U.S. authorities allege that three men used AI-generated CEO and lawyer impersonations to steal at least $129 million from businesses. The scheme targeted accounting staff with a confidential-transaction storyline, used an e-signature message to obtain an NDA, and then used a fake attorney to make a large wire transfer appear legitimate.
According to an unsealed indictment, the scheme allegedly defrauded companies of at least $129 million between July 2024 and February 2026. It typically began with an email from an e-signature company in which an impersonated CEO claimed to be handling a confidential financial transaction and asked the employee to sign an NDA before contacting outside legal counsel. The NDA request created a sense of urgency and secrecy, setting up the next step: a call or message with a fake attorney who reinforced the legitimacy of the deal.
Using AI, the alleged actors imitated the voices and images of CEOs and lawyers, including attorneys at some of the world's 50 largest law firms. This combination of deepfake audio and video with a plausible business pretext made the request difficult for employees to question in the moment.
The operation specifically targeted accounting employees who had the authority to approve large wire transfers, rather than random staff. By routing the interaction through an NDA and a supposed attorney, the scheme inserted artificial legitimacy and confidentiality into the process, discouraging employees from checking with colleagues or following standard verification steps. The use of AI-generated voice and video added a further layer of apparent authenticity to what was otherwise a classic business email compromise pattern.
Reported victims spanned multiple sectors, including financial technology, healthcare, banking, investment, mutual fund, and food manufacturing organizations, showing the pretext worked across industries rather than targeting one specific type of business.
Organizations can reduce exposure to this kind of attack by treating unexpected CEO requests involving confidential deals and wire transfers as verification events rather than routine executive instructions. Employees should never rely on a voice, video image, or a supplied legal contact to validate a payment request. Instead, they should independently verify the request using known company contact information and established approval processes. Requiring out-of-band confirmation and multi-person approval for large or unusual wire transfers adds a critical check that can stop this style of fraud before funds are sent.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers emailed accounting staff through an e-signature workflow, impersonating a CEO who described a confidential financial transaction and asked the employee to sign an NDA. Victims were then directed to a fake attorney who made the wire transfer request seem legitimate.
The scheme targeted employees with authority to approve large wire transfers, including accounting, finance, treasury, and accounts payable staff across industries like fintech, healthcare, banking, and investment management.
Warning signs include an unexpected urgent and confidential transaction request arriving via an e-signature workflow, bypassing of normal payment approval procedures, and being told to contact legal counsel using contact details supplied by the requester rather than independently verified information.
Require independent, out-of-band confirmation and multi-person approval for large or unusual wire transfers, and treat requests involving confidentiality and NDAs before a payment as verification events rather than routine instructions.
Your CEO needs a confidential wire transfer. Or do they? First comes an e-signature email: the CEO says a “confidential financial transaction” requires an NDA. Then you're told to call the lawyer whose number they supplied. Here's the trap: AI can fake the CEO's face and voice, and the lawyer's. The NDA makes secrecy feel official while the wire request skips normal approvals. Before any wire, call your CEO using the number in your company directory, not the one in the message.
U.S. prosecutors charged three people with allegedly using AI-generated CEO and attorney impersonations to steal about $129 million from companies worldwide. The group reportedly emailed accounting teams about confidential transactions, used AI voice and video calls to reinforce the request, and…
The roundup describes real social-engineering incidents: a phishing email that led an employee to enter credentials on a fake Microsoft 365 login page, and a wave of voice-phishing attempts against major hedge funds using voice-mimicking technology. Both incidents show practical lures that can be…
The article describes how modern phishing can start with an email impersonation and then move into live deepfake video calls to pressure employees into sending money. It cites a widely reported case at engineering firm Arup where an employee, convinced by a deepfake video call featuring synthetic…
Research from Cisco Talos and CrowdStrike says criminals are building AI into everyday operations, from writing malicious code to scaling fraud infrastructure. The reports describe real prompt logs where attackers use simple “authorized testing” claims to trick AI tools into helping them, plus…
The FBI warns scammers are impersonating FBI/IC3 staff and re-targeting people who already lost money to fraud. The scammers use emails, phone calls, social media messages, and even AI-generated videos to push victims to spoofed IC3 websites or to hand over more personal and financial information,…
INTERPOL’s Operation Serengeti III arrested 1,462 suspects across 21 countries targeting fraud, phishing, business email compromise, ransomware, and digital extortion. In Uganda, investigators found scam call centres using prepared scripts and fake trading platforms to persuade people, including…
