Threat reportFraudTL-2026-0017
Global HYIP Investment Scam Campaign - 4,200+ Fake Trading Platforms
Global HYIP Investment Scam Campaign (TL-2026-0017), also tracked as HYIP, is a medium-severity fraud campaign scored CVSS 5, first published 2026-02-02. It carries a reported China nexus and is not formally attributed, affects N/A Individual Investors, maps to 14 MITRE ATT&CK techniques (T1005, T1036, T1056), and is covered by 12 detection rules and 37 indicators of compromise.
- CVSS
- 5/10Medium
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 12SPL · KQL · Sigma
- IOCs
- 37Indicators of compromise
Key facts for TL-2026-0017
- Threat ID
- TL-2026-0017
- Also known as
- HYIP, High-Yield Investment Program, Crypto Ponzi, Investment Scam
- Severity
- MEDIUM
- CVSS
- 5 (N/A - Financial Fraud)
- Status
- ACTIVE
- Category
- FRAUD
- First published
- Last reviewed
- Attribution confidence
- NONE
- Nation-state nexus
- China
- Motivation
- FINANCIAL
- Target sectors
- All Sectors (individuals), Finance, Cryptocurrency
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 12
- Indicators of compromise
- 37
How Global HYIP Investment Scam Campaign works
A massive, globally coordinated investment scam campaign operates 4,200+ fake trading platforms impersonating legitimate financial services including cryptocurrency exchanges, forex brokers, and stock trading applications. These High-Yield Investment Program (HYIP) scams constitute the single largest category of financial fraud by dollar loss, with the FBI's Internet Crime Complaint Center (IC3) reporting $4.57 billion in investment fraud losses in 2023 alone — exceeding all other fraud categories. The campaign infrastructure includes: (1) Industrialized platform creation using website templates and white-label trading platform clones that mimic Coinbase, Binance, Robinhood, and traditional brokerages; (2) Social engineering via 'pig butchering' (sha zhu pan) — romance/friendship grooming over weeks or months before introducing the fake investment opportunity; (3) Fake returns displayed on fraudulent platforms showing growing portfolios to encourage larger deposits; (4) Cryptocurrency-based fund collection making recovery nearly impossible; (5) Multi-jurisdictional infrastructure spanning Southeast Asia (primarily Cambodia, Myanmar, Laos, Philippines) with forced labor operations trafficking victims to staff scam call centers; (6) AI-enhanced operations using deepfakes for impersonation, AI chatbots for grooming at scale, and AI-generated financial advisor personas. The operational scale is industrial: organized crime syndicates (primarily Chinese-origin transnational organized crime groups) operate compound-style facilities housing hundreds of scam operators, many of whom are human trafficking victims forced to participate under threat of violence.
HYIP investment scam campaigns represent the intersection of financial fraud, organized crime, human trafficking, and technology abuse at unprecedented scale.
**The Pig Butchering Model (Sha Zhu Pan):**
The dominant social engineering methodology is 'pig butchering' — a term coined by the perpetrators themselves, referring to 'fattening the pig before slaughter':
1. **Contact**: Victim is contacted via dating apps (Tinder, Bumble, Hinge), social media (Instagram, LinkedIn, Facebook), or messaging (WhatsApp, Telegram, WeChat). The 'wrong number' text message is a common cold approach.
2. **Grooming (weeks to months)**: The scammer builds a romantic or friendship relationship. They present as a successful, attractive individual (photos stolen from social media or AI-generated). They discuss their lifestyle, eventually mentioning investment success.
3. **Introduction**: The scammer introduces their 'investment platform' — a fake trading app or website that displays real-time cryptocurrency/forex prices but is entirely controlled by the scammers.
4. **Small wins**: The victim makes a small deposit and sees immediate returns. They may even be allowed to withdraw a small amount to build confidence.
5. **Escalation**: Encouraged by fake returns, the victim deposits larger amounts — often depleting savings, taking loans, borrowing from family.
6. **Slaughter**: When the victim tries to withdraw, they encounter fees, taxes, verification requirements — all designed to extract more money. Eventually the platform disappears and the scammer goes silent.
**Platform Infrastructure (4,200+ Sites):**
The scam platforms are industrialized: - White-label trading platform kits available for $500-$5,000 on underground markets - Templates clone Coinbase, Binance, Robinhood, MetaTrader, TD Ameritrade interfaces - Real-time price feeds from legitimate exchanges create appearance of authenticity - Fake mobile apps distributed via direct download links (bypassing App Store/Play Store review) - Some apps have temporarily appeared on legitimate app stores before removal - Domain infrastructure uses newly-registered domains with legitimate-looking names - SSL certificates and professional design make platforms indistinguishable from legitimate services - Backend allows operators to control displayed balances, returns, and withdrawal availability
**Operational Infrastructure (Southeast Asia Compounds):**
The FBI, Interpol, and UNODC have documented industrial-scale scam compound operations: - Primarily located in Cambodia, Myanmar (Myawaddy, KK Park), Laos, Philippines - Operated by Chinese-origin transnational organized crime groups - Compounds house hundreds to thousands of scam operators - Many operators are HUMAN TRAFFICKING VICTIMS — recruited with false job promises, passports confiscated, forced to work under threat of violence - Operations run 12-16 hour shifts targeting victims in English, Chinese, Japanese, Korean, and other languages - UN estimates 100,000+ people trafficked into scam compounds in Myanmar alone - Compounds include dormitories, cafeterias, and armed security — victims cannot leave
**Financial Scale:**
- FBI IC3 2023: $4.57 billion in investment fraud losses (highest category) - FBI IC3 2022: $3.31 billion in investment fraud losses - Global estimates: $50+ billion annually across all pig butchering operations - Average victim loss: $100,000-$500,000 (some lose millions) - Recovery rate: <5% — cryptocurrency transactions are largely irreversible - Victim demographics: all ages, education levels, income brackets — not limited to vulnerable populations
**AI Enhancement:**
- Deepfake video calls impersonating financial advisors or romantic interests - AI chatbots handling initial grooming conversations at scale - AI-generated photos for scammer personas (StyleGAN-generated faces) - AI translation enabling operators to target victims in multiple languages - AI-generated financial documents (statements, tax forms, regulatory filings) - Voice cloning for phone conversations matching the scammer's presented persona
MITRE ATT&CK techniques used in TL-2026-0017
collection
T1005 Data from Local System; T1056 Input Capture
defense-evasion
execution
impact
T1485 Data Destruction; T1491 Defacement; T1565 Data Manipulation; T1657 Financial Theft
initial-access
exfiltration
T1567 Exfiltration Over Web Service
resource-development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities
reconnaissance
Affected products and versions in Global HYIP Investment Scam Campaign
- N/A — Individual Investors
Vulnerable versions: Global victims
Remediation for Global HYIP Investment Scam Campaign
Immediate actions
- Educate employees about HYIP scam tactics
- Block known HYIP domains at web proxy
- Alert finance team to monitor for unusual crypto transactions
- Report scam sites to hosting providers and registrars
Workarounds
- Verify any investment platform through official financial regulators
- Never invest based on social media ads or Telegram groups
- Be suspicious of any 'guaranteed' returns over 10% annually
Longer-term hardening
- Implement web filtering for high-risk investment sites
- Deploy anti-fraud training for all staff
- Monitor for corporate email addresses used on scam platforms
- Subscribe to HYIP domain blocklists
Weaknesses (CWE) in Global HYIP Investment Scam Campaign
Timeline of Global HYIP Investment Scam Campaign
- Pig butchering (sha zhu pan) scams emerge from China and rapidly expand to Southeast Asia. Criminal organizations establish compound-style operations in Cambodia, Myanmar, and Laos. Early campaigns primarily target Chinese-speaking victims but rapidly expand to English, Japanese, Korean, and other languages.
- FBI IC3 2022 Annual Report documents $3.31 billion in investment fraud losses — the highest loss category. Investment fraud increased 127% from 2021. Cryptocurrency-related investment fraud specifically increased from $907M to $2.57B. FBI warns of 'rapidly increasing' pig butchering schemes.
- Sophos documents CryptoRom fake trading apps that bypassed Apple App Store and Google Play Store review processes. Apps use legitimate-looking interfaces mimicking Coinbase/Binance. Distributed via TestFlight (iOS) and side-loading (Android). Some briefly appeared on official stores. Source: https://news.sophos.com/en-us/2023/02/01/cryptorom-apps-on-app-stores/
- UNODC publishes comprehensive report on casinos, cyber fraud, and human trafficking in Southeast Asia. Estimates 100,000+ people trafficked into scam compounds in Myanmar alone. Documents compound operations in Cambodia (Sihanoukville), Myanmar (Myawaddy, KK Park), Laos, Philippines. Operators forced to work 12-16 hour shifts under armed guard. Source: UNODC
- FBI IC3 2023 Annual Report: $4.57 billion in investment fraud losses — new record, 38% increase from 2022. Investment fraud is now the HIGHEST dollar-loss crime category reported to IC3, exceeding BEC ($2.9B) and all other categories. Pig butchering specifically called out as primary driver. Source: https://www.ic3.gov/AnnualReport/Reports/2023_IC3Report.pdf
- AI enhancement of pig butchering operations documented: deepfake video calls impersonating financial advisors, AI chatbots handling initial grooming conversations at scale, StyleGAN-generated photos for scammer personas, AI translation enabling multi-language targeting, voice cloning for phone calls. AI dramatically increases the scale and sophistication of grooming operations.
- As of 2026-05-29, this HYIP/pig-butchering fake-trading-platform campaign remains ACTIVE and growing: IC3's 2025 report shows crypto investment fraud up 24% to $7.2B+ and the UN counts 250+ Cambodian compounds with 100,000+ trafficked workers still operating. Major 2026 takedowns (276 arrests, $701M seized; Prince Group $15B forfeiture) disrupted but did not end the resilient ecosystem, as operators simply migrate infrastructure.
Sources cited for Global HYIP Investment Scam Campaign
Detection coverage for TL-2026-0017
As of 2026-02-02, Threadlinqs Intelligence publishes 12 detection rule(s) for TL-2026-0017 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.