TRM Labs is publishing structured analysis of AI adoption inside cybercrime and ransomware cash-out. Public baselines for volume and loss are coming from the FBI, INTERPOL, and Europol rather than from vendor ROI slides.
Write them down: a wire to a new beneficiary, an MFA reset, a vendor bank-detail change. For each, name the channel that currently authorizes it, and name one channel the attacker cannot occupy at the same time. If the answer is the CFO on a video call, or a voice call to the help desk, that path belongs in the same risk class as an unsigned email wire request did a decade ago.
AI-enabled crime is ordinary criminal tradecraft that uses machine-generated text, speech, images, video, code, or targeting data to raise hit rates or cut the skill needed to run the attack. It is not one offense. It cuts across investment fraud, business email compromise, romance scams, ransomware, employment scams, and forged identity documents.
What counts as AI-enabled crime
Ask whether “AI malware” is being used as a reason to replace EDR, or as a reason to measure detection on new variants.
The control points are narrow: whether the media is authentic, whether the request is authorized on a second channel the attacker cannot occupy, and whether a high-value transfer can complete on the strength of a meeting alone.
Detection without a payment hold still loses the wire. A strong KYC check does not stop an employee who believes the CFO is on the call.
In 2025 the FBI’s Internet Crime Complaint Center recorded 22,364 complaints that referenced artificial intelligence, with reported losses of nearly 3 million. That was the first dedicated AI section in nearly 25 years of IC3 reporting, inside a year when Americans reported nearly billion in internet crime losses overall (FBI). The AI total is a floor. It counts only what victims noticed and reported as AI-related.
How the attacks actually run
Skip a branded “AI crime program.” Map the three highest-value actions that still treat a call, a video meeting, or a well-written email as proof of identity.
Cash-out still runs through wires, mules, and cryptocurrency, which is why tracing on the money side belongs in the same incident as the deepfake lure. The case that still shows up in board packs is Arup in January 2024. A Hong Kong employee joined what appeared to be a video call with senior colleagues, including a deepfake of the CFO, and authorized 15 transfers totaling about .6 million (CNN). Nothing in that attack broke encryption. It broke a human who believed the people on the call were real.
Outputs are what victims see. A fluent email from “finance.” A meeting full of apparent executives. A job-interview avatar. A celebrity selling a crypto product. Malware that looks less handmade.
Law enforcement outside the United States is measuring share, not just anecdotes. INTERPOL’s 2026 Africa assessment tied AI to more than half of reported cybercrime, citing speed, scale, and detection difficulty, against more than 1.1 billion mobile subscribers recorded in 2025.
Video-conference impersonation has already produced eight-figure corporate losses. INTERPOL said in 2026 that artificial intelligence was enabling 55 percent of reported cybercrimes across Africa. That is why this sits on the CISO and CFO agenda now.
Specialist identity and liveness vendors occupy KYC and contact-center traffic, where synthetic IDs and cloned voices hit onboarding and password reset. The buying question is whether a product scores a file after the fact or interrupts a live session before money or access moves.
What is already in production, and what is not
Synthesis models operate on compressed audiovisual streams. Artifacts that are obvious on a studio monitor disappear on a laptop call. The Arup pattern combined multi-person presence, urgency, and a finance employee already primed by a message. Dual control that still lives inside the same call, with a second synthetic participant agreeing, does not close the gap.
Microsoft’s identity and email security stack is still where many enterprises catch the first lure, because BEC and vishing often start as a mailbox or Teams message. OpenAI and Google sit on a different layer: abuse reporting, rate limits, and refusals on impersonation and cybercrime prompts. Those controls leak. Operators use uncensored local models and stolen API keys. Provider-side limits change the average case more than the determined one.
Most organizations cannot. The FBI’s nearly 3 million is an undercount of complaints that mentioned AI. If internal records only say “BEC” or “vishing,” funding will follow the old label, not the failed control.
Emerging over the next 12 to 24 months is AI-assisted malware development, and voice phishing aimed at taking over single sign-on. TRM Labs’ ransomware finding cuts against a common story. AI is collapsing the skill and time needed to build and run an intrusion, but TRM reported that total ransom payments were roughly flat-to-down in 2025 even as the number of variants rose. The method is changing faster than the payouts.
Two mix-ups are common. The first is treating AI as an autonomous attacker that independently picks victims. Most cases still have a human operator choosing targets, moving money, and handling cash-out. The second is using “deepfake” as a synonym for all AI crime. Deepfakes, synthetic audio or video that impersonates a real person, are one high-impact subset. LLM-written lures, fake identity documents, cloned websites, and AI-assisted malware sit in the same family without always involving a fabricated face.
Questions to ask before treating this as ordinary phishing
Will a video call still count as identity verification for a high-value transfer?
Defensive activity is lining up along the same pipeline as the crime.
Then put treasury and the SOC on one question: in the last 12 months, which incidents involved retained audio or video, and would the payment still have gone out if the meeting had been treated as untrusted.
Ask the SOC how quickly a new packer or lure kit from the last quarter was covered, and whether success is still scored mainly on known ransomware names.
The human failure is often identical: someone approved a transfer. Evidence of AI lives in the media, cloned audio, meeting recordings, synthetic ID images. If those artifacts are not retained, attribution is guesswork. Look for an incident taxonomy that captures lure medium (email, voice, video, KYC image), whether media was kept, and whether a second factor independent of that medium existed.
How will incidents be labeled when AI was involved?
One approach is media authentication: detecting synthetic audio and video, or attaching provenance to real recordings. Another is identity proofing at onboarding and at high-risk actions, including liveness checks that a replayed video should fail. A third is process redesign in finance and IT so that no single channel can both request and approve money or access. A fourth is financial-crime intelligence on cash-out, especially cryptocurrency.
Speculative: crime agents that select victims, negotiate ransoms, and cash out with no human in the loop. Treat conference demos as demos.
Inputs are public and stolen material. Earnings-call audio, LinkedIn photos, voicemail, names from a compromised mailbox, and open-source code all feed models. A short voice sample can support a clone that survives a phone call. A handful of stills can support a talking-head video that holds up on a compressed conference link.
Does AI-written malware change what endpoint detection is for?
A grounded answer is that AI changes the volume and polish of commodity tooling more than it creates a new undetectable payload class. Treat it as faster variant production. TRM’s 2026 index argued that AI is altering how ransomware is built and run without yet rewriting payment totals. More variants mean more hash diversity. Behavior-based detection, identity telemetry, and backup integrity matter more than counting named families.
Evaluate payment policies that require a pre-registered callback to a known number, dual approval inside the treasury system, and holds on new beneficiaries. Check whether those controls fire even when the request appears to come from the CFO on camera.
The mechanism is a pipeline.
Who is allowed to publish executive voice and video?
From the criminal’s side, the job these tools do is conversion. Traditional BEC failed when grammar, timing, or a mismatched voice gave the scheme away. Generative models reduce those tells and raise volume: more lures, more languages, more personalized pretext, without a matching increase in headcount.
Current, meaning visible in 2025 and 2026 caseloads: AI is an official U.S. internet-crime reporting category. The FBI described fake social profiles, voice clones, forged identification, and videos of public figures, and placed AI-related complaints among the costlier subsets of a nearly billion year. Phishing still leads complaint volume. AI is raising the quality of those lures rather than replacing the category.
Europol titled its 2026 Internet Organised Crime Threat Assessment around encryption, proxies, and AI expanding cybercrime together. AI improves the lure and the tooling. Proxies and encryption still hide the operator.
Who is building the response
Ask whether tickets, insurance notices, and board metrics can separate AI-assisted cases from conventional social engineering.
The organization should ask whether a live-looking conference is still accepted as proof that a senior officer authorized money movement.
Ask which high-value voices are treated as public training data.
Generative AI is raising success rates on fraud, impersonation, and intrusion by making those attacks cheaper and harder to dismiss as fake. The FBI now tracks AI-linked internet crime as its own category.
A useful answer is no, not by itself. A video meeting is now an untrusted channel for payment authorization, the way email became untrusted for wire instructions after BEC matured.
Public executive audio and video are now source material for clones. Earnings calls, all-hands recordings, and high-resolution headshots are exactly the samples models want. Voice and face models improve with clean, multi-sentence, multi-angle audio and video. Marketing and investor-relations teams are rewarded for producing those samples.
A one-hour next step
A phishing email written by a large language model is still phishing. A ransomware affiliate that uses a coding assistant to debug an encryptor is still running ransomware. The production function changed. Content that once needed a native speaker, a designer, or a malware author can be generated, iterated, and localized in minutes.
Inventory CFO, CEO, treasury, and help-desk voices. Restrict unpublished internal recordings where that is practical. This does not stop a determined clone. It raises the cost.
Process depends on the crime. For social engineering, an operator drafts a pretext with an LLM, then uses voice or video synthesis at the moment of pressure, often after email or chat has already set context. For document fraud, image models produce passports, bills, or selfies that pass a weak KYC check if liveness detection is thin. For intrusion, coding assistants help write loaders, obfuscate scripts, and generate kits. TRM Labs described AI entering ransomware at three stages in its 2026 AI-in-Crime Adoption Index: how attacks are built, how they are executed, and how proceeds are cashed out.
