IR playbook: triaging Google’s November 2025 fraud advisory (AI impersonation, job‑lure malware, and review extortion)
Google’s Trust & Safety team published a new scams advisory on November 6, 2025 that highlights three trends DFIR teams will encounter in the wild: job-lure campaigns that deliver RATs and info-stealers, negative-review extortion of merchants, and AI-product impersonation across apps, extensions, and malvertising chains (Google, Nov 6, 2025). The advisory also notes a rollout of a direct merchant extortion reporting flow and calls out protections in Chrome/Play you’ll see on endpoints during triage (Google).