[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpdQjGgP1QIXdL7iRQR4Y_EgZjotrmjiWIlxMGFG7peI":3},{"article":4,"iocs":48,"watch_terms":51,"solutions":52,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"baa5f70c-d8aa-405a-b281-7b4c04fb4bd4","Trio accused of using deepfake CEOs and bogus lawyers to scam businesses out of $129 million","trio-accused-of-using-deepfake-ceos-and-bogus-lawyers-to-scam-businesses-out-of-c0a75f","Three men allegedly used deepfakes of company CEOs and law firm attorneys to trick employees into wiring more than $129 million to accounts the group controlled, the Justice Department said. The indictment names the three as Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42. Soall used the alias “Rocky Balboa,” and Hazan went by “Superman Cash,” “Impossible Mission” and “Fat Boy,” among others. The scheme ran from 2024 to 2026 and usually opened … More → The post Trio accused of using deepfake CEOs and bogus lawyers to scam businesses out of $129 million appeared first on Help Net Security.","Three individuals have been indicted for allegedly using deepfake technology to impersonate company CEOs and lawyers, defrauding businesses out of over $129 million. The scheme involved voice and video manipulation to trick employees into wiring funds to accounts controlled by the conspirators, who then laundered the money through cryptocurrency.","Three men accused of using deepfake CEOs and lawyers to scam businesses out of $129 million.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F09\u002Fdeepfake-ceo-fraud-129-million-indictment\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2024\u002F05\u002F18153819\u002Fdeepfakes-1500.webp","2026-11-09T11:47:43+00:00","2026-11-09T12:01:17.689319+00:00",8,[17,20,22,24],{"name":18,"type":19},"Jacob Soall","threat_actor",{"name":21,"type":19},"Sharon Hazan",{"name":23,"type":19},"Guy Sheetrit",{"name":25,"type":26},"deepfake","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":42,"value":25,"context":50},"AI-generated audio and video used for impersonation",[25],{"controls":53,"vendors":137},[54,83,110],{"slug":55,"name":56,"problem":57,"products":58},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":84,"name":85,"problem":86,"products":87},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[88,96,102],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":97,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":97,"url":100,"description":101},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"slug":111,"name":112,"problem":113,"products":114},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[115,122,130],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":119,"url":120,"description":121},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":111,"product_name":134,"url":135,"description":136},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":150},"deepfake-ceo-scam-nets-129m-by-exploiting-human-trust","Deepfake CEO Scam Nets $129M by Exploiting Human Trust","Three individuals allegedly used AI-generated deepfake audio and video to impersonate CEOs and lawyers, convincing employees to wire over $129 million to fraudulent accounts. The root cause was a failure in human verification processes — employees lacked the training and protocols needed to authenticate high-stakes financial requests made through digital channels. This matters because deepfake technology is becoming increasingly accessible, making social engineering attacks more convincing and harder to detect with the naked eye alone. Organizations that rely solely on voice or video recognition for identity verification are now dangerously exposed to this class of fraud.",[143,144,145,146,147,148,149],"CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","GDPR Article 32",{"GDPR Article 32":151,"MITRE ATT&CK T1566: Phishing":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":154,"CIS Control 17: Incident Response Management":155,"CIS Control 14: Security Awareness and Skills Training":156,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":157},"To the extent that personal and financial data was processed and exposed through the fraudulent transactions, Article 32 requires appropriate technical and organizational measures — including identity verification controls — to protect against unauthorized processing.","Deepfake impersonation of executives is a sophisticated evolution of phishing\u002Fvishing (voice phishing) techniques catalogued under T1566, and the mitigations — user training and verification procedures — directly apply.","While not a software flaw, the procedural gap in verifying executive identities before executing fund transfers represents a control deficiency that SI-2's spirit of systematic remediation of known weaknesses directly addresses.","This clause requires organizations to ensure staff have the competence to recognize and respond to security threats; finance employees were not sufficiently trained to identify deepfake impersonation as a threat vector.","A rehearsed incident response playbook for voice\u002Fvideo compromise would have enabled faster detection, containment of fraudulent wire transfers, and evidence preservation for law enforcement.","Employees were deceived because they lacked specific training on deepfake-based social engineering; structured awareness programs covering synthetic media fraud would have improved recognition and skepticism.","The fraud succeeded because there was no robust identity authentication process for high-value financial instructions; out-of-band verification controls required by this function would have broken the attack chain."]