Nomani AI-Generated Deepfake Phishing Campaign Targets Social Media Users
Cybersecurity researchers identified a phishing scam called Nomani that uses AI-generated video testimonials and deepfake content to impersonate famous personalities and deceive social media users into visiting phishing sites. The scam, reportedly operated by Russian-speaking threat actors, grew by over 335% between H1 and H2 2024, with fraudsters using stolen personal data to manipulate victims into investing in non-existent financial products.
What happened
Cybersecurity researchers identified a phishing scam called Nomani that uses AI-powered video testimonials featuring famous personalities to defraud social media users. Fraudsters distribute malvertising and company-branded posts across social media platforms, directing victims to phishing websites and forms that harvest personal information.
The scam grew by over 335% between H1 and H2 2024, with more than 100 new URLs detected daily on average between May and November 2024. Attackers use fraudulent ads published from fake and stolen legitimate profiles associated with small businesses, governmental entities, and micro-influencers, as well as distribution through Messenger, Threads, and deceptive Google reviews.
Reported impact
Victims are manipulated into investing money into non-existent investment products that falsely show phenomenal gains. In some cases, victims are duped into taking out loans or installing remote access apps on their devices.
When victims request payout of promised profits, scammers force them to pay additional fees and provide further personal information such as ID and credit card information before taking both the money and data and disappearing.
Index analysis
ESET attributed the scam to Russian-speaking threat actors based on the presence of source code comments in Cyrillic and the use of Yandex tools for visitor tracking. The phishing websites imitate local news media, abuse logos of specific organizations, or claim to advertise cryptocurrency management solutions with names such as Quantum Bumex, Immediate Mator, or Bitcoin Trader.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.