# Global HYIP Investment Scam Campaign - 4,200+ Fake Trading Platforms

> A massive, globally coordinated investment scam campaign operates 4,200+ fake trading platforms impersonating legitimate financial services including cryptocurrency exchanges, forex brokers, and stock trading applications. These High-Yield Investment Program (HYIP) scams constitute the single largest category of financial fraud by dollar loss, with the FBI's Internet Crime Complaint Center (IC3) reporting $4.57 billion in investment fraud losses in 2023 alone — exceeding all other fraud categories. The campaign infrastructure includes: (1) Industrialized platform creation using website templates and white-label trading platform clones that mimic Coinbase, Binance, Robinhood, and traditional brokerages; (2) Social engineering via 'pig butchering' (sha zhu pan) — romance/friendship grooming over weeks or months before introducing the fake investment opportunity; (3) Fake returns displayed on fraudulent platforms showing growing portfolios to encourage larger deposits; (4) Cryptocurrency-based fund collection making recovery nearly impossible; (5) Multi-jurisdictional infrastructure spanning Southeast Asia (primarily Cambodia, Myanmar, Laos, Philippines) with forced labor operations trafficking victims to staff scam call centers; (6) AI-enhanced operations using deepfakes for impersonation, AI chatbots for grooming at scale, and AI-generated financial advisor personas. The operational scale is industrial: organized crime syndicates (primarily Chinese-origin transnational organized crime groups) operate compound-style facilities housing hundreds of scam operators, many of whom are human trafficking victims forced to participate under threat of violence.

- **Published:** 2026-02-02T19:56:00Z
- **Last reviewed:** 2026-02-02T19:56:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0017
- **ID:** TL-2026-0017
- **Severity:** MEDIUM (CVSS 5)
- **Category:** FRAUD
- **Status:** ACTIVE
- **Detections:** 12 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)

## Description

HYIP investment scam campaigns represent the intersection of financial fraud, organized crime, human trafficking, and technology abuse at unprecedented scale.

**The Pig Butchering Model (Sha Zhu Pan):**

The dominant social engineering methodology is 'pig butchering' — a term coined by the perpetrators themselves, referring to 'fattening the pig before slaughter':

1. **Contact**: Victim is contacted via dating apps (Tinder, Bumble, Hinge), social media (Instagram, LinkedIn, Facebook), or messaging (WhatsApp, Telegram, WeChat). The 'wrong number' text message is a common cold approach.

2. **Grooming (weeks to months)**: The scammer builds a romantic or friendship relationship. They present as a successful, attractive individual (photos stolen from social media or AI-generated). They discuss their lifestyle, eventually mentioning investment success.

3. **Introduction**: The scammer introduces their 'investment platform' — a fake trading app or website that displays real-time cryptocurrency/forex prices but is entirely controlled by the scammers.

4. **Small wins**: The victim makes a small deposit and sees immediate returns. They may even be allowed to withdraw a small amount to build confidence.

5. **Escalation**: Encouraged by fake returns, the victim deposits larger amounts — often depleting savings, taking loans, borrowing from family.

6. **Slaughter**: When the victim tries to withdraw, they encounter fees, taxes, verification requirements — all designed to extract more money. Eventually the platform disappears and the scammer goes silent.

**Platform Infrastructure (4,200+ Sites):**

The scam platforms are industrialized:
- White-label trading platform kits available for $500-$5,000 on underground markets
- Templates clone Coinbase, Binance, Robinhood, MetaTrader, TD Ameritrade interfaces
- Real-time price feeds from legitimate exchanges create appearance of authenticity
- Fake mobile apps distributed via direct download links (bypassing App Store/Play Store review)
- Some apps have temporarily appeared on legitimate app stores before removal
- Domain infrastructure uses newly-registered domains with legitimate-looking names
- SSL certificates and professional design make platforms indistinguishable from legitimate services
- Backend allows operators to control displayed balances, returns, and withdrawal availability

**Operational Infrastructure (Southeast Asia Compounds):**

The FBI, Interpol, and UNODC have documented industrial-scale scam compound operations:
- Primarily located in Cambodia, Myanmar (Myawaddy, KK Park), Laos, Philippines
- Operated by Chinese-origin transnational organized crime groups
- Compounds house hundreds to thousands of scam operators
- Many operators are HUMAN TRAFFICKING VICTIMS — recruited with false job promises, passports confiscated, forced to work under threat of violence
- Operations run 12-16 hour shifts targeting victims in English, Chinese, Japanese, Korean, and other languages
- UN estimates 100,000+ people trafficked into scam compounds in Myanmar alone
- Compounds include dormitories, cafeterias, and armed security — victims cannot leave

**Financial Scale:**

- FBI IC3 2023: $4.57 billion in investment fraud losses (highest category)
- FBI IC3 2022: $3.31 billion in investment fraud losses
- Global estimates: $50+ billion annually across all pig butchering operations
- Average victim loss: $100,000-$500,000 (some lose millions)
- Recovery rate: <5% — cryptocurrency transactions are largely irreversible
- Victim demographics: all ages, education levels, income brackets — not limited to vulnerable populations

**AI Enhancement:**

- Deepfake video calls impersonating financial advisors or romantic interests
- AI chatbots handling initial grooming conversations at scale
- AI-generated photos for scammer personas (StyleGAN-generated faces)
- AI translation enabling operators to target victims in multiple languages
- AI-generated financial documents (statements, tax forms, regulatory filings)
- Voice cloning for phone conversations matching the scammer's presented persona

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1566 Phishing
- T1204 User Execution
- T1036 Masquerading
- T1056 Input Capture
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft
- T1565 Data Manipulation
- T1491 Defacement
- T1485 Data Destruction

## Sources

- [FBI IC3 — 2023 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2023_IC3Report.pdf)
- [FBI — Pig Butchering Warning](https://www.fbi.gov/contact-us/field-offices/sanfrancisco/news/fbi-warns-of-increasing-pig-butchering-cryptocurrency-investment-fraud-schemes)
- [UNODC — Cyber Fraud and Trafficking in Southeast Asia](https://www.unodc.org/roseap/uploads/documents/Publications/2023/Casinos_Cyberfraud_and_TIP_in_SEA.pdf)
- [Interpol — Investment Fraud](https://www.interpol.int/Crimes/Financial-crime/Investment-fraud)
- [ProPublica — Pig Butchering Investigation](https://www.propublica.org/article/pig-butchering-scam-crypto-fraud)
- [Sophos — CryptoRom Fake Trading Apps](https://news.sophos.com/en-us/2023/02/01/cryptorom-apps-on-app-stores/)
- [Chainalysis — Crypto Crime Investment Fraud](https://www.chainalysis.com/blog/crypto-crime-investment-fraud/)
- [CFTC — Pig Butchering Advisory](https://www.cftc.gov/PressRoom/PressReleases/8670-23)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0017