   ler a análise desta fonte ocultar

   The U.S. Department of Justice announced charges against Jacob Soall, Sharon Hazan and Guy Sheetrit for an alleged years-long business email compromise scheme that used AI-generated deepfakes of CEOs and of attorneys at some of the world's 50 largest law firms to steal at least $129 million. Court records say the trio and co-conspirators targeted thousands of victims between July 2024 and February 2026, selecting employees with authority to approve large wire transfers. Named losses include a UK fintech (~$11.6M), a Florida pet food company ($5.2M), a Missouri hospital system ($4.8M), a Massachusetts mutual fund company ($4.6M), a California hospital system (~$3M), a New York investment firm ($2.8M) and a Rhode Island bank (~$2.7M). Funds were wired to accounts in the United States, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China, then converted to cryptocurrency and split among the conspirators. Soall was arrested in Spain on June 17, Hazan in Spain on Aug. 5 and Sheetrit in the United Kingdom on Sept. 7; the seven counts carry a maximum of 104 years. Reporting by itpro.com corroborates the DOJ figures and the roles attributed to each defendant (itpro.com).

   Technical Details

   The social engineering chain began with an email purportedly from an e-signature provider, in which the impersonated CEO described a "confidential financial transaction" and required the targeted employee to sign an NDA before contacting a supposed outside counsel. The crew then impersonated that attorney, using AI-cloned voices and images to validate the transaction; Soall allegedly voiced UK-based lawyers from a handwritten script. Hazan allegedly claimed to have laundered money since 1994, including more than $400 million in the past three years, and was convicted of bank fraud conspiracy in the Southern District of New York in 2008. No malware, CVEs or technical indicators are involved — the scheme relies entirely on impersonation and payment-process abuse.

   Remediation

   Finance and accounts-payable teams should enforce out-of-band callback verification on a known-good number for any payment change or "confidential" transaction, treat secrecy and NDA pressure as a red flag, require dual authorisation above a threshold, and verify outside counsel through the firm's published contacts rather than details supplied in the request. Voice and video calls must no longer be accepted as proof of identity.

3. securityweek.com ↗ · pub. 06/11/2026 00:03 · coletado 06/11 01:00 primeiro registro

   US Charges Three With Using AI Deepfakes to Impersonate CEOs, Attorneys in $129M Fraud Scheme

   ler a análise desta fonte ocultar

   A federal indictment unsealed in the Southern District of New York charges Jacob Soall, Sharon Hazan, and Guy Sheetrit with using artificial intelligence to impersonate corporate executives and attorneys to defraud companies worldwide of more than $129 million. Federal prosecutors say Jacob Soall, Sharon Hazan and Guy Sheetrit stole more than $129 million in total between 2024 and 2026 by pretending to be at least seven different high-profile corporate executives around the world. Victims included hospital systems in Missouri and California, a bank in Rhode Island, a financial technology company in the United Kingdom, a mutual fund company in Massachusetts and a pet food company in Florida. The defendants, who used nicknames including "Rocky Balboa," "Superman Cash," and "Fat Boy," were arrested in Spain and the United Kingdom between June and September 2026 and face extradition to the United States.

   Technical Details

   The scheme often targeted the companies' accounting departments, sending an email purporting to be from the CEO and asking for help with a confidential financial transaction, before coordinating a phone or video call where the defendants used AI to mimic the voice and sometimes the image of the CEO. The defendants would then tell them to contact an attorney at a major law firm, who the group was also ready to impersonate. Soall primarily impersonated attorneys from the United Kingdom and kept a handwritten script titled "Lawyer Call" that he used to make himself seem like a real attorney when speaking with victims (justice.gov). The impersonated attorney would direct the employee to wire funds, which were converted into cryptocurrency and routed through conspirator-controlled accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia, and China to conceal their source before being distributed among the group (justice.gov).

   According to the U.S. Attorney's Office, the fraud stole specific amounts from each victim, including $4,829,580 from the Missouri hospital system, $2,684,580 from the Rhode Island bank, $2,968,497 from the California hospital system, $11,578,474 from the UK fintech company, $4,639,918 from the Massachusetts mutual fund company, and $5,242,747 from the Florida pet food company (justice.gov). The three each face seven counts — conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy, and two counts of money laundering — with maximum sentences of 20 years per count except aggravated identity theft, which carries two years (justice.gov). Hazan has a prior 2008 conviction in the Southern District of New York for conspiracy to commit bank fraud and reportedly boasted of having laundered more than $400 million over the preceding three years (justice.gov). FBI Assistant Director in Charge James C. Barnacle, Jr. said the case shows how advanced technology can be used to commit large-scale fraud, noting that as criminals continue to weaponize emerging technologies, the FBI remains committed to adapting its capabilities to identify and disrupt those who seek to harm businesses.

   Remediation

   The case underscores the growing use of AI voice- and video-cloning to defeat executive-verification procedures in business email compromise and CEO-fraud schemes. Organizations should implement out-of-band verification for high-value wire transfer requests, independent of the channel used to make the request, and train accounting and finance staff to treat urgent, confidentiality-restricted financial requests — even ones accompanied by convincing voice or video calls — as a red flag warranting secondary confirmation.