Deepfake trap: Group-IB warns Gulf investors over WhatsApp crypto & stock scams
Group-IB, a creator of predictive cybersecurity technologies, has issued a comprehensive security advisory targeting retail investors and financial organizations across the GCC. The warning details how two active digital investment fraud networks are deploying AI-generated deepfakes and private messaging apps to target Gulf capital markets.
The alert stems from investigations conducted by Group-IB’s META Threat Intelligence and Fraud Protection teams, which identified two core operational schemes:
GoldBull Scheme
Leverages short-lived paid advertisements on Meta platforms featuring deepfake video and voice clones of high-profile financial professionals. Victims are lured into private WhatsApp groups and instructed to purchase specific small-cap stocks on regulated public exchanges. In one documented instance, coordinated buying drove a stock up by 12.4% before operators dumped their positions, inflicting a 42.4% loss on retail entry prices.
CoinLure Scheme
Manages an interconnected infrastructure of over 200 deceptive cryptocurrency investment websites. The portals present fabricated returns and exclusively accept crypto deposits. When victims attempt to withdraw funds, the operators demand secondary fees for invented taxes, compliance charges, or account upgrades.
Group-IB highlighted several regional variables that make Gulf markets attractive to international syndicates. WhatsApp serves as the primary regional channel for business and financial conversations. Additionally, high crypto adoption rates—highlighted by the UAE ranking fifth globally on the Henley Crypto Adoption Index and Saudi Arabia registering a 154% YoY surge in crypto transaction value—make new retail investors prime targets for fraudsters cloning legitimate corporate licenses.
Group-IB advises retail market participants to treat all investment leads originated via messaging platforms as fraudulent until independently verified with national regulatory authorities, urging enterprises to deploy automated digital risk monitoring to quickly take down brand-impersonating deepfakes.
