Cybercriminals are exploiting the growing interest in artificial intelligence to launch sophisticated social-engineering campaigns, targeting employees who use AI-powered tools. Attackers are impersonating popular AI platforms, such as ChatGPT and Microsoft Copilot, to distribute malware and deceive victims1. This shift in tactics requires a new approach to security, focusing on the human layer and employee behavior. As state-aligned activity involves Microsoft, the threat model expands from criminal to geopolitical, necessitating a different response strategy. The adapting scams take advantage of trusted digital services and changing workplace behavior, making it essential for organizations to reassess their security measures. This surge in AI-powered scams matters to practitioners because it demands a proactive approach to educating employees about the risks associated with AI adoption and implementing robust security protocols to mitigate these emerging threats.