Fake financial analysts scam investors via WhatsApp
Scammers use deepfake video ads of fake financial analysts to pull investors into WhatsApp groups, then push rigged stock tips or fake trading platforms that eventually block withdrawals.
- Report priority
- Medium
How it works
- Short-lived deepfake ads impersonating analysts route selected viewers through location-based redirects into WhatsApp groups, where a fake head analyst tells members to buy a specific stock so the operators, who already hold shares, can sell into the buying pressure the group creates.
- A related operation instead funnels victims to polished fake trading...
What to do
If you joined a WhatsApp group after clicking a short-lived ad claiming to feature a financial analyst, or deposited money on an unfamiliar trading or crypto platform that later demanded extra fees before allowing a withdrawal, treat any stock or crypto tip from an unsolicited WhatsApp group as a manipulation attempt, never pay extra taxes, insurance, or upgrade fees to unlock a withdrawal, and report the ad, group, or platform to your brokerage, bank, or national fraud reporting service.
Technical details
On November 6, 2025, members of a GoldBull WhatsApp group are told to buy a Nasdaq-listed stock at $24.79, with a promised exit around $29. Coordinated buying from about 1,000 group members pushes the price to $27.87, a 12.4% rise. The operators, who already hold shares in the stock, sell into that buying pressure. By February the price has fallen to $14.27, 42% below what the victims paid.
Group-IB tracked two operations, GoldBull and CoinLure, that pair deepfake advertising with legitimate platforms like WhatsApp and real brokerages to add a veneer of authenticity. GoldBull campaigns are estimated to move $1.5 million to $3 million in victim capital each by staging small-cap pump-and-dump trades inside closed WhatsApp groups of roughly 1,000 people. One confirmed CoinLure fake-investment network spanned 208 domains built from 23 shared templates on common hosting with reused contact details, with estimated revenue of $187 million. Because both operations reuse hosting, templates, contact details, wallets, and WhatsApp-number patterns across campaigns, researchers can map and disrupt the shared infrastructure even though the fraudulent payments themselves look legitimate.