Group-IB Warns Gulf Investors of Deepfake Stock Scams and Fake Crypto Platforms on WhatsApp

Cybersecurity researchers have issued a high-priority warning to financial institutions in the Gulf Cooperation Council (GCC) regarding two sophisticated investment fraud models. As retail participation and cryptocurrency adoption surge in the Middle East, these portable schemes—utilizing deepfakes and private messaging groups—are now being actively deployed to exploit the region's digital-first financial ecosystem.

What was announced

Group-IB’s regional team in the META region has identified two distinct fraud operations, tracked as GoldBull and CoinLure, which are rapidly transitioning into Gulf markets after successful deployments in Australia and the United States. These operations leverage deepfake videos of prominent finance professionals to recruit victims through paid advertisements on Facebook and Instagram, eventually funneling them into private WhatsApp groups.

The GoldBull scheme operates as a coordinated "pump and dump" maneuver. Researchers documented cases where victims were instructed to purchase small-cap stocks on regulated exchanges. In one instance, coordinated buying from as few as 500 to 3,000 participants pushed a stock price up by 12.4% before a planned collapse resulted in a 42.4% loss for retail investors. The capital required to manipulate the market in this fashion is estimated between US$1.5 million and US$3 million.

The CoinLure operation utilizes a network of over 200 fraudulent cryptocurrency platforms built on shared templates. These sites promise impossible daily returns and exclusively accept deposits in BTC, ETH, and USDT-TRC20. Analysis of a single platform revealed over US$90,000 in deposits since 2022. When victims attempt to withdraw funds, the operators demand fabricated "compliance charges" or "taxes," often following up with a secondary scam disguised as a "recovery firm."

"The assessment comes from Group-IB’s regional team in the META region and draws on a two-part investigation, published earlier this year, into fraud operations targeting victims in Australia and the United States. Both operations recruit through deepfake videos of well-known finance professionals and private WhatsApp groups. Neither is tied to the markets where it was observed: the advertising, the messaging-app coordination and the platform infrastructure can be pointed at a new country within days."

Group-IB META Regional Team

The companies involved

Group-IB is a global creator of predictive cybersecurity technologies focused on investigating and preventing digital crime. The firm utilizes a "Cyber Fraud Fusion" approach that integrates threat intelligence with on-chain cryptocurrency analysis to disrupt entire criminal infrastructures rather than isolated incidents. Their META regional team specifically monitors threats across the Middle East, Africa, and Turkey.

The fraud schemes rely heavily on the infrastructure of major social and messaging platforms. WhatsApp, owned by Meta, serves as the primary coordination hub for these actors, while Facebook and Instagram are utilized for the initial dissemination of deepfake advertisements. The researchers also noted the use of Telegram for similar fraudulent promotions. The growth of these schemes in the Gulf is linked to high crypto adoption rates; the UAE currently ranks fifth globally on the 2025 Henley Crypto Adoption Index, and Saudi Arabia has seen crypto activity grow 154% year-on-year to approximately US$31 billion in transaction value. This environment provides a fertile ground for actors like CoinLure to deploy their fake investment templates.

What FF News has reported before

The rise of messaging-based financial services has been a recurring theme in recent months. FF News recently covered how Swapiz Launches Telegram Swap Bot to Streamline Non-Custodial Crypto Exchanges and the debut of Bella Protocol Debuts Bella Alpha: AI-Powered Trading Signals and Research via Telegram. While these tools aim to streamline legitimate trading, their existence highlights the industry shift toward the very channels fraudsters are now exploiting. Additionally, the CFA Institute Demands Stricter Private Credit Safeguards Amid Rapid Retail Market Expansion, reflecting a broader institutional concern regarding the protection of retail investors as they gain access to increasingly complex financial products, such as the Volt Funded Launches Global Prop Trading Platform with 90% Profit Share Model.

What this means

The migration of GoldBull and CoinLure to the GCC puts immediate pressure on regional regulators and traditional financial institutions to update their fraud detection parameters. The use of deepfakes to impersonate trusted voices bypasses traditional "know your customer" (KYC) psychological barriers, making the fraud appear as a legitimate endorsement. As long as retail investors view private messaging groups as valid sources for financial advice, the barrier to entry for international fraud syndicates remains dangerously low. The industry must now grapple with the fact that regulated exchanges are being used as the final stage for "pump and dump" schemes, suggesting that monitoring stock price volatility alone is no longer sufficient to protect the retail base.