The One-Shot Phishing Attack

About this episode

Welcome back to Fraudology.

I have to tell you I’m genuinely excited about this one. Today’s guest was highly recommended by Matt Vega, someone whose opinion I trust completely in this industry. By the time we finally hit record, we’d already been talking for 45 minutes off air. That’s a pretty good sign this episode is going to deliver.

Cy Khormaee spent years at Google, building out what eventually became the company’s user protection platform and the technology that now runs quietly in the background protecting billions of devices worldwide from phishing and malware. He took that experience and eventually founded Aegis.AI, and he just got back from Black Hat, which means he is walking into this conversation with a front-row view of exactly where adversarial AI is heading next.

What I wasn’t fully prepared for was how far he was willing to take the demonstration. Cy didn’t just tell me adversarial AI is a growing thread, he showed me, live. Using nothing more than ChatGPT and information freely available online. It’s the kind of moment that changes how you think about a threat you thought you already understood.

We cover a lot of ground in this one. And if you work in fraud, trust and safety, or security in any capacity, this is one you’ll want to sit with.

What you’ll hear in this episode:

• Cy's path from Google's user protection platform, home of reCAPTCHA and Safe Browsing, to founding Aegis.AI, and how credential stuffing defense evolved into a hundred-million-dollar business.
• A live ChatGPT phishing demo where Cy used open source intelligence to research himself and generate a convincing, contextualized phishing email and matching fake conference website in minutes.
• Why AI phishing attacks have moved from theoretical to fully operational, with real-world state actor phishing tactics now automatable at near-zero cost.
• The staggering AI phishing email bypass rate statistics: over 50% of emails now slip past existing security email filter bypass controls.
• Why AI red team fraud thinking, treating AI as a gardener to nurture rather than a carpenter to micromanage, changes how fraud and security teams should actually deploy these tools.
• How the real Robinhood phishing attack shows why login fraud detection signals and upstream fraud detection AI matter more than ever.
• Why fraud and cybersecurity convergence isn't optional anymore, and how fraud data sharing across teams closes gaps that adversaries are actively exploiting.
• How automated sandboxing fraud detection can catch attacks before a user ever clicks, and why carding attack prevention and account takeover detection increasingly rely on the same signals as cybersecurity teams.

You should listen to this episode if you:

• Work in fraud, trust and safety, or security and want to understand how adversarial AI is changing social engineering and phishing attacks.
• Are responsible for account takeover detection, credential stuffing detection, or synthetic identity risk at a bank, fintech, or merchant.
• Assumed business email compromise had been mostly solved and need a reality check.
• Are evaluating AI fraud investigation automation tools and want a clearer sense of what can realistically be automated today.
• Are trying to build the case internally for fraud and cybersecurity convergence and fraud data sharing across teams.