How Did AI Send 1M Scams in 3 Days? 7 Brutal Security Stories Making Headlines This Week

Microsoft researchers tracked a phishing campaign in which an unknown threat actor used AI to send over 1 million highly personalized fraud emails in less than three days, targeting payroll and accounts payable departments at companies worldwide with fake ServiceNow invoices demanding payment for overdue bills, according to Dark Reading. The AI-drafted messages were personalized with the actual names and roles of target employees and details about each company's management, and appeared as part of a threaded conversation with other company representatives. The campaign was reported alongside other security incidents this week, including the compromise of iTorrents.org and the takedown of the DDoS site NightmareStresser.

There are two rules when it comes to cybersecurity news. First, there’s always something to talk about. Second, those things are often so irritating that you just want to go back to bed. Take this week, for example, when we reported on three different campaigns that compromised legitimate, trusted names to spread malware. Perhaps the biggest was that an HBO Max Reddit account was hijacked https://uk.pcmag.com/security/167322/hbo-maxs-reddit-account-was-hijacked-to-spread-malware and began directing users to an app that was actually infostealer malware in disguise. Hot on the heels of that attack were the Iranian-affiliated hackers who used known security brands https://uk.pcmag.com/reviews/817/norton-antivirus-plus like Norton https://uk.pcmag.com/reviews/817/norton-antivirus-plus and KeePass to trick users into installing spyware https://uk.pcmag.com/antivirus/103700/viruses-malware-and-spyware-whats-more-dangerous . In this case, you may not need to worry about it as much, since the campaign is designed to target political dissidents, journalists, and activists opposed to the Iranian government. Even so, targeted malware attacks usually don’t stay targeted for long. For example, cybersecurity company Kaspersky published a warning this week https://uk.pcmag.com/security/167377/itorrentsorg-compromised-to-spread-windows-malware-kaspersky-says that iTorrents.org http://iTorrents.org , a public torrent repository, had been hijacked and was instead spreading malware, including a malware-laden version of Christopher Nolan’s The Odyssey that we mentioned a few weeks ago https://uk.pcmag.com/security/166845/gta-6-leaks-the-odyssey-malware-and-water-grid-attacks-this-week-in-cybersecurity . As of right now, the site remains compromised. It’s not all bad news, though. I love sharing security-related wins when we find them, and this week we reported on law enforcement taking down one of the web’s most long-running DDoS sites https://uk.pcmag.com/security/167364/us-takes-down-long-running-ddos-site-nightmarestresser . The site, NightmareStresser, posed as a legitimate tool that allowed users to stress test websites for reliability, but of course, for a modest fee, you could stress test hard enough to disrupt a site that didn’t belong to you, and that was the primary business model. Similarly, this week Bastille Networks, a security startup specializing in wireless intrusion detection, announced it had developed tools to detect nearby smart glasses https://uk.pcmag.com/smart-glasses/167265/worried-about-snooping-smart-glasses-this-startups-tech-detects-nearby-specs , specifically for businesses and government agencies that want to keep them out of sensitive areas. Considering the reputation that pervert glasses https://uk.pcmag.com/smart-glasses/166863/pervert-glasses-are-ruining-wearable-tech-the-best-smart-frames-ditch-cameras-entirely have, we can only hope the tech becomes available to consumers soon, too. Now then, let’s take a look at what else is going on in the infosec world this week. Threat Actor Uses AI to Generate 1M Personalized Fraud Emails in 3 Days When we talk about how AI is a hacker’s favorite tool and how it supercharges malware campaigns, this is what we mean. Dark Reading reports https://www.darkreading.com/cyberattacks-data-breaches/1m-personalized-fraud-emails-3-days that researchers at Microsoft tracked a phishing campaign https://uk.pcmag.com/security/156565/how-to-spot-and-avoid-phishing-scams-5-tips-from-our-security-expert in which an unknown threat actor sent over 1 million highly personalized phishing emails in less than three days, targeting payroll and accounts payable departments at companies worldwide with fake ServiceNow invoices and demanding payment for overdue bills. Even worse, because the threat actor used AI to draft the emails, they were often personalized with the actual names and roles of the target employees at the impacted companies, along with information about each company’s management. The emails even looked like they were part of a threaded conversation with other company representatives, making the email look like it was originally addressed to a company leader, who then directed the scammer to contact accounting to have the bill paid. Attacks like this play on the human element of security https://uk.pcmag.com/security/164040/rsac-2026-the-surprising-reason-phishing-still-works-on-everyone , creating a false sense of urgency and authority to encourage overworked, stressed-out employees to just do what the email asks rather than stop to verify its claims. It’s certainly creative, if not scary, and AI is making it easy for scammers to scale up such spear-phishing campaigns https://uk.pcmag.com/security/161986/the-shady-emails-keep-coming-its-time-to-fight-back-against-spear-phishing . Copyright Scammers Get Instagram Accounts Suspended and Demand Payment This isn’t so much a strict security story as it is a warning for anyone with an Instagram account they’d actually like to hold on to, and another example of social media platforms’ lax policy enforcement and overreliance on automated tools for reporting and moderation. Both the BBC https://www.bbc.com/news/articles/cjw54ww73qjo and the Malwarebytes blog https://www.malwarebytes.com/blog/scams/2026/09/copyright-scammers-get-instagram-accounts-suspended-and-demand-payment shared an alarming story about copyright scammers on Instagram weaponizing the platform’s automated reporting tools and “suspend first, verify later” approach to moderation by filing repeated false copyright strikes against accounts, getting them suspended, and then demanding payment via cryptocurrency to have the complaints withdrawn so the owner can get their accounts back. As with any ransom-style attack, there’s no guarantee that paying the ransom will actually get the attacker to withdraw the complaint, and even if they do, there’s no guarantee that Meta, the parent company of Instagram and Facebook and WhatsApp , will restore the account. Malwarebytes reported that similar attacks have been occurring since 2023 https://www.malwarebytes.com/blog/news/2023/03/log-out-king-instagram-scammer-gets-accounts-taken-down-then-charges-to-reinstate-them , and the platform hasn’t found a way to handle them. Meta says it restored the accounts the BBC reported, but let’s be honest: It shouldn’t take a media campaign to get a platform to listen to its users and to fight people who use its own tools to scam others. EFF: Privacy Considerations With AI Tools We’ve discussed before that AI and privacy don’t really go hand in hand https://uk.pcmag.com/ai/166824/your-ai-prompts-arent-private-the-most-and-least-invasive-chatbots-ranked , and we've even tested the most popular chatbots https://uk.pcmag.com/ai/161394/chatgpt-copilot-deepseek-or-gemini-which-ai-chatbot-collects-the-least-of-your-data ourselves to see which ones store the most personal data. Since they’re so widely used, we also have tips to limit what ChatGPT https://uk.pcmag.com/ai/163711/chatgpt-tracks-more-than-you-think-8-ways-to-lock-down-your-privacy and what Google Gemini know https://uk.pcmag.com/ai/164639/protect-privacy-when-using-google-gemini about you. But the folks over at the Electronic Frontier Foundation https://www.eff.org/ published a broad guide to AI privacy https://ssd.eff.org/module/privacy-considerations-with-ai-tools last month that dives much deeper, going into the differences between cloud-based AI and on-device AI, and reminding people that “do not train using my data” is not the same thing as “do not access my data and use it for other things,” which is easy to overlook. Opting out of one method of data handling doesn’t mean you’re successfully keeping your data private, unfortunately. The EFF guide also has specific links to disable AI training for individual tools, including ChatGPT, Gemini, Claude, and others. Additionally, it reminds people to consider how these services would handle law enforcement requests and if that should matter in your use case. Whether you’re an AI skeptic or a regular user, it’s worth bookmarking, if only as a reminder of how these platforms handle your data, from your prompts and queries to everything else they’re capable of collecting about you just based on your usage habits. Ask Our Expert: If Your Phone Is Stolen, Are Your Passkeys at Risk? Do you have a question about online privacy or security? I'm here to help You can submit your question here https://docs.google.com/forms/d/e/1FAIpQLSete4v7pynnSD9ISyZS4VCJiXpCS Sgntvl4mIdxAdKXize1w/viewform , and I may answer it in an upcoming SecurityWatch column and newsletter. If you're not subscribed to the newsletter, head here to sign up https://www.pcmag.com/newsletter manage , and check back each week for the latest updates from PCMag's security team. Now, on to this week's question Sam F asks: “Can using passkeys on a phone be at risk if your unlocked phone is snatched out of your hand?” Hi Sam Thanks for your question. If you’ve been nagged by pop-ups every time you log in to Amazon, PayPal, or even your bank lately to create a passkey https://uk.pcmag.com/password-managers/145064/passwordless-authentication-what-it-is-and-why-you-need-it-asap for the site and stop using passwords usually the messages say “sign in faster next time ” , you’re not alone. On the one hand, passkeys do make signing in to websites and services faster: They create a unique key pair, with the public key on the website to identify you and the private key on your device to verify that it’s really you logging in to your account. The downside is that while you don’t have to remember a passkey and you can store them in a password manager https://uk.pcmag.com/password-managers/4296/the-best-password-managers , they’re susceptible to other kinds of attacks, like cookie hijacking and session stealing. To get to your question, though, if someone snatches your phone out of your hand and it’s unlocked, yes, whoever has your phone probably has your passkeys as well and can use them, assuming you don’t have your password manager or whatever tool you use to store the passkeys set to ask you to authenticate every time you use one. For example, I use Proton Pass https://uk.pcmag.com/password-managers/150533/proton-pass for all of my passwords, and before I can log in to an app or website, I have to authenticate to unlock my vault. Still, just like my vault’s master password and those passkeys, it’s not like the burglar can use them after I’ve changed them or taken steps to disable them. A thief who runs off with my phone may have access to some open sessions before the phone locks itself or before I lock and wipe it remotely, which you should do as soon as possible if your phone gets stolen . But when someone has physical access to your unlocked device, all bets are off, really. That’s not the fault of passkeys any more than it’s the fault of saved passwords or any other security measure that relies on your device to work. So don’t think of it as a limitation of passkeys—just remember that there’s a reason security experts admit there’s only so much you can do if someone has physical control of your device.