Emerging Trends in Deepfake Scam Campaigns Online

Researchers have uncovered dozens of scam campaigns using deepfake videos of public figures to promote fraudulent investment schemes and giveaways. These campaigns share an infrastructure that points to a single threat actor group across languages and nations, featuring hundreds of newly registered domains and a network of shared hosting that complicates attribution and takedown. #QuantumAI #Deepfake

Keypoints

Discovery of multiple scam campaigns using deepfake videos of public figures.
Campaigns target specific countries and languages, including English, Spanish, French, and more.
Believed to originate from a single threat actor group due to similarities in tactics and infrastructure.
Hundreds of domains linked to these campaigns, averaging 114,000 accesses each globally.
Deepfake videos often feature well-known figures like Elon Musk, promoting fake investment schemes.
Traditional investigative techniques remain effective in identifying malicious hosting infrastructure.
Proactive measures, such as Advanced URL Filtering, are essential for defense against these scams.

MITRE Techniques

[T1566] Phishing – Threat actors use social media ads and fake news articles to lure victims to scam webpages. ‘Threat actors use social media ads and fake news articles to lure victims to scam webpages.’
[T1584] Impersonation – Deepfake videos impersonate public figures to gain trust and promote scams. ‘Deepfake videos impersonate public figures to gain trust and promote scams.’
[T1483] Domain Generation Algorithms – Attackers register numerous domains to host scam content and evade detection. ‘Attackers register numerous domains to host scam content and evade detection.’
[T1003] Credential Dumping – Scammers collect personal information from victims through registration forms on scam sites. ‘Scammers collect personal information from victims through registration forms on scam sites.’
[T1486] Data Encrypted for Impact – Scammers may lock victims out of their accounts, preventing fund withdrawal. ‘Scammers may lock victims out of their accounts, preventing fund withdrawal.’

Indicators of Compromise

[Domain] Campaign hosting infrastructure – belmar-marketing.online, fiirststreeeet.top, and 2 more domains (ai-usmcollective.click, fortunatenews.com)
[Webpage URL] Deepfake scam landing pages – xtradgpt[.]online, euphemiouslystner[.]life
[Video URL] Deepfake video assets – hxxps://quontic[.]site/wp-content/uploads/2024/07/449030935_482215324194392_281914555774571171_n[.]mp4, hxxps://fortunatenews[.]com/video/quantumal__video[.]mp4
[Domain] KazMunayGas scam domain – coinframework[.]top
[Webpage URL] Invest-toolavenue[.]shop – used in World Bank-themed scams to promote a fake investment program