CEO-spoofing AI fraud campaign — US companies defrauded of ~$129M via AI voice/image impersonation of executives and lawyers
Severity: high · Patch status: no-fix-needed · Since 2026-11-06
The US Justice Department indicted three men — Jacob Soall (Spain), Sharon Hazan (Israel) and Guy Sheetrit (Israel) — for a 2024-2026 conspiracy that stole approximately $129 million by impersonating CEOs and lawyers using AI-generated voices and images. They contacted lower-level employees claiming a confidential financial transaction, mimicked executives on calls, then posed as attorneys at large international firms to legitimise requests. Victims included a Missouri hospital (~$5M), a Rhode Island bank ($2.6M), a California hospital ($2.9M), a UK tech company ($11.5M), a Massachusetts finance company ($4.6M) and a Florida pet food company ($5.2M). Funds were wired to accounts in the US, Europe, UAE and China, then converted to cryptocurrency. Soall and Hazan were arrested in Spain, Sheetrit in the UK; extradition is pending. Each faces up to 104 years. No technical fix applies; this is social engineering exploiting AI tools.
What to do
- Train finance and AP staff to verify payment requests out-of-band via known phone numbers or in-person, never via contact details supplied on the call
- Require dual approval and callbacks for wire transfers, especially confidential or urgent requests attributed to executives or outside counsel
- Establish code words or verification protocols with executives and legal firms for sensitive transactions
- Monitor for anomalous wire requests and review recent large transfers for similar patterns
- Report suspected incidents to the FBI, which is seeking additional victim companies
Sources
All live incidents on Threat Watch
