This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Security researchers at Cato CTRL identified a threat actor, ProKYC, selling a deepfake-based tool designed to bypass biometric and document-based identity verification on cryptocurrency exchanges. The tool generates synthetic personas and forged government documents to facilitate new account fraud, money laundering, and identity theft. The report highlights the increasing sophistication of AI-powered tools in the cybercriminal underground and provides a demonstration of the tool successfully verifying a fake account on ByBit.
Cato CTRL security researchers reported that the cybercriminal group ProKYC is selling a deepfake tool capable of bypassing biometric and two-factor authentication (2FA) systems on cryptocurrency exchanges. The tool creates synthetic identities using AI-generated videos and forged documents, enabling fraudulent account creation. A demo video from ProKYC shows the tool in action against ByBit, allowing attackers to verify fake accounts for purposes such as money laundering and identity theft.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The tool exploits vulnerabilities in biometric facial recognition and document verification systems to inject synthetic media and bypass security controls.
The ProKYC tool is designed and sold specifically to facilitate financial fraud, scams, and identity deception by bypassing KYC security controls on cryptocurrency exchanges.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The risk is caused by human threat actors intentionally developing, selling, and deploying a deepfake tool to commit financial fraud after the underlying AI models have been trained.
Added categories peak at 3: Substantial (Epistemic Harm, Inferred)
The ProKYC deepfake tool represents an evolved cybercriminal capability designed to bypass biometric and document-based identity verification on financial platforms. While it poses a minor threat to financial and economic security by enabling money laundering and fraud, it does not currently present a direct threat to physical infrastructure or state sovereignty.
The ProKYC application operates as a tool, performing the specific, well-defined function of generating synthetic documents and videos based on direct user inputs without autonomous planning or context retention.
Risk Level 3: The system is a deepfake generation tool used to create synthetic videos and documents, which falls under Limited Risk due to transparency obligations for AI-generated content.
The tool's primary function is to generate synthetic videos of fake personas that mimic head movements to pass facial recognition challenges, alongside generating fake passport images.
The report clearly details the functionality of the ProKYC tool, its target (cryptocurrency exchanges like ByBit), and how it operates to bypass 2FA. There is little ambiguity about its purpose and capabilities.
None
Technology
Camera Input Spoofing
Tool injects pre-recorded deepfake video directly into the camera stream.
Lax Facial Recognition
Algorithms ignore minor glitches to avoid false positives for users.
Accessible Generative AI
Commodity AI tools make high-quality face generation extremely easy.
Data Inputs
Synthetic Biometric Data
Deepfake videos mimic required head movements to trick liveness checks.
High-Quality Document Forgery
AI-generated photos are layered onto realistic passport templates.
Human Factors
Lack of Manual Oversight
Operators do not manually inspect suspicious verification attempts.
Process and Methods
Weak Liveness Detection
Verification processes fail to detect virtual camera injection.
Inadequate Glitch Detection
Processes do not flag digital artifacts and eye movement anomalies.
Management
Prioritizing Frictionless UX
Management prioritizes easy onboarding over strict biometric security.
Poor Threat Intelligence
Firms fail to track emerging dark web threats like ProKYC.
Regulatory Environment
Lax Biometric Regulations
Regulatory standards do not mandate advanced anti-deepfake checks.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
