A Chinese-speaking hacker used AI agents built on DeepSeek, Kimi and an older Claude model to attack as many as 100 organisations over five days in September, according to Gambit Security, which found the attacker's exposed server holding details of at least 618,000 credit cards. The operation reportedly cost $8,000 in total; Anthropic says it banned the account.
With a federal court's authorisation, Microsoft's Digital Crimes Unit seized 50 websites and disabled more than 150 domains behind EvilTokens, a subscription phishing service whose AI combed hijacked inboxes for payment conversations. Microsoft estimates it compromised more than 12,000 inboxes across 10,000 organisations; British police arrested two men in connection with the service, and Coinbase traced about $1.1 million in revenue to it.
A Derbyshire Police officer used Microsoft Copilot to draft a victim personal statement, telling it the 'goal is to reach the highest sentence' and to 'make a judge or reader weep', the Court of Appeal heard. Judges called the AI use deplorable but said it did not appear to lengthen the sentence and rejected the defendant's appeal; a criminal investigation into the officer continues.
Brazil's electoral court president, Kassio Nunes Marques, ordered presidential candidate Flávio Bolsonaro to remove within 24 hours an AI-made Instagram video casting Lula's son as a fugitive over alleged INSS embezzlement. Ruling on a complaint from the PT, PCdoB and PV federation, he held that the video's AI disclosure does not exempt it from the deepfake ban; the injunction goes to the full court.
Who did it: HUMAN Australian Broadcasting Corporation
William Hamish Yeates, 20, the first person in Australia charged under 2024 federal deepfake laws, faced a pre-sentence hearing in South Australia's District Court after pleading guilty to two counts of creating or altering sexual material without consent. He made and shared explicit deepfakes of a teenage girl between October 2024 and February 2025; prosecutors seek imprisonment, and sentencing is due in October.
Fraudsters in Volos recorded a 60-year-old man's voice during a wrong-number call, then used AI to clone it and convince his 29-year-old son to admit a fake power-company repair crew, according to local reports. A woman entered while two accomplices waited nearby; cash, jewellery and family heirlooms reportedly worth over €50,000 were taken, and authorities plan to use video footage.
Southern Metropolis Daily reporters bought nearly 500 'modern character' images for AI short dramas for 19.8 yuan on a second-hand platform; the seller claimed no copyright limits but said the faces were AI-'fused' from ordinary people's photos gathered on overseas social platforms, including livestream screenshots, refined with ChatGPT and Grok prompts. The paper reported the material to the platform and authorities.
China's Cyberspace Administration is investigating DeepSeek and Moonshot over possible leaks of sensitive Chinese data, including data linked to the state, police and military, to Anthropic's Claude, The Information reports, after Anthropic alleged the two firms passed such data to its model. Regulators also reportedly summoned Alibaba, Zhipu, SenseTime, MiniMax and Xiaomi; no findings have been reported.
A Busan court gave a suspended six-month prison sentence and 80 hours of community service to a candidate who twice stole spare papers for an official English test, photographed them, fed them to Google's Gemini and wrote its answers on their palm before sitting the exam. Convicted of theft and obstruction of business, the would-be tax accountant had not reached the required score of 65.
The US Court of International Trade gave Zhejiang Dingli Machinery 14 days to substantiate its brief's uncited claim that Commerce made factual findings in a Canadian antidumping probe of Turkish rebar, statements the judge called so outlandish as to appear hallucinated 'by a human being or by artificial intelligence'. Otherwise it must show cause against sanctions and say who, or what, wrote them.
