Three men concocted an elaborate, yearslong scheme that defrauded companies of at least $129 million by using AI to impersonate executives and lawyers, tricking targeted victims into transferring large payments to criminal-controlled accounts, the Justice Department said Thursday.

Jacob Soall, Sharon Hazan and Guy Sheetrit allegedly used AI to impersonate the voices and images of chief executive officers at companies and lawyers at major international law firms. The trio are accused of targeting thousands of victims between July 2024 and February 2026, according to court records.

Victims include a U.K.-based financial tech company that lost almost $11.6 million, a Florida-based pet food company that lost $5.2 million, a Missouri-based hospital system that lost $4.8 million, a Massachusetts-based mutual fund company that lost $4.6 million, a California-based hospital system that lost nearly $3 million, a New York-based investment company duped out of $2.8 million, and a Rhode Island-based bank that transferred nearly $2.7 million.

The trio’s scheme typically started by targeting accounting staff, pretending to be the CEO, and requesting help on a financial transaction, officials said. Using AI to create deepfakes pretending to be CEOs, the crew allegedly directed employees to contact attorneys who they would also impersonate to trick the employee into thinking the financial transaction was legitimate.

Prosecutors said the men and their co-conspirators identified and targeted employees who had sufficient authority to authorize large wire transfers. 

The scheme typically began with an email from an e-signature company, wherein the impersonated CEO claimed they were working on a “confidential financial transaction” that required the victim employee to sign a non-disclosure agreement before contacting the purported attorney at a victim law firm, according to an unsealed indictment.

Soall, Hazan, Sheetrit and their co-conspirators allegedly impersonated attorneys at some of the 50 largest law firms globally. 

“Super intelligence technology offers tremendous potential, but the public should recognize that there are some who seek to use this emerging technology to pursue criminal goals,” Jamie McDonald, U.S. attorney for the Southern District of New York, said in a statement. 

Prosecutors said the wire transfers were sent to bank accounts controlled by co-conspirators around the world, including the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China. The crew allegedly converted the funds to cryptocurrency and distributed the illicit proceeds amongst themselves and their co-conspirators.

Soall, a 41-year-old from Marbella, Spain, was arrested in Spain on June 17. He allegedly primarily impersonated attorneys from the United Kingdom, reading from a handwritten script designed to dupe targeted victims.

Hazan, a 54-year-old from Israel, was arrested in Spain on Aug. 5. He allegedly boasted that he had been laundering money since 1994, including more than $400 million in the past three years, and was previously convicted in the Southern District of New York of conspiracy to commit bank fraud in 2008.

Sheetrit, a 42-year-old from Israel and the United Arab Emirates, was arrested in the United Kingdom on Sept. 7 and allegedly laundered funds from the scheme.

The trio are charged with conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy and two counts of money laundering. The seven counts carry a maximum sentence of 104 years in prison.

“The alleged scheme orchestrated by Soall, Hazan, and Sheetrit demonstrates how the use of advanced technology can be exploited to commit large scale fraud,” James C. Barnacle Jr., assistant director in charge of the FBI New York field office, said in a statement.

“As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities to identify, investigate, and disrupt those who seek to harm New Yorkers and businesses operating in our communities.”

After initial publication of this story, Sheetrit’s attorneys, Sharon Nahari and Shay Shorer, emailed a statement to CyberScoop saying their client “has no connection to this matter and has had no involvement in it whatsoever.”

“Mr. Sheetrit is a businessman with extensive expertise and professional experience in cybersecurity and technology,” wrote Nahari and Shorer. “In the course of his work, he provides professional advisory services to a range of clients. Working in cybersecurity, possessing specialist expertise or providing advisory services cannot, in themselves, establish complicity in or involvement in the alleged conduct.”

“Our client maintains his complete innocence and, like everyone else, is entitled to the presumption of innocence,” the statement continued. “We are confident that, once the facts have been established and the evidence fully examined, it will become clear that there is no basis for holding him criminally responsible.”

UPDATE: Nov. 6, 2026; 8:25 p.m.: This story has been updated to include a statement from attorneys representing Guy Sheetrit.

The post Authorities accuse trio of using AI deepfakes to defraud $129M from businesses appeared first on CyberScoop.

The FBI and French authorities have arrested an individual and seized a pair of websites that were used to disseminate child sexual exploitation material, including AI generated deepfake media, according to court documents.

The websites, NudeLeaksTeens and NLTVIDS, were seized and shut down by the FBI this week. According to the Department of Justice, the cybercrime division of the French Paris Prosecutor’s Office has also arrested an unnamed 25-year-old French resident suspected of being the primary administrator for the sites.

According to a seizure warrant filed Oct. 2 in the Eastern District of Virginia by Arlington County police detective and FBI cybercrime task force member John Bamford, law enforcement first became aware of the websites in 2024, which advertised hacked, leaked and stolen CSAM of young girls.

The seizure warrant identifies VeriSign, a Reston, Virginia-based U.S. domain registry, as being the registry operator for .com, and directs Verisign to redirect the .com domain names identified in the warrant to FBI-designated name servers. David McGuire, a spokesperson for VeriSign told CyberScoop that the company executed its responsibilities under the warrant and has no relationship to the websites or administrators.

Together the sites offered “a wide range of explicit content including CSAM and content that violates the TAKE IT DOWN Act, which prohibits the non-consensual sharing of intimate images,” Bamford wrote.

The TAKE IT DOWN Act, passed last year, makes it a crime to create or share nonconsensual “intimate” deepfake media of real people. The law also gives the Federal Trade Commission authority to enforce it and allows courts to order websites to remove such content.

The sites posted explicit disclaimers disavowing child pornography while simultaneously advertising and selling CSAM. At least one had its own form of currency used to buy images and videos individually or bundles organized by victim. One collection, containing 189GB of material on 315 different girls, sold for $64.90.

Some of the material came from victims’ social media accounts on Snapchat, TikTok, Instagram and Facebook, either recorded directly or stolen from their accounts. Several victims who appear on the site reported to law enforcement that their accounts were hacked.

Some of the advertised collections were compiled by individuals now serving prison sentences for their crimes. One individual, Andrew Venegas, pled guilty in a Texas federal court to sexual exploitation of children and receipt of CSAM as was sentenced to 30 years in prison in April 2026.

“In the investigation and prosecution of Venegas, law enforcement learned that Venegas obtained sexually explicit images and videos of his victims in various ways, including extortion and the unauthorized accessing of victim social media accounts,” wrote Bamford.

A separate collection available for sale on one of the sites in 2022 and 2023 was named after an individual, Reuben Oswaldo Yeverino Rosales, who was convicted and sentenced to more than 34 years in prison in 2022 for sexual exploitation of children and cyber stalking.

The websites put up disclaimers stating that they do not host or store any files or images on their servers, but rather link to “other non-affiliated sites” that do. Administrators would often encourage payments in cryptocurrency and urge individuals to reach out to them personally for some material, rather than posting them on the site.

10/08/2026: This story was updated with comment from VeriSign.

The post FBI, French authorities seize deepfake CSAM-for-sale websites  appeared first on CyberScoop.

A class action lawsuit filed by victims of child sexual abuse material (CSAM) accuses xAI of training Grok’s synthetic deepfake “nudify” capabilities on real images and videos of child abuse.

The lawsuit, filed Wednesday in the U.S. District Court for the Northern District of California, names Jane Doe 1 and other anonymous individuals as plaintiffs, calling Doe “an identified victim of child pornography tracked by the Federal Bureau of Investigation’s Child Exploitation Notification Program.”

Doe was a pre-school aged child when her perpetrator’s abuse began and continued for years, for the explicit purpose of making CSAM material to distribute online. Media depicting the victim has circulated online since at least the early 2000’s, with, according to the lawsuit “hundreds of thousands of files” being included in law enforcement submissions to the National Center for Missing & Exploited Children (NCMEC).

As part of the FBI’s program, she still receives updates when images related to her abuse surface online, and the suit alleges her material has “well known hash-values” that have shown up in deepfakes created with Grok and spread on X.

“CSAM depicting Plaintiff has been found on xAI as part of investigative reporting, takedown request efforts, and criminal investigations, arrests, and convictions for violations of state and federal laws,” the lawsuit states. It also claims “xAI, using Grok, has generated images depicting Plaintiff and the child pornography series in which she is the victim.”

The lawsuit cites “Masha’s Law” as the basis for its allegations. That law, passed in 2018,  protects civil legal remedies to victims of child pornography and online exploitation.

According to an analysis by the Center for Countering Digital Hate, during an 11-day period between Dec. 2025 and Jan. 2026, Grok created more than 3 million sexualized images, at least 23,000 of which appeared to depict children.

On Jan. 14, after the period tracked by the center, Musk wrote on X that he was “not aware of any naked underage images of Grok. Literally zero.” Must also implied that users, not his technology, were primarily responsible for images created using Grok while simultaneously claiming the model “will refuse to produce anything illegal” if asked.

The suit claims that while other competitors enacted guardrails to prevent their AI models from generating “nudified” images of adults and children, xAI “did the opposite,” embedding Grok and it’s deepfake capabilities directly into X, effectively creating an instantaneous CSAM generation and distribution system for the internet.

While xAI said it built in guardrails to prevent Grok from creating deepfake sexualized images, the suit notes that they are “very weak,” diverge from standard industry best practice and can be easily circumvented.

The system rejects prompt prompts where the chatbot detects “clear intent by the user in the phrasing of their request,” the complaint stated. “Indirect or euphemistic prompts can easily slip past a text-based filter, so if the model retains the underlying capability to generate sexual or abusive content, some volume of CSAM becomes effectively inevitably generated by the system.”

The lawsuit also notes that Grok’s terms of service treat anything that gets posted on X as training material, meaning any CSAM material posted on the site over the past year was likely ingested by the model.

The alleged victims are asking for monetary damages along with injunctions to prevent Grok from creating additional harm through future sexualized deepfakes or CSAM. The suit lists “thousands” of members in the class, all with similar claims against xAI.

A request for comment on the lawsuit sent to xAI was not returned.

Grok’s nudification capabilities, and xAI owner Elon Musk’s dismissive public attitude around the fallout have led to international outrage, criminal investigations and a wave of private lawsuits against the company.

Another lawsuit against X filed earlier this year claims that a man used Grok to generate thousands of instances deepfake CSAM material of his stepdaughter. That lawsuit also claims xAI withheld information from law enforcement authorities that would have helped them identify the stepfather as the perpetrator. Days after authorities traced and seized the material on the wte, he committed suicide.

In July, Musk sued Minnesota Attorney General Keith Ellison over a new state law that bans nudification technology and impose a $500,000 fine for each instance where an AI tool is used to generate or alter an image in a sexually explicit way. Musk’s lawsuit claims the ban violates the First Amendment.

The post Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities appeared first on CyberScoop.

Like seemingly everything else these days, artificial intelligence will re-shape the way voters gather information on candidates running in the 2026 midterm elections.

In some ways, this is already the reality. Voters are increasingly turning to AI chatbots for information instead of Google.  Political campaigns are deploying deepfakes of their opponents. And AI systems have been developed to carry out increasingly complex  hacks.

Since the last major U.S. election in 2024, major tech companies have  embedded AI into their products while hundreds of millions of people have adopted the tools, either by purchasing subscriptions to commercial models or using open-source models. Yet both research and experts state that while AI systems have gotten better at handling basic facts, they’re nowhere near reliable enough to be a main source of  accurate or complete information. 

While chatbots are becoming a primary way that voters gather information on  local races, candidates, issues, and voting information, they are not substitutes for more authoritative sources, like a voter’s state or local election office. 

“I think this is one of the first elections we’re seeing…where AI is just everywhere,” said Thania Sanchez, senior vice president of research and analytics at the nonprofit States United Democracy Center. “Even if you just Google it, [now] the first thing that comes up is the AI overview.”

While AI companies have worked to cut down on errors in their model’s responses for questions around basic election information, they continue to fall short in important ways.

In new research shared exclusively with CyberScoop ahead of its release, States United Democracy Center tested two of the most popular tools — OpenAI’s ChatGPT’s free tier and the AI interface used alongside Google Search — for their performance on a series of basic questions around elections, such as how to register to vote, or a list of candidates in a race.

The models were chosen because they are free and easy to access. For Google AI, the nonprofit tested two types of accounts: ones running in Incognito Mode and ones that had a history of browsing election-skeptical websites.

The nonprofit ran two rounds of testing in 2025 and 2026, collecting nearly one thousand responses from the models submitted by users across six swing states (Arizona, Michigan, North Carolina, Nevada, Pennsylvania and Wisconsin).

In 2025 tests, 6.9% of responses from Google AI and 8.2% responses from ChatGPT“contained verifiable factual errors,” like not listing the correct candidates in a race or false guidance around polling site locations.

However, follow up tests in 2026 across Arizona, Pennsylvania and Michigan found that the error rates in both models had dropped to zero. The study notes that “this is real progress and should be acknowledged.”

But underneath those topline numbers, a more murky picture emerges around the tools’  reliability.

An AI response can sound accurate without actually being complete.  To wit: ChatGPT provided incomplete lists of current gubernatorial primary race candidates 88.9% of the time when queried.

Linking to a state election website – an output the study considers the single most important measure of voter utility  — happened less than 40% of the time. Whether due to formatting issues or the model ingesting outdated information, it’s a problem if voters use them as their primary information source for elections.

“It will be like ‘this person is the Republican candidate and this person is the Democratic candidate’ but it is not telling you there’s also these other third-party candidates,” said Sanchez. “It’s not giving you complete information, so the voter thinks these are the [only] two people running.”

A June survey from the Pew Research Center found that about half of U.S. adults reported having used chatbots at least once, up from a third in 2024, while a quarter reported using them daily. The top use case listed for engaging with the chatbot was searching for information.

Isabel Linzer, an elections policy analyst at the Center for Democracy and Technology, told CyberScoop that voters, campaigns and governments alike are using AI more freely and with fewer restrictions.

Bad actors in the information space have followed suit, and “we are in a phase now of generative engine optimization” where information operations are structured to rank higher in AI model responses.

“We’ve moved beyond [SEO] to [Generative Engine Optimization], and that’s where we’re seeing campaigns thinking about how to structure their materials to make sure that they are in a format that AI models want to use when they’re searching the web…to develop their responses to user queries,” she said.

There is also the underlying problem of frontier AI companies constantly tinkering with their models, their algorithms and the technologies they are intertwined with. . Election officials, by contrast, have decades of experience educating voters about their options.

A prime example of this churn occurred this past February, in between the first and second round of the study, when Google AI suddenly shifted to providing only links for election related queries in incognito mode, replacing the written summaries that showed up in the first round.

Like the study’s authors, Linzer said most people are still best served by going directly to local sources for accurate information on elections. With issues like ideological bias, the potential for bespoke or sycophantic answers for each user based on their prior chat histories and lack of predictability, voters should still be very careful about using AI chatbots as political truth machines.

The best thing that tech companies can do to educate voters is “making sure that for high-stakes situations like elections, that chats are connecting directly to the most important sources, like the website where you can actually register to vote,” said Linzer.

The post AI is getting better at election facts, but voters shouldn’t rely on it appeared first on CyberScoop.

Two new parties have been added to a class-action lawsuit against X.ai over its Grok tool including teenagers and children who say it was used by family members or other people they know to create nonconsensual deepfake child sexual assault material (CSAM).

The lawsuit, originally filed in March by three women, was amended this week to include two additional plaintiffs, Jane Does 4 and 5, who say that Grok was used to make the illegal content based on their real photos and videos.

All five of the women in the lawsuit are anonymous, and the complaint said the spread of the material had left them humiliated and ashamed.

Jane Doe 4, a female from Wyoming, said her stepfather uploaded a photo of her when she was 11 and lying on a couch to his phone. Using Grok, the stepfather created more than 7,000 CSAM-related images of her. He also shared and traded the images with others on social media platforms.

The lawsuit alleges that the stepfather opted for Grok “because the platform was less restrictive than other AI models and responded to his prompts to generate sexually explicit material using an image depicting a prepubescent minor.”

It also claims that in February, xAI did generate a tip to the National Center for Missing and Exploited Children regarding the images, but the company only submitted the original, authentic image as evidence. According to the suit, xAI did not respond when law enforcement requested the thousands of Grok-generated images based on the photo and IP address information that would have quickly helped identify her stepfather as the perpetrator.

The lawsuit states that the stepfather shot himself two days after he was arrested and charged with child exploitation crimes. His suicide added to the “extreme personal crisis” brought on by the images created through Grok. She regularly “struggles with self-loathing and disgust” as well as “extreme anxiety” at the thought that the images will be found by others online and suffer from depression, including excessive sleep and suicidal ideation when awake.

Jane Doe 5 claimed that an adult male related to one of her classmates used Grok to convert a photograph from her eighth-grade graduation into illicit material. The images were also traded and shared with others online. While the man was arrested and charged, much of the content is still available on the internet. As a result, she “feels a complete lack of control over the ongoing dissemination of the files.”

“It is impossible to know how many other child sex predators may now possess Jane Doe 5’s CSAM, nor how widely her CSAM has now been disseminated online through darknet channels and applications,” the complaint said.

The press office for xAI did not respond to an emailed request for comment from CyberScoop.

The lawsuit also adds Stability AI as a defendant, alleging the company released Stable Diffusion 1.0 as an open-weight model despite knowing it was trained on CSAM and has declined to alter or modify its guardrails in response.

According to a 2023 Stanford study, the underlying dataset used to train Stable Diffusion models was created through unguided webcrawling of internet content. That means it ingested “a significant amount of explicit material,” including CSAM. Stable Diffusion 1.0 had a classifier meant to block the generation of such images, but because of that training data, downstream developers could more easily exploit the model and create modified versions that bypass those protections.

While Stable Diffusion 2.0 introduced stronger guardrails, the lawsuit claims Stability AI rolled back those protections in response to “disgruntled” users that the new restrictions were “prude” and “unpopular.” That in turn has fed an ecosystem of jailbroken “nudify apps” based on Stability AI’s models.

“Stability AI knew that its models, once capable of generating sexually explicit images, would foreseeably be used to generate CSAM unless appropriate model-level safeguards were implemented,” the complaint said.

Stability AI did not respond to a request for comment from CyberScoop.

The post Deepfake CSAM lawsuit against xAI, Grok expands appeared first on CyberScoop.