US charges three with AI deepfake CEO and attorney impersonation BEC scheme that stole at least $129M

Linha do tempo

1. cyberscoop.com ↗ · pub. 06/11/2026 14:20 · coletado 06/11 15:00

   DOJ charges three men over AI deepfake BEC scheme that defrauded companies of at least $129M

   ler a análise desta fonte ocultar

   The U.S. Department of Justice announced charges against Jacob Soall, Sharon Hazan and Guy Sheetrit for an alleged years-long business email compromise scheme that used AI-generated deepfakes of CEOs and of attorneys at some of the world's 50 largest law firms to steal at least $129 million. Court records say the trio and co-conspirators targeted thousands of victims between July 2024 and February 2026, selecting employees with authority to approve large wire transfers. Named losses include a UK fintech (~$11.6M), a Florida pet food company ($5.2M), a Missouri hospital system ($4.8M), a Massachusetts mutual fund company ($4.6M), a California hospital system (~$3M), a New York investment firm ($2.8M) and a Rhode Island bank (~$2.7M). Funds were wired to accounts in the United States, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China, then converted to cryptocurrency and split among the conspirators. Soall was arrested in Spain on June 17, Hazan in Spain on Aug. 5 and Sheetrit in the United Kingdom on Sept. 7; the seven counts carry a maximum of 104 years. Reporting by itpro.com corroborates the DOJ figures and the roles attributed to each defendant (itpro.com).

   Technical Details

   The social engineering chain began with an email purportedly from an e-signature provider, in which the impersonated CEO described a "confidential financial transaction" and required the targeted employee to sign an NDA before contacting a supposed outside counsel. The crew then impersonated that attorney, using AI-cloned voices and images to validate the transaction; Soall allegedly voiced UK-based lawyers from a handwritten script. Hazan allegedly claimed to have laundered money since 1994, including more than $400 million in the past three years, and was convicted of bank fraud conspiracy in the Southern District of New York in 2008. No malware, CVEs or technical indicators are involved — the scheme relies entirely on impersonation and payment-process abuse.

   Remediation

   Finance and accounts-payable teams should enforce out-of-band callback verification on a known-good number for any payment change or "confidential" transaction, treat secrecy and NDA pressure as a red flag, require dual authorisation above a threshold, and verify outside counsel through the firm's published contacts rather than details supplied in the request. Voice and video calls must no longer be accepted as proof of identity.

2. securityweek.com ↗ · pub. 06/11/2026 00:03 · coletado 06/11 01:00 primeiro registro

   US Charges Three With Using AI Deepfakes to Impersonate CEOs, Attorneys in $129M Fraud Scheme

   ler a análise desta fonte ocultar

   A federal indictment unsealed in the Southern District of New York charges Jacob Soall, Sharon Hazan, and Guy Sheetrit with using artificial intelligence to impersonate corporate executives and attorneys to defraud companies worldwide of more than $129 million. Federal prosecutors say Jacob Soall, Sharon Hazan and Guy Sheetrit stole more than $129 million in total between 2024 and 2026 by pretending to be at least seven different high-profile corporate executives around the world. Victims included hospital systems in Missouri and California, a bank in Rhode Island, a financial technology company in the United Kingdom, a mutual fund company in Massachusetts and a pet food company in Florida. The defendants, who used nicknames including "Rocky Balboa," "Superman Cash," and "Fat Boy," were arrested in Spain and the United Kingdom between June and September 2026 and face extradition to the United States.

   Technical Details

   The scheme often targeted the companies' accounting departments, sending an email purporting to be from the CEO and asking for help with a confidential financial transaction, before coordinating a phone or video call where the defendants used AI to mimic the voice and sometimes the image of the CEO. The defendants would then tell them to contact an attorney at a major law firm, who the group was also ready to impersonate. Soall primarily impersonated attorneys from the United Kingdom and kept a handwritten script titled "Lawyer Call" that he used to make himself seem like a real attorney when speaking with victims (justice.gov). The impersonated attorney would direct the employee to wire funds, which were converted into cryptocurrency and routed through conspirator-controlled accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia, and China to conceal their source before being distributed among the group (justice.gov).

   According to the U.S. Attorney's Office, the fraud stole specific amounts from each victim, including $4,829,580 from the Missouri hospital system, $2,684,580 from the Rhode Island bank, $2,968,497 from the California hospital system, $11,578,474 from the UK fintech company, $4,639,918 from the Massachusetts mutual fund company, and $5,242,747 from the Florida pet food company (justice.gov). The three each face seven counts — conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy, and two counts of money laundering — with maximum sentences of 20 years per count except aggravated identity theft, which carries two years (justice.gov). Hazan has a prior 2008 conviction in the Southern District of New York for conspiracy to commit bank fraud and reportedly boasted of having laundered more than $400 million over the preceding three years (justice.gov). FBI Assistant Director in Charge James C. Barnacle, Jr. said the case shows how advanced technology can be used to commit large-scale fraud, noting that as criminals continue to weaponize emerging technologies, the FBI remains committed to adapting its capabilities to identify and disrupt those who seek to harm businesses.

   Remediation

   The case underscores the growing use of AI voice- and video-cloning to defeat executive-verification procedures in business email compromise and CEO-fraud schemes. Organizations should implement out-of-band verification for high-value wire transfer requests, independent of the channel used to make the request, and train accounting and finance staff to treat urgent, confidentiality-restricted financial requests — even ones accompanied by convincing voice or video calls — as a red flag warranting secondary confirmation.