Issue #198 | November 2026, Week 2

U.S. Charges Three Over $129 Million AI-Enabled Corporate Fraud Scheme

Jurisdiction

United States

Threat Actor

Individual

Incriminated Activity

AI-enabled impersonation

Estimated Damage

$129 million

Enforcement Action

Criminal charges

Case Status

Charged; extradition proceedings pending

U.S. federal prosecutors have charged three foreign nationals over an alleged global fraud operation that used artificial intelligence to impersonate corporate executives and lawyers and steal approximately $129 million from companies.

Jacob Soall, Sharon Hazan and Guy Sheetrit allegedly used AI-generated voices and images to pose as chief executives between 2024 and 2026. The U.S. Department of Justice says employees were contacted about supposedly confidential financial transactions before being referred to individuals posing as lawyers from major international law firms. Those identities were also allegedly reproduced using AI technology.

The scheme targeted organizations across several industries. Identified victims included hospital systems in Missouri and California, a Rhode Island bank, a UK financial technology company, a Massachusetts mutual fund company and a Florida pet food company. Employees were persuaded to send large transfers to accounts controlled by the group, with some of the proceeds allegedly routed internationally and converted into cryptocurrency to obscure their origin.

Authorities arrested Soall and Hazan in Spain and Sheetrit in the United Kingdom. The United States is seeking their extradition. Charges include conspiracy to commit wire fraud, wire fraud, aggravated identity theft and money laundering offenses. The allegations have not been proven in court, and all three defendants are presumed innocent unless convicted.

Ukraine Dismantles €4.3 Million Cryptocurrency Investment Scam Network

Jurisdiction

Ukraine / Germany

Threat Actor

Individual

Incriminated Activity

Cryptocurrency investment fraud

Estimated Damage

€4.3 million

Enforcement Action

Suspects arrested

Case Status

Pre-trial detention and house arrest

Ukrainian authorities have dismantled a network of fraudulent call centers accused of stealing more than €4.3 million through fake cryptocurrency and financial investment schemes. Four suspected members of the organization, including its alleged organizer, have been arrested.

Operating as supposed brokers and financial advisers, members of the network reportedly contacted potential investors using IP telephony and messaging applications. According to Ukraine's Cyber Police, social-engineering techniques were used to direct victims toward fraudulent trading platforms offering investments in cryptocurrencies, shares and other financial instruments. At least 135 victims have been identified in Germany.

Once trust had been established, victims were allegedly assisted in creating cryptocurrency exchange accounts and instructed to transfer digital assets to wallets controlled by the organization. Some members of the group are also accused of obtaining access to victims' online banking. The proceeds were then routed through bank accounts, cryptocurrency exchanges and intermediary wallets.

The case forms part of Operation Trade, a joint Ukrainian-German law enforcement effort. Police conducted 56 searches during two stages of the operation in August and September, recovering more than $90,000 and nearly UAH 600,000 in cash as well as hardware cryptocurrency wallets, computers and phones.

Four suspects remain in pre-trial detention and another alleged co-organizer has been placed under house arrest. Five people have been formally notified of suspicion of fraud and participation in a criminal organization. They could face prison sentences of up to 12 years and confiscation of property if convicted.

Canada Disrupts Nearly 11,000 Cybercrime Operations in Nationwide Crackdown

Jurisdiction

Canada

Threat Actor

Individual

Incriminated Activity

Online fraud

Estimated Damage

C$14.8 million

Enforcement Action

10,987 disruption actions

Case Status

Ongoing investigation

Canadian law enforcement and private-sector organizations carried out 10,987 disruptive actions against infrastructure associated with cybercrime and online fraud during the nationwide Maple Disruption 2.0 campaign.

More than 50 organizations participated in the initiative, which ran from November 2 to 6, 2026. Led by the Royal Canadian Mounted Police's National Cybercrime Coordination Centre and the Canadian Anti-Fraud Centre, the campaign brought together police agencies, financial institutions, telecommunications providers, technology companies, cryptocurrency businesses and cybersecurity organizations.

Rather than concentrating exclusively on arrests, participants targeted the infrastructure that allows fraud operations to function. Fraudulent email accounts and telephone numbers were disabled, malicious websites and URLs were removed or blocked, suspicious financial transactions were stopped and cryptocurrency addresses associated with fraud were blocklisted.

During the five-day campaign, authorities received and acted on 4,264 fraud reports representing approximately C$14.8 million in reported losses. More than C$1.06 million was successfully recovered.

The Ontario Provincial Police, Competition Bureau Canada and FINTRAC were among the public-sector participants. The RCMP described the strategy as a way to prevent further victimization by depriving criminals of the communications, financial and technical infrastructure required to conduct their operations.

U.S. Files Forfeiture Action Against $456,602 in Alleged Romance Scam Proceeds

Jurisdiction

United States

Threat Actor

Individual

Incriminated Activity

Romance fraud

Estimated Damage

$456,602

Enforcement Action

Civil forfeiture action filed

Case Status

Ongoing investigation

U.S. federal prosecutors are seeking the forfeiture of $456,602 in cryptocurrency allegedly obtained through online romance and investment scams targeting victims in Massachusetts and elsewhere.

A civil forfeiture complaint filed on November 9 targets 456,602 USDT, commonly known as Tether. The U.S. Attorney's Office for the District of Massachusetts says the cryptocurrency was traced to schemes in which fraudsters approached victims through dating websites and Facebook before developing online relationships with them.

After gaining their trust, the scammers allegedly introduced victims to purported cryptocurrency investment opportunities. Fake trading platforms were used to create the appearance that deposited funds were generating returns. Victims who attempted to withdraw their supposed profits were instead told that additional payments were necessary to cover taxes or fees.

Financial tracing eventually led authorities to two cryptocurrency wallets containing proceeds allegedly associated with the schemes. Court documents state that Tether froze the wallets at the request of law enforcement. Federal authorities subsequently obtained seizure warrants after establishing probable cause that the assets were traceable to wire fraud and involved in money laundering.

The government must now establish its claim to the cryptocurrency through the civil forfeiture process. Other parties may submit claims to the assets before a court determines whether they can be permanently forfeited to the United States and potentially returned to victims. The allegations in the forfeiture complaint have not yet been proven.

Israel Arrests Five in NIS 16 Million Cryptocurrency Investigation

Jurisdiction

Israel

Threat Actor

Individual

Incriminated Activity

Unauthorized crypto trading

Estimated Damage

NIS 16 million

Enforcement Action

Five arrests

Case Status

Ongoing investigation

Israeli police have arrested five people suspected of operating an unauthorized cryptocurrency trading network that handled transactions worth approximately NIS 16 million.

The arrests were carried out on November 10 by the National Unit for Combating Economic Crime within Lahav 433. Israeli police information cited by local media indicates that the suspects performed different roles in an operation that used a WhatsApp group to arrange cryptocurrency exchanges, some involving hundreds of thousands of shekels.

Authorities believe the activity was conducted without the necessary authorization and was not properly reported to tax authorities. Part of the inquiry concerns methods allegedly used to conceal the source and nature of funds passing through the network.

One suspected method involved moving cryptocurrency proceeds into conventional bank accounts while presenting the transfers as loans. Loan agreements were reportedly prepared to give the transactions an apparently legitimate explanation.

Searches of the suspects' homes resulted in the seizure of cryptocurrency wallets, computers and tens of thousands of shekels in cash. The five were questioned on suspicion of offenses including money laundering, unauthorized provision of financial asset services and obtaining property by fraud. The case remains active, with police expecting to question additional individuals.