AI is moving fast and most people are falling behind. 

The Rundown AI keeps you ahead of the curve. 

It's a free AI newsletter that keeps you up-to-date on the latest AI news, and teaches you how to apply it in just 5 minutes a day.

Plus, complete the quiz after signing up and they’ll recommend the best AI tools, guides, and courses — tailored to your needs.

Sign up to start learning.

Before the file opens, picture two phones ringing on the same afternoon.

The first rings at a corporate help desk. The caller knows the employee’s name, badge format, and IT vendor. He sounds bored, competent, a little rushed.

There’s a problem with your multi-factor, he says. Read me the code so I can clear it.

The employee reads it.

No malware. No exploit. Just a 30-second conversation, and a company most of you have an account with is suddenly wide open.

The second phone rings in a kitchen.

It is a grandson’s voice, tight with panic. There has been an accident. There is a lawyer. Please do not tell Mom. I need the money today.

The voice cracks in exactly the right places.

It is not the grandson. It is a few seconds of his audio, scraped from a graduation video and run through software that costs less than lunch.

Two calls. One technique.

Neither picked a lock, because neither had to. The locks got stronger, so the attackers changed targets. They stopped attacking the system and started attacking the person the system trusts: the employee who can be hurried, and the grandmother who can be scared.

This week, the file is the phone in your hand.

Scene 1: The IT Call

Through the first half of 2026, a crew known as ShinyHunters ran the same play against company after company. Security researchers count the victims in the hundreds. Charter, the company behind Spectrum. ADT. Carnival. Instructure, the company behind Canvas, the grading platform used by schools across the country.

The method barely changed.

Someone called an employee, posed as an internal IT representative, and walked them through “fixing” their multi-factor authentication. The employee handed over a login or approved a prompt. The crew walked through the open door into the company’s cloud systems, copied the customer data, then sent the private note.

Pay us, or we publish.

No zero-day. No genius code. A phone call and a script.

Scene 2: The Grandchild Call

While crews worked the help desks, the same weapon was aimed at kitchens.

The FBI logged $893 million in losses to AI-assisted scams in a single year, with $352 million coming from people over 60. The signature version is the cloned voice of someone you love, calling with an emergency that cannot wait.

One mother told reporters she wired $5,400 after a voice she was sure belonged to her daughter begged her for bail money. Industry surveys say one in four Americans received a deepfake voice call in the past year, and that more than three-quarters of those who engaged with one lost money.

The tool that makes this possible used to belong to intelligence agencies.

Now it is a subscription, sold on the same forums as everything else.

Scene 3: The Same Call

Put the two calls side by side and they become the same heist at two price points.

Both skip the technology and go straight at the person. Both use authority, urgency, and fear to shut down the part of the brain that checks. Both work because the victim is trying to do the right thing.

The corporate version steals millions of records.

The kitchen version can steal a retirement in a single afternoon.

The lock on your accounts has never been stronger. That no longer matters as much as it should, because nobody is attacking the lock.

They are calling the person who holds the key.

And asking nicely.

Operatives, last week the file was the capital stack.

A chip sold once, leased back, financed by private credit, and parked on top of someone’s retirement. The risk was real, but it was paper. It lived on a balance sheet you would need a lawyer to read.

This week, the file drops off the balance sheet and lands in your hand.

No structure. No filing. Just a phone that rings, a voice that knows your name, and a request that feels reasonable for exactly as long as it takes to do damage.

If Dead Drop #104 was the fraud the rich commit with paperwork, Dead Drop #105 is the fraud anyone can commit with a microphone.

The Crews: ShinyHunters, now operating alongside the group researchers call Scattered Spider under the loose umbrella known as The Com, spent 2026 proving that the front door of almost any company is a tired employee on a phone call. They got past text-message codes, authenticator apps, and the little “approve” button on your phone, not by breaking them, but by getting a human to use them for them.

The Reach: The same technique, scaled down and aimed at the public, is the voice-clone scam. It does not care whether you are technical. It cares whether you love someone.

That is the part the headlines miss.

This is not really a hacking story. It is a story about the one security control nobody can patch: the human reflex to trust a familiar voice in a moment of fear.

Same architecture as always. A defense sized for the public. A bypass sized for the house.

This week, the bypass is a phone call.

And the door it opens is the oldest one there is

Start with the corporate side, because simplicity is the point.

The crew picks a target, then finds an employee through information that is already public, already leaked, or already stolen. They call. They sound like the help desk. They invent a small, boring problem: a login that needs to be re-verified, a security update that has to be approved, a code that expires in the next few minutes.

The employee, trying to be a good employee, reads back the code or taps approve.

Notice what happened. The text-message code worked. The authenticator app worked. The push notification worked. Every layer did exactly what it was designed to do, because the real user operated all of them. The attacker did not beat the security. He borrowed the person.

Once inside, the work gets quiet. These crews favor cloud platforms where companies store customer records because one valid login can expose millions of people at once. Researchers have tied the 2026 wave to intrusions at Charter, ADT, Carnival, Instructure’s Canvas, and others. The reported numbers vary and should be treated carefully. Charter’s breach has been described as more than forty million customer records in a class-action filing, but roughly five million accounts in technical write-ups. ADT has been reported at around five and a half million, while the attacker claimed more.

Treat the exact counts as contested. Treat the pattern as settled.

Now look at the consumer side, which runs on the same logic with cheaper tools. Modern voice-cloning software needs only a few seconds of someone’s recorded voice, the kind of clip that lives on any public video, to produce new speech on demand. The scammer pairs the clone with urgency and secrecy, the two oldest levers in fraud.

An accident. An arrest. A lawyer who needs cash now. Do not tell anyone.

The victim hears a voice they would know anywhere, in a moment of fear, and the part of the brain that would normally pause is exactly the part the script is built to shut down.

The connective tissue between the corporate breach and the family emergency scam has a name: Fraud-as-a-Service. The cloning tools, scripts, stolen contact lists, call spoofing, and payment channels are now packaged and rented like ordinary software, with support desks and pricing tiers. A capability that once required a state intelligence budget now requires a credit card.

That is the real news. Not that the trick exists. That it has been industrialized, productized, and put on a self-serve menu.

There is one defensive reflex worth naming, because it beats both versions.

Hang up and call back on a number you already trust.

The corporate breach dies when the employee says, “I’ll call IT back on the internal line.” The bail-money scam dies when the grandmother hangs up and dials her grandson directly. Urgency is the weapon. The pause is the counter. Everything in the script exists to stop you from taking it.

The most advanced attack of 2026 is a stranger with a familiar voice asking you to skip the one step that would save you.

The defense is not a product. It is a habit. And you can install it tonight.

Why the human voice is the last unpatched protocol, and why arrests don't stop it.

Every other layer of your security has been hardened by a decade of paranoia.

Passwords got longer. Devices got encrypted. Networks got watched. The one layer that has not changed in a hundred thousand years is the human instinct to trust a familiar voice.

That instinct kept us alive.

Now it is the softest target in the system, and the only one that cannot be upgraded.

Notice that the criminals went looking for it on purpose. They did not fall back on social engineering because they failed at code. They chose it because it is cheaper, faster, more reliable, and easier to scale.

The same crew can vish a Fortune 500 help desk on Tuesday and rent the cloning kit to a 100 small-time scammers by Friday. The wholesale and retail versions run on the same insight:

The machine is hard now.

The person in front of it is still human.

And arrests do not end it. Four members of ShinyHunters were arrested in 2025. By January 2026, the campaigns were running again, busier than before.

That is the tell of industrialized crime. It is not just a gang. It is a market. And you cannot arrest a market.

You can take a name off the board, and the technique keeps trading because the technique is the asset. The technique is what is for rent.

The con artist never needed a computer.

The computer just gave him a perfect impression of someone you love, and a phone book the size of the country.

Five controls for the one security layer that has no patch: you.

The Ledger exists because the record is the only thing that reliably keeps count. This week the record makes a quieter point than usual.

The parallel. We are used to documenting impunity at the top, the financial-crime conviction quietly erased, the connected name that never sees a courtroom. This week the impunity is structural in a different way. You can arrest the people, and the crime continues, because the crime has been turned into a product that anyone can rent. The four arrests were real. The campaigns came back anyway. When the technique outlives the technicians, prosecution stops being a cure and becomes a line item. The Ledger keeps the count so the rest of us remember that the absence of a perp walk is not the absence of a crime.

This newsletter is for informational purposes only and promotes ethical and legal practices.