This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The 'Nomani' phishing campaign, active throughout the second half of 2024, utilized AI-generated deepfakes and video testimonials to impersonate legitimate services and celebrities. These assets were used to lure victims into sophisticated investment scams, resulting in significant financial and data loss. The campaign leveraged social media malvertising and stolen accounts to distribute phishing links, demonstrating a coordinated effort by threat actors to exploit AI for financial fraud.
AI-generated deepfakes were reportedly used in the "HTML/Nomani" phishing campaign to mimic legitimate platforms like booking services and lured victims into investment scams. These scams allegedly leveraged realistic fake content to deceive users on social media for the purposes of financial fraud. This campaign was part of the rising misuse of AI in cybercrime during the second half of 2024.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The phishing infrastructure set up via the AI-driven lures harvested victims' sensitive personal information, including IDs and credit card details.
The Nomani campaign used AI-generated deepfakes of celebrities to impersonate trusted individuals and execute fraudulent investment scams for financial gain.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by human threat actors intentionally deploying AI-generated deepfakes post-deployment to execute financial scams.
Added categories peak at 3: Substantial (Psychological Harm, Inferred)
The Nomani campaign represents an evolved cybercrime threat leveraging AI-generated deepfakes for financial fraud and data harvesting. While causing millions in losses and exploiting thousands of victims globally, its national security impact remains minor as it does not target critical infrastructure, state sovereignty, or strategic economic systems.
The AI is used as a tool to generate deepfake video testimonials of famous personalities. The report states the scam leverages 'artificial intelligence (AI) powered video testimonials featuring famous personalities' to lure victims.
Limited Risk: The system involves AI-generated content such as deepfakes. According to the definitions, Risk Level 3 applies to 'AI-generated content such as deepfakes' which require transparency obligations.
The AI was used to generate video testimonials featuring famous personalities (deepfakes) to deceive victims.
The report clearly details the mechanics of the Nomani phishing campaign, the role of AI-generated deepfakes as lures, and the resulting financial and data harms. While exact victim counts for Nomani are not specified, the overall threat landscape and campaign growth are well-documented by ESET.
None
Technology
AI-Powered Video Testimonials
Deepfake videos of famous figures are used to build trust with victims.
Malicious Screen Capture Software
Illicit programs spy on users' screens to collect unauthorized data.
Automated Phishing Infrastructure
Rapid generation of daily new URLs evades security detection systems.
Data Inputs
Harvested Personal Information
Phishing forms collect victim contact details to enable direct phone scams.
Stolen Profile Data
Abuse of legitimate accounts and profiles to distribute fraudulent ads.
Real-Time Stock Market Data
Programs use real brokerage data to display fake trading charts.
Human Factors
Susceptibility to Social Engineering
Victims are manipulated into trusting fake recovery lures and phone calls.
Overconfidence in Ad Platforms
Users trust ads appearing on major social media platforms and Google.
Trust in Impersonated Authorities
Targeting previously scammed victims using fake Europol and Interpol lures.
Process and Methods
Inadequate Ad Verification
Social media platforms fail to detect and block AI-generated scam ads.
Evading Bank Verification
Social engineering tactics bypass bank authorization and verification calls.
Segmented Cybercrime Operations
Dividing tasks among specialized groups makes the scam chain highly efficient.
Management
Weak Platform Moderation Oversight
Meta and Google fail to manage and police fraudulent profiles and reviews.
Inadequate Scam Tracking
Delayed response in identifying and taking down malicious domains.
Regulatory Environment
Lack of Global Ad Regulation
Weak cross-border enforcement allows foreign threat actors to run scam ads.
Inadequate Identity Verification
Easy registration of fake profiles on social platforms enables rapid scaling.
AI system involved
An AI system was involved, but the reports do not identify it.
Identified by automated extraction; can differ from the alleged developers above.
