Deepfake Stock Tips Pushed via WhatsApp

Group-IB warns that organized investment fraud is using deepfake video “endorsements,” WhatsApp groups, and professional-looking fake crypto platforms to trick victims into sending money. The models described (“GoldBull” and “CoinLure”) include pump-and-dump stock manipulation and a large network of templated fake crypto investment sites, with evidence of impersonation and cross-platform coordination.

Key findings

• Group-IB says fraud schemes combine deepfake videos, WhatsApp groups, and fake crypto platforms and could spread to GCC markets.
• Two named fraud models are described: GoldBull (pump-and-dump using legitimate stock markets) and CoinLure (200+ fake crypto platforms built from shared templates).
• The scams include impersonation, including “more than 20 fake WhatsApp accounts” impersonating an Australian economist.
• The article highlights indicators of fraud: cloned branding/license numbers, platforms accepting only cryptocurrency, and platforms requiring payments before withdrawals.

Who’s being targeted

• Commonly targeted roles: All employees, Finance, Executives, Investor relations / treasury (if applicable).
• Affected industries: Financial services, Retail investing, Cryptocurrency / digital assets.
• Attack channels: whatsapp, website, telegram.
• Impersonated: A well-known economist/investment expert (impersonated via WhatsApp accounts and deepfake video), A regulated investment/crypto firm (brand and license numbers cloned).

Awareness takeaways

• Treat investment offers promoted in WhatsApp/Telegram as high risk and verify through official, regulated channels.
• Do not trust video “endorsements” as proof, deepfakes are being used to manufacture credibility.
• Be cautious of platforms that only accept cryptocurrency or use extra ‘fees’ to release withdrawals, these are common scam mechanics.
• Watch for impersonation signals (cloned branding/license numbers, multiple lookalike accounts) and report suspected fraud early.

Red flags to watch for

• Investment opportunities promoted through WhatsApp groups
• Video endorsement presented as “proof”
• Branding/license numbers that appear cloned from regulated firms
• “Any platform that accepts only cryptocurrency”
• Requirements to make payments before withdrawals
• Promotions originating from WhatsApp/Telegram rather than official channels