Last Wednesday, 11pm, "Boss Wang" messaged me on WeChat
"Xiaoli, contract's changed, transferring 80k RMB (~$11k) prepayment to your account." Avatar, nickname, the way he talked — all matched the Boss Wang I've worked with for two years. I almost scanned his collection code.
Looked two seconds longer — his WeChat ID had an extra underscore. Clone account.
This "good enough to fool your actual boss" capability is being driven down by AI. Anthropic published a report a few days ago, naming GLM-5.3 (a model from Chinese AI company Zhipu) as spreading advanced cyberattack capabilities.
What's GLM-5.3? Why does this matter for us solo founders?
GLM-5.3 is a model from Zhipu AI, originally built for legit business. Anthropic's Threat Intelligence team found it's being packaged on the dark web as a "script kiddie hacker tool" — type "build me a phishing link that mimics my boss's WeChat" in Chinese, and you get a working phishing page in seconds.
Who's already using it? My friend Ajie, freelance photographer, shot promo videos for 3 companies last year. Last month he got hit — scammer sent a "client review video" zip file, he opened it, every client contract on his laptop got encrypted, attackers demanded 0.5 Bitcoin.
The report's one-line takeaway: AI didn't make hackers "smarter" — it made ordinary people into hackers. Our client lists, contracts, payment records? That's exactly their training data.
3 things you can do today (free, 30 minutes)
Cost to copy: $0 / 30 min / tech barrier = install a phone app / first step: open WeChat → Me → Pay → Wallet → Security → Enable "Transfer Cooldown"
- Turn on WeChat & Alipay "transfer cooldown." Set 2-hour arrival, mistakes can be reversed. I messed this up myself — used to think "I'm not stupid" until I almost sent money to a clone account.
- All work files on cloud drive, not desktop. I use the free tier of Alibaba Cloud Drive (enough for me), all client contracts, quotes, chat screenshots get synced there. If my local machine gets hacked, I just swap the hardware.
- Any link or zip from a "boss, client" — confirm by phone first. Even if WeChat makes it sound urgent, spend 30 seconds on a phone call. This step is the most basic, but it's the one Ajie skipped.
Not everyone needs this toolkit — if your annual revenue is under ~$14k and you don't have much client data, at least do step 1 and you're fine for now.
Advice by stage
Just starting out (0 clients / under $1.5k/month): Do step 1 (transfer cooldown) + step 3 (phone confirmation). Don't rush the rest — you don't have valuable data, hackers won't bother with you.
1-2 stable clients ($1.5k-$7k/month): Do all 3 steps. Plus back up client contracts and payment records to cloud. I made this mistake before — kept everything on desktop, laptop died, couldn't find original files for client reconciliation.
Scaling up (3-5 person team / $7k+/month): All 3 steps above + enable 2FA (login requires phone code) for every team member account: WeChat, Work WeChat, email, cloud drives. I'm planning to set this up for my team this week — been putting it off for 2 months.
AI-era scams won't disappear, but they're avoidable. Our edge as solo founders is fast decisions — read this today, change settings today.