Investment Scams Using Deepfakes Could Spread to Gulf Markets, Group-IB Warns

Investment scams that combine deepfake video, private WhatsApp groups, and fake cryptocurrency platforms could soon be adapted for Gulf markets, according to cybersecurity firm Group-IB. The company investigated two fraud operations first identified in Australia and the United States. It found that the advertising, messaging, and platform infrastructure behind them can be redirected to other countries within days.

Group-IB tracks the first operation as GoldBull. The scheme relies on paid Facebook and Instagram advertisements featuring deepfake videos that imitate financial professionals. Those advertisements direct potential victims into private WhatsApp groups, where they are encouraged to buy shares of specific small-cap stocks traded on regulated exchanges. The instruments themselves are real; the deception is in the orchestrated push.

In one documented case, victims were instructed to buy shares at US$24.79. The coordinated purchases that followed pushed the share price up 12.4% to US$27.87. The price later fell to US$14.27. From the stated entry price, investors lost 42.4%. Group-IB estimated that US$1.5 million to US$3 million could have been used to drive the movement. The scheme may have involved 500 to 3,000 participants across multiple WhatsApp groups.

The second operation, tracked as CoinLure, is built on a network of more than 200 fake cryptocurrency investment platforms. Those platforms display fabricated returns to attract deposits. When victims try to withdraw money, the sites demand additional payments for purported taxes, compliance fees, and account upgrades. In an analysis of one CoinLure platform, Group-IB identified more than US$90,000 in cryptocurrency deposits flowing to addresses active since 2022.

Gulf markets are a plausible next target. Group-IB pointed to the widespread use of messaging apps for financial conversations in the region, along with growing retail investment and cryptocurrency activity. Fraudsters may also impersonate regulated financial firms in Gulf markets, the firm warned.

What makes these operations dangerous is not the technology itself. The infrastructure is portable, and the playbook is old. Coordinated buying, fabricated returns, and hard-to-retrieve funds: that sequence has appeared before. What has changed is the channel. Deepfakes give the promotion a face, and private messaging apps give it distribution. A campaign built for one jurisdiction can be shifted to another almost unchanged, putting a burden on local regulators to recognize patterns already documented elsewhere and on investors to treat unsolicited digital pitches with suspicion.

Group-IB offered practical advice for investors. Verify firms independently with national financial regulators before transferring money. Be cautious about opportunities promoted through private messaging groups, video endorsements, or platforms that require cryptocurrency payments. Treat any request for additional payments before a withdrawal is released as a warning sign, whether it is labeled taxes, insurance, or compliance charges. The warning extends to video endorsements: a familiar face in a clip is not proof of legitimacy.

The research was carried out by Group-IB's Fraud Protection team with analysts from its Investigations, Threat Intelligence, and CERT-GIB units. They analyzed advertising activity, digital infrastructure, and cryptocurrency transactions to identify links across a wider network of fraud operations.