Cyber adversaries aren’t slowing down, Digital Defenders. |
AI deepfake scams, OAuth abuse, global espionage, and Android malware—proof that attackers continue to weaponize trust and technology, leaving defenders with no room to breathe. |
|
| Here’s what you need to know: |
|
|
AI Supercharges Cybercrime From Ransom to Espionage |
Anthropic’s recent report warns that hackers and state actors are using AI to automate extortion, fraud, and espionage.
The report stated that criminals used Claude AI to steal data, create ransomware, and aid North Korean operatives in US job scams. |
One attacker, GTG-2002, extorted over $500K from hospitals, agencies, and religious groups. Meanwhile, Chinese operators used AI to breach Vietnamese critical infrastructure. Anthropic is updating its safeguards to counter these AI-driven threats. Update threat models, strengthen behavioral monitoring, and regularly test defenses against AI-simulated attacks to catch blind spots before adversaries do. |
As the Scams Turn: AI Soap Opera Deception Drains $431K |
Scammers used an AI-generated deepfake of soap star Steve Burton to trick a California woman out of nearly $500,000. Believing she was helping the actor, the victim sent cash, crypto, and even sold her condo. But she was actually being fooled by AI-cloned video and voice.
The case shows how AI-driven social engineering is harder to spot, devastating individuals and families while putting executives and employees at greater risk of deepfake-enhanced phishing and fraud. Unfortunately, this victim is reported to be considering bankruptcy after this scam.
Deploy deepfake awareness training and enforce MFA for sensitive requests, especially involving finances or personal data. |
Google Unmasks Token Abuse Behind Salesforce Breach |
Google traced a recent Salesforce breach to UNC6395, which abused OAuth tokens via the Salesloft Drift integration.
Attackers stole personal data, accounts, and case logs, prompting Salesforce and Salesloft to revoke tokens and pull Drift—showing how easily trusted authentication can be weaponized. Google stated that any authentication tokens stored in or connected to the Drift platform should be considered compromised.
Immediately cross-check your logs against GTIG’s published IOCs—especially unusual User-Agent strings and flagged IPs—and revoke any suspicious OAuth tokens. |
|
|
Deepfake Detection Check: Could you spot an AI fake? |
|
|
Yesterday's Pulse Check Results |
How strong is your input validation? |
|
|
Security Tools You Can Use |
|
|
FBI Warns: Global Espionage Campaign Hits 200+ U.S. Orgs |
An FBI-led advisory involving 13 nations exposed Salt Typhoon, a Chinese-backed group infiltrating critical infrastructure in 80+ countries.
Instead of smash-and-grab tactics, the group hid in routers and surveillance systems for years, siphoning sensitive data from 200+ US organizations. |
Salt Typhoon’s stealthy espionage escalates nation-state cyber threats, exposing government surveillance systems and maintaining hidden re-entry points with serious national security implications. The advisory urges proactive threat hunting and mitigation steps.
Audit router and edge firmware now, and apply zero-trust across networks to catch intrusions beyond endpoints. |
Meta Ads Push TradingView Android Trojan |
Researchers found a Meta malvertising campaign pushing a fake “TradingView Premium” app that installs an advanced Android trojan.
Disguised as legit, the ads delivered APKs that stole crypto, bypassed 2FA, and took control of devices—75+ campaigns since July hit thousands across Europe. Attackers are shifting to mobile, using multilingual lures on financial apps in a larger malvertising campaign, Bitdefender says. Block unverified APK sideloading on enterprise devices and use MTD tools to detect accessibility abuse in real time. | |
|
Is Your Team Ready for AI Social Engineering? |
AI scams are rapidly evolving, with deepfake voices and videos that exploit trust, outpacing traditional phishing. Vigilance and safeguards now can prevent costly mistakes. |
How to defend against AI-powered social engineering scams: |
- Verify requests with callbacks through a separate, trusted communication channel.
- Enable multifactor authentication to stop attackers, even with stolen passwords.
- Train teams to detect deepfake voices, faces, and AI-generated content.
-
Require multiple approvals for all high-value or unusual financial transactions.
- Use AI-driven identity tools to flag fake images, videos, and voices.
- Promote a pause-and-check culture to verify unusual requests before acting.
|
AI social engineering scams are growing more convincing. But awareness, verification, and layered defenses help organizations stay ahead and keep people and data safe. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
