Field notes from the front of AI social engineering.

Threat intel and methods, written by the team building Diopter. Two tracks: incident teardowns from the wild, and the model and signal work behind the platform.

Featured threat report · Q2 2025

The Manipulation Arc Report: what 12 months of AI social engineering taught us.

A 40-page synthesis of incident data, attacker tradecraft, and verdict-matrix outcomes from across our pilot deployments. Available under NDA — contact us for access.

Tracks

Threat intel + Methods

Incident teardownMar 2025 · 12 min

Arup, frame by frame: the $25.6M deepfake call

A reconstruction of the multi-participant deepfake video call that authorized 15 wires in a single afternoon, and where Diopter's signals would have intervened.

Arcauthorityisolationask
Threat intelApr 2025 · 9 min

Q1 2025: $200M of redirected closing wires

How coordinated impersonation of title agents and closing attorneys redirected residential closing wires across 30+ U.S. states in twelve weeks.

Arcauthorityurgencyask
Threat intelFeb 2025 · 11 min

DPRK IT workers: the hiring-side picture

What the 220% YoY rise in fake-candidate operations looks like from the hiring manager's seat, and what the loop-level signals reveal.

Arcauthorityisolationescalation
Incident teardownJan 2025 · 8 min

Voice clone, $35M wire: the UAE bank case

A familiar director's voice, a spoofed email confirmation, an hour of pressure. Anatomy of a single-call manipulation that cleared $35M.

Arcauthorityurgencyask
AnalysisDec 2024 · 7 min

Vishing, +442%: what the curve actually means

We map the H2 2024 vishing spike against tooling availability, victim industries, and average per-incident loss to separate signal from headline.

Walkthrough · 30 min · NDA-safe

Walk an attack arc with our threat team.

We'll replay a real deepfake incident through Diopter, frame by frame and signal by signal, and show what you would have caught and when.