This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Cybersecurity researchers at Bitdefender Labs identified a widespread malvertising campaign on Reddit where threat actors impersonated major news outlets like the BBC and The Guardian. The campaign utilized deepfake video segments and cloned websites to promote fraudulent AI-themed investment platforms such as Wencoin STX and Nevo Coin. Victims were lured through high-pressure social engineering tactics and fake financial success stories, with the ultimate goal of harvesting personal contact information and soliciting fraudulent deposits.
Sponsored Reddit ads reportedly impersonated the BBC, Financial Times, and The Guardian to promote purportedly fake AI investment platforms including Wencoin STX, Warrior Coin AI, and Nevo Coin. The campaign allegedly dressed the scam as legitimate financial journalism, using cloned publisher pages and deepfake-style news footage to pressure users into sharing contact details and making deposits.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The campaign relied on fabricated news stories and cloned websites to mislead users.
The incident involves threat actors using AI-generated deepfakes and cloned media websites to execute targeted investment scams and harvest personal information for financial gain.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The risk was caused by human threat actors who intentionally deployed deepfake generation tools and cloned websites post-deployment to execute a financial scam.
Added categories peak at 2: Minor (Epistemic Harm, Direct)
A sophisticated Reddit malvertising campaign exploited AI-generated deepfakes of news anchors and cloned websites of major media outlets to run investment scams targeting US and European users. While demonstrating evolved capabilities in synthetic media fraud, the incident presents minor national security risk, primarily affecting individual economic security and information integrity.
The AI involved in the incident consists of deepfake generation tools used by scammers to create realistic video segments of news anchors. These systems function as tools that perform specific, well-defined image and voice synthesis tasks based on direct inputs.
Limited Risk: The report describes the use of AI-generated deepfakes, which fall under the Limited Risk category of the EU AI Act, requiring transparency obligations to inform users they are interacting with synthetic media.
The threat actors utilized AI primarily to generate deepfake video segments of news anchors to make their fraudulent advertisements appear as legitimate news broadcasts.
The reports from Bitdefender and Mashable provide clear, detailed, and consistent accounts of the malvertising campaign, the platforms targeted, the brands impersonated, and the mechanics of the scam. The role of AI (deepfakes and AI-themed narratives) is explicitly documented.
None. The campaign is unambiguously a fraudulent investment scam using deceptive advertising and deepfakes.
Technology
Deepfake Video Generation
Scammers generated deepfake BBC video segments to deceive Reddit users.
Evasion of Automated Ad Filters
Deceptive ads bypassed Reddit's automated screening and moderation tools.
AI-Themed Narrative Exploitation
Use of automated trading and AI hype to lure victims into investment scams.
Human Factors
FOMO on AI Investment Hype
Users' fear of missing out on AI IPOs and tech trends made them vulnerable.
Trust in Cloned Media Brands
Victims trusted fake articles because they impersonated known news outlets.
Susceptibility to Deepfakes
Users struggled to distinguish deepfake BBC videos from real news broadcasts.
Process and Methods
Inadequate Ad Verification
Reddit's ad review processes failed to validate the authenticity of ads.
Rapid Domain Rotation
Scammers quickly rotated short-lived domains to evade detection systems.
Multi-Stage Funneling Tactics
Complex redirection paths obscured the scam from simple automated checks.
Management
Failure to Detect Recycled Scams
Platforms failed to prevent tactics previously observed on Meta in March 2026.
Reliance on Third-Party Vendors
Reddit relied on external partners to validate ad authenticity post-facto.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
