يوضح نموذج الصورة الجديد لـ OpenAI السبب وراء تفاقم عمليات الاحتيال المتعلقة بالعملات المشفرة

A crypto founder had his laptop compromised when he joined what appeared to be a Microsoft Teams call with Pierre Kaklamanos, a Cardano Foundation contact he had spoken with before. When “Pierre” reached out about Atrium and sent a Teams invite, nothing looked out of place. On the call, the face and voice matched what he remembered, and two other apparent foundation members were present. When the call lagged and dropped him, a prompt told him his Teams software was out of date and needed reinstalling through Terminal. He ran the command, then shut the laptop off because the battery was dying, which limited the damage in retrospect. He describes himself as “quite technically savvy,” which is part of the point that the attack worked because the context felt legitimate. Social engineers have always relied on familiarity, and executing that at scale once required either a compromised account or weeks of text-based rapport-building. The video call was the authentication layer, the thing victims learned to trust, and replicating it is now within reach. Fake update Microsoft documented campaigns in February and March 2026 in which malicious files masqueraded as workplace apps, such as msteams.exe and zoomworkspace.clientsetup.exe, with phishing lures that mimicked legitimate Teams and Zoom meeting workflows. In a separate warning, Microsoft described “ClickFix”-style prompts targeting macOS users, instructing them to paste commands into Terminal and targeting browser passwords, crypto wallets, cloud credentials, and developer keys. The fake Teams update fits both patterns simultaneously. Google Cloud's Mandiant unit described a crypto-focused intrusion built on the same structure. A compromised Telegram account, a spoofed Zoom meeting, what witnesses described as a deepfake-style executive video , and troubleshooting commands that launched the infection. Mandiant said it could not independently verify which AI model, if any, generated the video, but confirmed the group use