Threat watch / Campaign
Three charged in AI impersonation scheme that stole more than $129 million
US prosecutors in New York say three men used AI to imitate the voice or image of company executives, then posed as lawyers, to get employees to wire money to accounts they controlled. The charges are accusations: the defendants are presumed innocent.
- Sector
- Many sectors
- Way in
- Phishing, social engineering
- Product or vendor
- None named
- How it happened
- According to the indictment, the defendants impersonated the voices or images of corporate executives, typically CEOs, who told employees they needed help with a confidential transaction. Employees were then sent to supposed lawyers at major law firms, played by the conspirators, who directed wire transfers to accounts the group controlled. Prosecutors cite a handwritten script titled "Lawyer Call" with language meant to stop employees from discussing the requests with coworkers. AP adds that the first contact was an email posing as the CEO.[1][2] Checked 8 Nov 2026
- What was stolen
- Money: more than $129 million over 2024 to 2026, according to the Justice Department. Victims wired funds to accounts in the US, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China. The funds were converted to cryptocurrency and shared among the conspirators.[1][2] Checked 8 Nov 2026
- Who was impacted
- Six victim companies are listed with their losses: a Missouri hospital system ($4.8M), a Rhode Island bank ($2.7M), a California hospital system ($3.0M), a UK financial technology company ($11.6M), a Massachusetts mutual fund company ($4.6M) and a Florida pet food company ($5.2M). Those six amounts do not add up to the total; AP says the group targeted thousands of companies worldwide.[1][2] Checked 8 Nov 2026
- Threat actor
- Not attributed. The indictment charges Jacob Soall (41), Sharon Hazan (54) and Guy Sheetrit (42). The Justice Department says Soall mainly impersonated UK attorneys and Hazan and Sheetrit laundered the proceeds. They are presumed innocent unless proven guilty.
Timeline
- Soall is arrested in Spain. Hazan is arrested in Spain on August 5 and Sheetrit in the UK on September 7. Extradition requests are pending. [1]
- The US Attorney's Office for the Southern District of New York announces the unsealed indictment. The charges include wire fraud, aggravated identity theft and money laundering. [1][2]