$275M Real Estate Scam Losses, Brushing Fraud, Iran Water Hacks

KEMETIC MINDS
Cybersecurity Scam Watch — Weekly Report — August 24, 2026

Photo: Gustavo Fring via Pexels (source)

This week’s roundup: the FTC named the mystery-package “brushing” scam, the FBI flagged cloned rental listings that have cost Americans millions, and federal agencies warned that Iran-linked hackers using AI are targeting the Siemens controllers that run U.S. water plants. Each story has specific red flags worth knowing before you pay, click, or open.

Key Takeaways

• The FTC warned consumers on August 20, 2026 that “brushing” scams use your name to post fake reviews for parcels you never ordered (FTC, 2026).
• Rental scams are surging, with more than 12,000 real estate scam reports and losses topping $275 million last year (Rodriguez Cruz, 2026).
• U.S. agencies issued a major warning that energy, water, wastewater, and chemical facilities are being targeted (Bing News, 2026a).
• An “active threat” is targeting Siemens PLCs across critical infrastructure, and AI is making them easier to exploit (Bing News, 2026b).
• Iranian-affiliated hackers are targeting internet-connected PLCs at water facilities, and systems in at least seven states reported incidents to the FBI (Gizmodo, 2026).
• Officials warn AI is lowering the expertise needed to attack industrial controllers, amplifying the risk (Weisman, 2026).

1. FTC “Brushing” Scam Warning

Watch how a real fake review brushing email unfolds — and the red flags that give it away.

On August 20, 2026, the Federal Trade Commission issued a consumer warning about a scheme that leaves people holding boxes they never bought (FTC, 2026).

The “brushing” scam uses your name to post fake reviews for parcels you never ordered (FTC, 2026). The FTC’s warning puts a name to a shopping-world nuisance many recipients face: surprise deliveries with no record of purchase.

How to Avoid This Scam

• Treat any unexpected package as a red flag — the “brushing” scam is built on parcels you never ordered (FTC, 2026).
• If a surprise delivery arrives in your name, check your shopping accounts for unrecognized orders before doing anything else (FTC, 2026).
• Search for reviews appearing under your name for items you never bought — fake reviews are how this scam uses your identity (FTC, 2026).

2. Cloned Rental Listings Steal Deposits

Watch how a real fake rental deposit hook unfolds — and the red flags that give it away.

Rental scams are surging across New England, according to a consumer alert from the Boston Division of the FBI (Rodriguez Cruz, 2026). Nationwide, more than 12,000 Americans reported real estate scams to the FBI last year, with losses topping $275 million (Rodriguez Cruz, 2026).

The scheme starts when fraudsters copy legitimate property listings and repost them with different contact information (Rodriguez Cruz, 2026).

When an interested renter reaches out, the supposed owner claims they can’t show the property because they’re out of town, then asks for a deposit by wire transfer or digital payment (Rodriguez Cruz, 2026). Once your money is sent, the listing disappears (Rodriguez Cruz, 2026).

How to Avoid This Scam

• Don’t put money toward a property you haven’t seen — the single most effective rule (Rodriguez Cruz, 2026).
• Check public property records to confirm the landlord’s identity before making any payment (Rodriguez Cruz, 2026).
• Research local rental prices and look for reviews or references from previous tenants (Rodriguez Cruz, 2026).
• Walk away from any landlord who says they’re out of town and demands a deposit by wire transfer or digital payment (Rodriguez Cruz, 2026).

3. U.S. Water Supply Attack Warning

Watch how a real fake water safety alert unfolds — and the red flags that give it away.

A major warning published August 19, 2026 says the infrastructure being targeted includes energy, water, wastewater, and chemical facilities (Bing News, 2026a).

The advisory arrives amid a recent wave of cyberattacks against U.S. water systems (Gizmodo, 2026). Federal agencies have been stepping up alerts over the past months, with CISA, the FBI, the NSA, the Department of Energy, and the EPA jointly naming the threat on August 19 (Bing News, 2026a; Weisman, 2026).

How to Avoid This Scam

• Know who is warning you: CISA, the FBI, the NSA, the DOE, and the EPA jointly named energy, water, wastewater, and chemical facilities as targets on August 19 (Weisman, 2026).
• If your utility issues a service advisory, treat it seriously — a successful attack on these systems could disrupt critical processes and create safety risks (Gizmodo, 2026).

4. “Active Threat” Against Siemens PLCs

Watch how a real fake plc firmware alert unfolds — and the red flags that give it away.

U.S. agencies warn of an “active threat” targeting Siemens programmable logic controllers across critical infrastructure (Bing News, 2026b). These devices are industrial computers that run pumps, valves, and manufacturing processes at water plants and other facilities (Gizmodo, 2026).

The warning highlights AI as the accelerant: AI is making the devices faster and easier for hackers to exploit (Bing News, 2026b).

How to Avoid This Scam

• Facility operators should audit exposed controllers now: the “active threat” targets Siemens PLCs across manufacturing, energy, water, chemical, food, and commercial sectors (Bing News, 2026b; Gizmodo, 2026).
• Pay special attention to AI-aided tactics — attackers are using AI-generated Python scripts disguised as legitimate monitoring tools (Gizmodo, 2026).
• If you live in a state like Minnesota, where officials say the hit was particularly hard, follow state and utility announcements closely (Gizmodo, 2026).

5. AI-Powered Iranian Water Plant Attacks

Watch how a real fake ‘monitoring agent’ update unfolds — and the red flags that give it away.

An August 1 analysis by cybersecurity expert Steve Weisman detailed cyberattacks on water facilities in Minnesota, Michigan, Arkansas, Georgia, and New Jersey (Weisman, 2026). The attacks fit a pattern federal agencies describe as an urgent, ongoing Iranian-affiliated threat (Weisman, 2026).

The timeline shows how long this has been brewing: warnings go back to 2016, and the EPA’s attempt at mandatory cybersecurity regulations in 2023 was challenged by states and withdrawn (Weisman, 2026). In March 2024, the EPA and White House urged states to implement protective plans after inspections found 70% of utilities fail to meet necessary cybersecurity standards (Weisman, 2026).

In April, the EPA, FBI, CISA, and NSA issued a joint advisory warning of an “urgent and ongoing” Iranian-affiliated threat against water and wastewater systems through their operational technology (Weisman, 2026).

On August 19, CISA, the FBI, the NSA, the DOE, and the EPA jointly warned that AI is making these attacks more effective (Weisman, 2026). The specific targets are Siemens S7 programmable logic controllers — devices that receive inputs from sensors, execute a control program, and send outputs to industrial equipment (Weisman, 2026).

How to Avoid This Scam

• Know the history: warnings date to 2016, and the EPA’s 2023 mandatory rules were withdrawn after states challenged them (Weisman, 2026).
• Ask your water utility whether it has implemented the protective plans the EPA and White House urged in March 2024 (Weisman, 2026).
• Understand the vulnerable gear: Siemens S7 PLCs run water, energy, manufacturing, and agriculture systems, so an attack can ripple far beyond drinking water (Weisman, 2026).

6. Inside the Siemens S7 Advisory

Watch how a real fake monitoring tool install unfolds — and the red flags that give it away.

The joint advisory from the NSA, CISA, the FBI, and other agencies details an active threat against Siemens S7 Series PLCs, the industrial computers that operate physical equipment such as pumps and valves at water treatment facilities (Gizmodo, 2026).

“The threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools,” the advisory reads (Gizmodo, 2026).

Attackers use internet-scanning services to find exposed Siemens PLCs that run outdated software or are poorly protected (Gizmodo, 2026). The targeted sectors include manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities (Gizmodo, 2026).

A successful attack could disrupt critical industrial processes, create safety risks, damage equipment, cause downtime, or compromise sensitive operational data (Gizmodo, 2026). The warning follows a July FBI and EPA alert that hackers were targeting internet-connected PLCs at water and wastewater facilities, when systems in at least seven states reported incidents to the FBI (Gizmodo, 2026). Minnesota was hit particularly hard, and CISA and other agencies had earlier warned that Iranian-affiliated hackers were actively targeting PLCs in critical infrastructure (Gizmodo, 2026).

How to Avoid This Scam

• Audit internet-exposed S7 controllers — attackers scan for devices running outdated software or with weak protections (Gizmodo, 2026).
• Question any new “monitoring tool” appearing on an industrial network; the advisory says the exploit scripts are disguised as legitimate monitoring software (Gizmodo, 2026).
• Take odd pump, valve, or plant behavior seriously — disruption, safety risks, equipment damage, and downtime are the listed consequences of a successful attack (Gizmodo, 2026).

This Week’s Family Safety Checklist

• Never send a deposit or digital payment for a rental you haven’t seen in person — that single rule would stop the most common version of the $275 million real estate scam wave (Rodriguez Cruz, 2026).
• If an unexpected package arrives, check for unrecognized orders and fake reviews in your name — it may be the “brushing” scam the FTC just flagged (FTC, 2026).
• Stay tuned to local water utility notices; federal advisories now name water and wastewater systems as active targets in at least seven states (Bing News, 2026a; Gizmodo, 2026).
• Expect more convincing attacks: AI is now being used to write exploit scripts and lower the expertise needed to compromise industrial systems (Weisman, 2026; Gizmodo, 2026).

References

1. Bing News. (2026, August 21). The FTC warns a ‘brushing’ scam is using your name to post fake reviews for parcels you never ordered. msn.com
2. Bing News. (2026, August 19). Weekly Scam Alert: Scammers Are Copying Rental Listings to Steal Deposits. thenewstribune.com
3. Bing News. (2026, August 19). Major warning issued over potential attacks on US water supply. msn.com
4. Bing News. (2026, August 19). FBI warns hackers are targeting Siemens PLCs amid fears over Iran-linked US water attacks. cybernews.com
5. Bing News. (2026, August 21). AI-Powered Iranian Cyberattacks Threaten Critical Infrastructure. forbes.com
6. Bing News. (2026, August 19). FBI Warns That Hackers Are Targeting Siemens Equipment Amid Recent Water Plant Breaches. gizmodo.com