Group-IB have exposed an AI-trading scam using deepfakes of Dutch politician Geert Wilders as part of a misinformation campaign to attract victims to an investment scam.
The new report has exposed a worrying rise in sophisticated online trading scams that leverage artificial intelligence (AI) and deepfake technology to deceive victims. According to an investigation, fraudsters are using AI-generated videos of public figures to falsely endorse fake trading platforms, creating a false sense of legitimacy and trust.
The research found that deepfake videos are now a central component of these campaigns. These scams rely on a network of fake blogs, review sites and social media channels to distribute misleading content and lure users into investing money in fraudulent schemes.
The investigation began after a sponsored YouTube video was discovered that featured a deepfake of Geert Wilders, a well-known Dutch politician. The video, created with synthetic voice cloning and AI-generated visuals, was designed to mimic a legitimate news segment. It showed the politician revealing a “secret” AI trading platform that could generate significant passive income with minimal effort. The narrative was crafted to create a sense of urgency and exclusivity, claiming the politician was risking his career to help “ordinary people.”
At the end of the video, viewers were encouraged to click a link to a fraudulent article styled to look like a reputable media outlet. The page’s primary goal was to convince the user to register and get them involved in the scam.
Key findings from the investigation reveal a coordinated effort behind these global campaigns:
- Deepfakes are central: AI-generated visuals and voices of public figures, like politicians, are used to falsely promote fraudulent trading platforms and build trust with potential victims.
- Fake reviews and blogs: Scam operations create fake blogs and review sites on platforms such as Medium and Blogspot to manufacture a false sense of legitimacy.
- Targeted content: Websites use scripts to localise content based on a user’s IP address and language, making the scam feel more trustworthy and region-specific.
- Coordinated infrastructure: A small number of registrants are linked to dozens of malicious domains, indicating a highly organised infrastructure behind the fraud.
The report serves as a warning to both cybersecurity professionals and consumers, highlighting that while AI is now a part of everyday life – especially in finance – its use by sophisticated fraudsters presents a significant new threat.
