Chile, Mexico, Colombia hit by AI fraud

Update November 2, 2026: El Peruano added that Operation FlashHole remains a potential warning for Peruvian organizations, but no victims have been confirmed in the country. A South Korean report also said Kaspersky detected domains and subdomains tied to local entities as possible relay points linked to ClientHub command-and-control indicators.

Phishing accounted for 50% of fraudulent messages blocked in Latin America, according to an Infobip report cited by ebizlatam.com, while regional digital fraud rose 56% year over year. The company also said its defenses blocked 99.9% of fraudulent traffic detected in 2025. At the same time, other reports from the region describe AI-assisted tactics ranging from vishing and voice cloning to attacks that use injection techniques in account-opening processes.

What are the reported cases showing in the region?

The cases published so far point to broader use of AI in digital fraud across Latin America. In Chile, Mundo en Línea cited Infobip data showing that 71% of phishing scams detected in the country were tied to AI-powered vishing, using generated or scripted voices, voice cloning and fake support bots as attack methods. Facephi also described attempts to bypass selfie checks with AI-generated faces and videos, including through virtual cameras or emulators.

What happened in Operation FlashHole?

Kaspersky described Operation FlashHole as a campaign attributed to Lazarus that combined fake job profiles generated or supported by AI, AI-created photos and spear phishing to compromise devices and steal information. The coverage says the documented attacks were concentrated in Asia, while presenting Latin America as a region that could still be exposed to those techniques.

According to El Peruano, the operation is seen as a risk for Peruvian organizations, but the report makes clear that no victims have been confirmed in Peru. The Hacker News also reported that Kaspersky attributed FlashHole to Lazarus and that at least three organizations in South Korea, in the construction, software and wired communications equipment manufacturing sectors, were affected.

Another technical report said an updated version of LPEClient uses ML-KEM-1024, a NIST-standardized post-quantum key encapsulation mechanism, to protect the delivery of additional malware. That same line of research said the infection chain may have involved South Korean security software CrossWeb EX and that researchers identified the undocumented tools TouchHub and ClientHub, which can run commands and communicate with operators.

The Hacker News also said the initial attack vector was not confirmed, although there were signs of malicious sites hosted on GitHub Pages and a resume profile whose photo was likely generated with AI. A separate South Korean report said Kaspersky identified domains and subdomains tied to local entities, including media outlets, construction companies and a medical association, as possible relay points linked to ClientHub command-and-control indicators.

What defenses are the firms recommending?

Facephi recommends combining document and biometric verification, liveness checks and injection attack detection to stop fraud in account opening. It also points to validation against official registries such as INE and RENAPO in Mexico and the Registraduría in Colombia.

In coverage aimed at the Dominican Republic, Hoy said Kaspersky recommends checking the authenticity of resumes, profiles and received links, updating systems and monitoring digital access. That warning frames the technique as a potential risk for the Dominican Republic and other Latin American countries, not as a confirmed regional campaign.

What scale are the sources assigning to the problem?

The figures published by Infobip show sustained pressure on detection systems across the region, with phishing as the top blocked vector and a year-over-year rise in digital fraud. Added to that are reports of AI-powered vishing in Chile, deepfake-assisted account-opening attempts and spear-phishing campaigns using fake profiles, a set of tactics now appearing across multiple stages of digital fraud in Latin America.