AI Weekly Malaysia

Security researchers created a fake DeFi startup called Ballena Azul, advertised developer jobs, and hired three suspected North Korean operatives who submitted forged identity documents—including one edited with Google Gemini and carrying a SynthID watermark. The operatives cleared interviews, signed contracts, and were given work VMs with access to source code, illustrating how the hiring process itself is the attack vector.

Why: If you hire remote developers, especially for crypto or startup roles, this is a concrete playbook of what forged onboarding documents look like: mismatched addresses vs. bank locations, AI-edited IDs with SynthID watermarks, and stolen SSNs attached to someone else's license. Tighten your identity verification and limit source-code and infrastructure access until trust is established.

Group-IB detailed a fraud campaign called WindRelay that combines a phone-based social engineering attack with two Android malware strains—SpyNote (a RAT leaked in 2016) and WindRelay (NFC relay malware discovered August 2025)—to clone contactless card transactions in as little as 13 minutes. The attacker poses as bank helpdesk, gets the victim to install SpyNote, which silently deploys WindRelay, then tricks the victim into tapping their card on their NFC phone and entering a PIN. WindRelay captures the live EMV APDU exchange and relays it to an attacker-controlled POS terminal or ATM, completing a genuine card-terminal handshake that authorizes fraudulent payments.

Why: If you build or operate payment, fintech, or banking apps in Malaysia—where contactless card and e-wallet usage is near-universal—this attack shows that contactless EMV is not a trust boundary you can rely on when the cardholder's own device is compromised. Fintech teams should evaluate whether their fraud detection can flag relay-style transactions characterized by unusual POS-to-cardholder geolocation or timing gaps, and whether customer-facing flows that instruct users to tap cards on phones create teachable moments for social engineering awareness.

Spanish police caught a suspected digital certificate fraudster after his real-time deepfake face-swap software glitched for barely a second during a live video identity check, exposing his real face. He had made 38 attempts to impersonate 30 people, using forged documents, household spotlights with colored bulbs to simulate ID holograms, VPNs, and deepfake tools to bypass a certificate authority's visual verification. Certificates were fraudulently issued on multiple occasions before the glitch led to his identification.

Why: If you build or rely on video-based KYC, identity verification, or e-signature onboarding, this is a concrete demonstration that real-time deepfake attacks against live face checks are already happening and can succeed multiple times. The attacker's setup was low-cost—household spotlights and consumer deepfake software—yet defeated a certificate authority's checks. Review whether your verification flow includes liveness detection that goes beyond matching a face to a photo, and consider whether your fraud monitoring catches repeated attempts from the same device or IP range even when VPNs are used.

Bloomberg reports that Phia, a shopping startup co-founded by Phoebe Gates and Sophia Kianni, knowingly engaged in 'cookie stuffing'—taking affiliate commissions for purchases it didn't drive—as far back as December, contradicting earlier claims it was unaware. Leaked Slack messages show founders and engineers discussed the practice, which was a purposefully built feature, not a bug. Cookie stuffing reportedly made up a significant portion of Phia's sales, and daily revenue dropped sharply after the practice stopped.

Why: If you build anything involving affiliate links, referral tracking, or e-commerce attribution, this is a concrete example of how cookie stuffing can become a revenue dependency that's hard to unwind—and a legal liability. Affected retailers include Nike and Nordstrom, meaning the contracts you sign with affiliate marketplaces likely explicitly ban this practice. Don't treat attribution manipulation as a growth hack; the revenue drop after stopping shows how dangerous it is to build a business model on it.

The FBI is investigating how a North Korean national was hired to work remotely for an unnamed U.S. federal government agency, as first reported by Federal News Network. This is a rare confirmed case of a sanctioned North Korean worker penetrating government employment, though thousands are believed to have infiltrated U.S. and European companies using fraudulent identities to funnel wages back to the regime and steal intellectual property.

Why: If you hire remote developers or contractors, this underscores that identity fraud in remote hiring is not hypothetical — even U.S. federal agencies with security clearances have been breached. Founders and hiring managers should tighten identity verification (video interviews, device fingerprinting, payroll address validation) rather than relying on resumes and references alone.

VideoVerse, an Indian video clipping startup, announced a $250M acquisition by Minute Media in September 2025, but the deal unraveled within a year amid allegations of fraud and forged signatures. Minute Media terminated the contract in May citing 'significant discrepancies,' while investor Bluestone Capital is suing for fraud and a creditor is seeking to recover $64 million from a loan founder Vinayak Shrivastav took out post-close.

Why: For SaaS founders considering acquisition exits, this is a concrete reminder that acquirers can unwind deals post-close when representations prove false, and that founder-level debt and side deals can surface in litigation. The article does not provide actionable technical or operational guidance for builders.

Investors are suing Selena Gomez and her mother over their mental health startup Wondermind, alleging securities fraud and breach of contract after investing nearly $1.2 million. The complaint claims the app was never built, promised partnerships never materialized, and investors were kept in the dark about the company's collapse until a September 2025 media report.

Why: For SaaS founders, this is a cautionary tale on founder-investor communication and the legal risk of overpromising celebrity involvement in marketing; the core allegations—misrepresented finances, undisclosed failure to deliver, and a founder not fulfilling contractual obligations—are standard fraud claims that any startup with investor capital should take seriously.