Las Vegas – Niche, specialized cyber-criminal groups are offering customizable off-the-shelf tools for scam gangs to use to make scams like pig-butchering more efficient and convincing, new research shows.
Eric Huber, senior manager of adversary intelligence and disruption at TD Bank, gave a demonstration of AI-powered translation software, reply engines, and a full customer relationship management platform being used by criminal gangs, at Black Hat USA 2026.
So called ‘pig-butchering’ scams are among the fastest growing fraud targeting Americans. In these schemes, scammers build relationships with individuals over time before convincing them to make fake investments.
These scams cost Americans at least $7.2 billion in 2025, figures that are believed to significantly underrepresent actual losses as many victims do not report to law enforcement.
The scam compounds themselves, in countries like Cambodia and Myanmar, hold thousands of trafficked workers in what Huber described as slave labour supporting a billion-dollar industry.
Huber emphasized that the tools do not automate attacks, but “help some poor person do the scamming by creating responses that are going to be the most effective.” For example, workers in the compounds, who may only speak one or two languages, are given AI translation software that automatically translates.
One app, Editone, lets an operator load a victim’s profile and a fabricated persona to make the replies more convincing, with voice cloning built in.
The capabilities of AI image and voice cloning tools have become far more sophisticated over the last couple of years, including the ability to add fake meta-data into images, Huber demonstrated.
Another app functions as a customer relationship management system for scam victims, which tracks stages of fraud and sets daily contact targets, with punishment for workers who miss them.
Using AI against large retailers
Not all of the AI tools targets individuals. Huber also demonstrated refund-fraud crimeware aimed at retailers, including Amazon.
Operators open ordinary retail accounts and “warm” them with a period of normal browsing to make them look established. They then conduct refund fraud attacks, buying goods, returning them, and keeping both the item and the refund.
Huber maintains fraudsterglossary.com, a public glossary of fraud terminology in English and Chinese drawn from his years monitoring criminal Telegram channels.
