The rise of generative AI, mixed with the ease of access provided by crypto currency, has created scamming opportunities we couldn’t have imagined just a few years ago. Romance scams that exploit these technologies have now become one of the fastest growing and most devastating forms of financial crime.

The capabilities of generative AI mean it’s now possible to get scammed by a range of incredibly convincing fake personalities, including deepfakes of celebrities and public figures. In fact, according to the makers of the new documentary Super Scam Me, it’s revealed that an estimated one in seven American adults have lost money to this form of deception. In 2025 alone, romance scammers stole more than $1 billion from American victims.

In Super Scam Me, Emmy-winning investigative journalist Mariana van Zeller builds a digital target persona to intentionally lure a persistent fraudster, then teams up with a white-hat hacker to reverse-engineer the scammer’s digital footprint and track him down and confront him face-to-face.

In the documentary Mariana meets the victims whose lives have been upended by romance scams, including a woman who was duped into believing she was in a year-long relationship with Jon Bon Jovi. Yes, that Jon Bon Jovi. What she thought was a genuine connection with the superstar musician left her facing foreclosure on her home, providing a window into the devastating real-world consequences of these crimes.

I caught up with Mariana van Zeller to ask her about the new documentary, Super Scam Me.

TechRadar: From talking to people who were scammed, do you think they were especially gullible, or could this really happen to anyone?

Mariana van Zeller: I truly believe this could really happen to everyone. I mean, the main reason why I decided to do this documentary was because very often I come back from reporting on these scams and people's response would be, "How stupid could they be?" and "Why did they react like this?" and "Why do you give money to a stranger?" And I really wanted to turn the table around and start focusing on the actions of the actual scammers.

TR: How sophisticated are these scammers?

MvZ: You know, these scammers are very, very good at what they do. They spend a lot of time sort of honing their craft, and they use the latest technology out there. They have it all at their disposal. They have scripts, they work in teams, they're educated, there are schools for scammers out there. And they prey on emotions that are common to all of us. You know, hope, fear, love, greed in some cases. So as long as we have those emotions — which I believe every single one of us do — we are very likely, or it is very possible that we can fall victim to one of these scams.

TR: How do we stop this?

MvZ: I think awareness is very important. I think we should be aware of how good these scammers are, about the tactics and technology and strategies that they use. It's partly what I've tried to show in Super Scam Me. But I also think the onus shouldn't just fall on individual citizens. We should be asking our governments, we should be asking big tech and banks to do a lot more than they're doing.

You know, Leslie is a great example. In the documentary, she was supposedly having a relationship with Jon Bon Jovi for almost a year. And she is out there right now. Her heart was broken. She lost a lot of money. She almost lost her house. She felt humiliated and shamed and suffered this enormous loss.

She is now out there herself, every single day, on these platforms, raising awareness and telling people that these are fake profiles and reporting every single one of these profiles to Facebook and to Instagram and Meta in general, and hoping that they will take them down. And she says just four or three in every 10 of these actually get taken down, and the rest have existed for months.

And again, it shouldn't be Leslie, right? It shouldn't be a person who is a victim of a scam trying to prevent other people from falling for these scams. It should be our governments, it should be big tech and our banks, and there should be just a lot more being done to make sure that we're protecting our citizens.

TR: Thank you Mariana.

Super Scam Me, premieres on October 17 in the US, airing on National Geographic at 9pm EDT and streaming on Disney+ and Hulu the same day. In the UK Super Scam Me premieres on Sunday 18th October at 10pm on National Geographic, and streams from the same day on Disney+.

If you are affected by any of the issues raised in this piece, support is available.

Whatever you are going through, you don’t have to face it alone. In the US, you can call or text the 24/7 Lifeline, which is confidential and free, at 988. You can also reach the Crisis Text Line by texting HOME to 741741.

In the UK, you can call Samaritans for free on 116 123, email jo@samaritans.org, or visit the website to find your nearest branch.

• Attackers abused Microsoft Power BI dashboards to lure victims into downloading ScreenConnect software
• Public dashboards mimicked blurred documents and redirected users to attacker-controlled sites
• Campaign established persistent remote access, potentially enabling ransomware, espionage, or data theft

Microsoft's Power BI has seemingly become the latest in an ever-growing line of legitimate software being abused in phishing attacks.

Security researchers Huntress said they uncovered a new campaign that leverages publicly accessible Power BI dashboards to trick people into downloading remote monitoring and management software (RMM) called ScreenConnect. The end game of the campaign is not known at this time.

Power BI

Power BI is Microsoft’s business intelligence and data visualization platform, allowing users to create charts, reports, and various dashboards, out of their data and other raw information. The tool itself can collect data from sources such as spreadsheets, databases, cloud services, and more, and users can publish reports and dashboards online, or share them with colleagues privately.

In this campaign, which started on or around September 10 2026, the threat actors created a public dashboard, likely using a throwaway Microsoft account (or a compromised one). Huntress does not confirm how that account was obtained, but says that the dashboard was designed to look like a blurred document with a button labeled “Download Reference”.

The blurred document trick is rather common in phishing emails. Other services such as DocuSign, Dropbox, and even Office 365, were being abused in the same way. To “unblur” (or unlock) the document, victims are told to click a link and follow along.

Sometimes they were asked to download a “premium” version of a document reader, or an “updated” one, and sometimes they were asked to log in using their Office or Google credentials. This attack is no different - clicking on the “Download Reference” button redirects the victim to an attacker-controlled website outside Microsoft’s infrastructure, where an automatic download of ScreenConnect is launched.

On its own, ScreenConnect is not malicious. It is a legitimate remote access and support tool developed by ConnectWise, and designed to help IT staff manage devices remotely. Through the product, users can connect other devices on the internet, troubleshoot problems, transfer files, and install software. Once installed and connected to an attacker-controlled endpoint, ScreenConnect can provide persistent remote access.

Establishing persistence

The researchers didn’t discuss how the emails were delivered, but since they contained a link to a legitimate Microsoft service, they most likely evaded at least some email filters and landed in people’s inboxes. After all, this is probably why Power BI was used in the first place (aside from the fact that it’s not commonly abused this way).

But what’s particularly interesting about this attack is that after deploying one ScreenConnect instance, the attackers deployed a second one and configured a scheduled task to repeatedly execute a PowerShell script. In at least one incident, they also deleted the first instance.

Why they did it remains a mystery. An educated guess would be that they were trying to establish reliable, persistent remote access, while at the same time making sure their activities were harder to detect and disrupt. If defenders were to discover and remove one malicious ScreenConnect installation, a second one might remain available.

This is all in the domain of speculation, unfortunately, since Huntress stopped the observed attack before it progressed beyond establishing remote access. Therefore, we don’t know if the goal was to steal data, deploy ransomware, or engage in financial fraud. What we do know is that with two ScreenConnects, they were able to establish a durable foothold inside corporate networks, which they could subsequently leverage for espionage, data theft, ransomware, or other financially motivated attacks.

As a general rule of thumb, the best way to defend against these types of attacks is to be highly skeptical of incoming emails, especially those with links to “locked” documents, and even more so those that end up with a ScreenConnect deployment.