The cat-and-mouse game between email scammers and their victims is about to take a dramatic turn. A new open-source tool called ScamBuster, developed by French engineer Laurent Giovannoni, uses artificial intelligence (AI) to “scam the scammers” at scale. Instead of simply deleting phishing emails, ScamBuster engages with attackers using AI-driven human personas, gathering crucial data on cybercriminal operations and helping law enforcement track down perpetrators.
ScamBuster was born out of a personal experience for Giovannoni. He created the system after friends fell prey to phishing attacks, and he realized that simply deleting these emails didn’t solve the problem. It allowed scammers to continue their work, potentially targeting others with the same malicious tactics. By responding to scam emails with a convincing AI persona, ScamBuster turns the tables on attackers, allowing organizations and law enforcement to gather valuable information about cybercriminal operations.
The system is designed to be an inbound-only tool, meaning it never initiates contact with anyone. It only responds to incoming emails that have been flagged as scams. When ScamBuster engages with an attacker, it assumes a persona tailored to the scam email’s specific characteristics. This could be an elderly widow or a small business owner, for example. The goal is to gather clues about the attacker and their infrastructure, including financial details and other data that can help identify related scams.
ScamBuster identifies indicators such as financial institution account numbers (IBAN), payment domains, or phone number prefixes. By linking these indicators together, it creates a profile of a cybercriminal business, allowing investigators to take further action. In essence, ScamBuster waits for the scammer to reveal their hand, and then it retrieves the data from them, structures it, and exports it as structured intelligence.
The implications of ScamBuster are significant. With this tool, organizations can shift the balance of power against email scammers, gaining valuable insights into their operations and helping law enforcement track down perpetrators. By disrupting the attackers’ business model, ScamBuster has the potential to reduce the financial losses suffered by individuals and businesses.
As ScamBuster prepares to make its public debut at Black Hat USA 2026 in Las Vegas, it’s clear that this innovative tool is poised to change the way we combat email scams. By leveraging AI to engage with attackers, organizations can gather crucial data on cybercriminal operations, ultimately making the internet a safer place for everyone.
If you’re an organization interested in combating email scams, take note of ScamBuster. This open-source tool has the potential to be a game-changer in the fight against phishing attacks. As ScamBuster’s developer notes, “The goal of ScamBuster is to retrieve this information… It waits for the moment when the scammer says, ‘You have to pay.'” By adopting similar strategies, your organization can take a proactive stance against email scammers and help create a safer online environment.
Source: Dark Reading — 2026-07-13