HISPI Project Cerebellum HISPI PROJECT CEREBELLUM

Purportedly AI-Enhanced Phishing Campaign Allegedly Impersonates Australian Government Services in Large-Scale Welfare Scam

November 17, 2025

In 2025, a large-scale phishing attack, allegedly impersonating Services Australia and Centrelink, reportedly sent more than 270,000 fraudulent emails. The attackers (MCTO3001) utilized AI tools to generate highly convincing government-themed messages with evasion techniques, targeting vulnerable Australians and public institutions. Victims faced potential risks of credential theft and subsequent digital exploitation. This incident underscores the importance of implementing robust safeguards for trustworthy AI in governance, as well as the need for continuous monitoring and improvement through projects like HISPI Project Cerebellum's TAIM (Govern, Measure). Join us to help create a safer digital environment by contributing to the AI incident database and shaping harm prevention guardrails. JOIN US

Matched TAIM controls

Suggested mapping from embedding similarity (not a formal assessment). Browse all TAIM controls

Alleged deployer
unknown-cybercriminals, mcto3001
Alleged developer
unknown-generative-ai-developers
Alleged harmed parties
medicare-of-australia-beneficiaries, government-of-australia, general-public-of-australia, general-public, centrelink-beneficiaries, centrelink, australian-welfare-recipients, australian-businesses, epistemic-integrity, truth

Source

Data from the AI Incident Database (AIID). Cite this incident: https://incidentdatabase.ai/cite/1275

Data source

Incident data is from the AI Incident Database (AIID).

When citing the database as a whole, please use:

McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. In Proceedings of the Thirty-Third Annual Conference on Innovative Applications of Artificial Intelligence (IAAI-21). Virtual Conference.

Pre-print on arXiv · Database snapshots & citation guide

We use weekly snapshots of the AIID for stable reference. For the official suggested citation of a specific incident, use the “Cite this incident” link on each incident page.