9. The New Attack Catalog

The AI-era catalog is the old catalog, made indistinguishable from real members.

That is the whole chapter in one sentence, and it is worth sitting with before we get into the specifics, because the temptation is to treat what follows as a list of new attacks. It is not. There are almost no genuinely new attacks here. Admin impersonation, fake support, the relationship con, the malicious link, the bait-and-switch — every entry in this catalog has a direct ancestor in the chapters you have already read. What changed is not the move. What changed is that the move can no longer be told apart from a person who belongs in the room.

For two decades, defenders survived on tells. A scam message read like a scam message. The grammar was off, the urgency was too thick, the link was too obviously wrong, the persona was too thin to survive five minutes of conversation. The attacker was a human in a content farm or a crude script, and either way there was a seam — a place where the costume didn't quite fit the body underneath it. Detection, whether automated or human, was fundamentally the practice of finding that seam. Filters looked for the misspelled domain and the wallet address; moderators looked for the new account that joined and immediately pasted a giveaway; experienced members developed an instinct, a prickle at the back of the neck, that they would have described as "something felt off."