GoKawiilEveryone who uses email has at some point been sent a malicious phishing email attempting to scam them out of money. Some have even engaged with an attacker unwittingly, perhaps falling prey to social-engineering tactics.
What happens to most of these malicious emails is that they get deleted, either by users or by security software designed to recognize and eliminate the threat. But what would happen if organizations could turn the tables and scam the scammers at scale, using artificial intelligence (AI) to masquerade as a victim? That's exactly what Laurent Giovannoni, principal software engineer with Filigran, envisions doing with a software solution he calls ScamBuster.
Inspired by stories of friends who had been scammed by phishing attacks, Giovannoni created ScamBuster as part of his thesis while studying at the French engineering university École Polytechnique. He plans to formally unveil the ScamBuster system, which has been in production since November 2025, at Black Hat USA 2026 in Las Vegas in August.
Related:'GodDamn' Ransomware Uses BYOVD to Smite US Companies
Scamming the Scammers
Just like most people, corporate IT teams also tend to delete scam emails, but this doesn't solve the problem, Giovannoni tells Dark Reading. It means that even if the person who received the message wasn't fooled, it could still fool someone else, and doesn't hold the attacker to account.
What ScamBuster is designed to do is, instead of immediately deleting scam emails, is write back to the scammers using an AI-driven human persona that the scammer thinks is being fooled by the attack. This could be an elderly widow, or a small business owner, a busy executive, or a tourist out of their depth, he explains.
The ultimate goal is to gather clues about the attacker and the infrastructure behind the attack, including financial details and other data that can help organizations identify other scams by the same or related attackers, as well as inform the appropriate authorities as they investigate cybercrimes.
How ScamBuster Works
ScamBuster is designed to be an inbound-only system, Giovannoni tells Dark Reading. "It never contacts anyone first," he says. "It only answers emails that come in. This rule is built into the architecture, not just set as a policy."
... continue reading