Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands An Informa TechTarget Publication Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise Newsletter Sign-Up Newsletter Sign-Up Cybersecurity Topics Related Topics Application Security Cybersecurity Careers Cloud Security Cyber Risk Cyberattacks & Data Breaches Cybersecurity Analytics Cybersecurity Operations Data Privacy Endpoint Security ICS/OT Security Identity & Access Mgmt Security Insider Threats IoT Mobile Security Perimeter Physical Security Remote Workforce Threat Intelligence Vulnerabilities & Threats Recent in Cybersecurity Topics Application Security AI Coding: Do Security Risks Outweigh Productivity Gains? AI Coding: Do Security Risks Outweigh Productivity Gains? by Alexander Culafi Jul 10, 2026 7 Min Read Vulnerabilities & Threats Microsoft Reins in RoguePlanet Zero-Day Threat Microsoft Reins in RoguePlanet Zero-Day Threat by Rob Wright Jul 9, 2026 4 Min Read World Related Topics DR Global Middle East & Africa Asia Pacific Latin America Recent in World See All Cybersecurity Operations State IDs for AI Agents: Will Estonia Set a Precedent? State IDs for AI Agents: Will Estonia Set a Precedent? by Nate Nelson Jul 8, 2026 5 Min Read The Edge DR Technology Events Related Topics Upcoming Events Podcasts Webinars SEE ALL Resources Related Topics Resource Library White Papers Reports Webinars Newsletters Podcasts Heard It From a CISO Reporters' Notebook Dark Reading's 20th Videos Dark Reading Polls Partner Perspectives Meet the Editors Advertise With Us About Us Dark Reading Resource Library Cyberattacks & Data Breaches Cyber Risk Endpoint Security Remote Workforce News Turning the Tables on Email Scammers With 'ScamBuster' An open source, AI-driven system adopts victim personas to engage with phishing attackers, allowing organizations and law enforcement to gather relevant data on cybercriminal operations. Elizabeth Montalbano , Contributing Writer July 10, 2026 5 Min Read Source: Rawpixel.com via Shutterstock Everyone who uses email has at some point been sent a malicious phishing email attempting to scam them out of money. Some have even engaged with an attacker unwittingly, perhaps falling prey to social-engineering tactics. What happens to most of these malicious emails is that they get deleted, either by users or by security software designed to recognize and eliminate the threat. But what would happen if organizations could turn the tables and scam the scammers at scale, using artificial intelligence (AI) to masquerade as a victim? That's exactly what Laurent Giovannoni, principal software engineer with Filigran, envisions doing with a software solution he calls ScamBuster. Inspired by stories of friends who had been scammed by phishing attacks, Giovannoni created ScamBuster as part of his thesis while studying at the French engineering university École Polytechnique. He plans to formally unveil the ScamBuster system , which has been in production since November 2025, at Black Hat USA 2026 in Las Vegas in August. Related: 'GodDamn' Ransomware Uses BYOVD to Smite US Companies Scamming the Scammers Just like most people, corporate IT teams also tend to delete scam emails, but this doesn't solve the problem, Giovannoni tells Dark Reading. It means that even if the person who received the message wasn't fooled, it could still fool someone else, and doesn't hold the attacker to account. What ScamBuster is designed to do is, instead of immediately deleting scam emails, is write back to the scammers using an AI-driven human persona that the scammer thinks is being fooled by the attack. This could be an elderly widow, or a small business owner, a busy executive, or a tourist out of their depth, he explains. The ultimate goal is to gather clues about the attacker and the infrastructure behind the attack, including financial details and other data that can help organizations identify other scams by the same or related attackers, as well as inform the appropriate authorities as they investigate cybercrimes. How ScamBuster Works ScamBuster is designed to be an inbound-only system, Giovannoni tells Dark Reading. "It never contacts anyone first," he says. "It only answers emails that come in. This rule is built into the architecture, not just set as a policy." When ScamBuster starts the "conversation" with an attacker upon receiving a scam email , the appropriate persona takes over and "the scammer thinks he found his target, but it's not his target," Giovannoni explains. "Who" the attacker is communicating with is really an intelligent system that aims to gather information, which it groups together as "indicators," for security researchers and law enforcement to identify the perpetrators behind the scams, he says. Related: Vidar Infostealer Hammers SMBs via Malvertising Campaign "He is handing over his own infrastructure," Giovannoni says. "We can retrieve the bank account he gets paid into, the phone number, the way the money moves and the system pulls all of that out, and it turns it into structured intelligence." Creating a Cybercriminal Profile The "conversations" can also help analysts link together separate scams that share the same account and create a picture of a cybercriminal business so that investigators can take further action. ScamBuster identifies indicators, such as the financial institution's International Bank Account Number (IBAN), payment domains, or phone number prefixes, and links them, clustering them together when appropriate to build a profile of a cybercriminal. "What looks like dozens of separate scam emails can trace back to the same few numbers and the same payment domain," Giovannoni says. In this case, that list of indicators becomes "a starting point for an investigation," which can be done by an organization, security researchers, or law enforcement. "The goal of ScamBuster is to retrieve this information," Giovannoni says. "It waits for the moment when the scammer says, 'You have to pay.'" Then the system retrieves the data from the scammer, structures it, and exports it in standard formats that security tools and threat intelligence teams can read — STIX 2.1 and MISP. Related: Big Brand Jobs Scam Targets Marketing Pros' Google Accounts Self-Learning to Improve Outcomes ScamBuster was designed to keep the conversation between the system and the attacker believable and to turn the attacker's psychological tactics against them. It also uses AI to learn on the fly which conversational patterns work better to get the scammer to give up financial and other information that can be tracked by investigators. "ScamBuster learns which persona works against which kind of scam and changes its approach on its own," Giovonanni explains. "The longer it runs, the better it gets." The gap between the best and the worst persona for successfully engaging and getting information on an attacker is 5.5 times, Giovanonni says. That means this learning matters in the long run how successfully ScamBuster works when installed on an organization's email system. "It is not a small tuning detail," Giovanonni explains. "It is the difference between a conversation that gives five indicators and one that gives almost none." AI Agnostic Under the hood, a set of large language model (LLM) agents runs the conversation, scores what the scammer reveals, and saves it as structured threat intelligence. It then uses this info to pick which persona to use in the next encounter. Giovannoni designed ScamBuster to be low-cost, using a small, inexpensive commercial model — in this case, GPT-4o-mini — keeping the running costs to "near zero," he says. However, the system is not limited to one AI model, and operators can decide which one best suits their purposes, he says. "The system is completely agnostic," Giovannoni says. "When you install, you just have to set up the email and you put a token of your favorite LLM, like OpenAI or Anthropic or Llama, or an open source LLM and that's it." The full production code base for ScamBuster will be released under the MIT open source license on Wednesday, Aug. 5 at Black Hat. Giovannoni also is working on updates to the system to support vishing and smishing attacks, he says. Black Hat USA Aug 1, 2026 TO Aug 6, 2026 | Mandalay Bay Convention Center, Las Vegas, USA The premier cybersecurity event of the year returns to Mandalay Bay with a re‑engineered, six‑day program built to ignite innovation, push boundaries, and bring the global security community together like never before. This year’s event features four days of immersive, expert‑led Trainings (August 1–4), followed by Summit Day on Tuesday, August 4, and a two‑day main conference packed with groundbreaking Briefings, open‑source tool demos in Arsenal, a dynamic Business Hall, and unlimited learning & networking opportunities. Use code: DARKREADING to save $200 on a Briefings pass or $100 on a Business pass. GET YOUR PASS GET YOUR PASS Read more about: Black Hat News About the Author Elizabeth Montalbano Contributing Writer Elizabeth Montalbano is freelance writer, editor, and journalist with 30 years of professional experience and a master's degree from Arizona State University. Her areas of expertise include enterprise technology, cybersecurity, business, and culture. During her long career, Elizabeth has lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City. She specializes in news coverage and analysis, using her years of experience to look at the current state of cybersecurity with a critical gaze. She currently resides in a village on the southwest coast of Portugal, where in her free time she enjoys surfing, hiking with her dogs, growing plants, and playing and performing as a singer and musician. See more from Elizabeth Montalbano Want more Dark Reading stories in your Google search results? Add Us Now More Insights Industry Reports The State of Cloud Security