# Deepfake Investment Scam Ads Funnel Victims Into Fake-Analyst WhatsApp Groups (GoldBull, CoinLure)

> Group-IB documents two organized fraud operations, GoldBull and CoinLure, that use deepfake video ads impersonating financial professionals, economists, and regulators to funnel retail investors into private WhatsApp 'analyst' groups running pump-and-dump stock signals or into fake KYC-gated investment platforms that later block withdrawals. CoinLure's confirmed infrastructure links 208 domains across 23 shared templates and common hosting, with an estimated $187M in network revenue.

- **Published:** 2026-08-21T00:00:00Z
- **Last reviewed:** 2026-08-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2109
- **ID:** TL-2026-2109
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Group-IB's fraud-intelligence research, published August 20-21, 2026, describes two related but distinct investment-fraud operations. GoldBull runs deepfake social-media advertisements impersonating financial professionals and public figures (Group-IB documented over 20 fake WhatsApp/social accounts impersonating a single Australian economist) with deliberately short ad lifespans to manufacture urgency and evade moderation. Geo-targeted redirects funnel victims into private WhatsApp groups of roughly 1,000 members each, run by a fake 'head analyst' persona who names a small-cap, NASDAQ-listed stock, a buy price, and a profit target. Victims are required to purchase through legitimate brokerages and submit proof of execution, letting the operators pre-position and then exit their own holdings once coordinated buying moves the price -- a documented November 2025 case saw a stock rise 12.4% (from a $24.79 signal to a $27.87 peak) before the operators exited and the price collapsed 42% below entry by February 2026. Two to three concurrent WhatsApp groups can generate an estimated $1.5-3M in victim capital per campaign.

CoinLure industrializes the fake-investment-platform model: victims arrive via SEO-optimized content, paid social advertising, or romance-scam grooming, then pass through fake registration, counterfeit KYC checks (including fabricated ASIC registration numbers to appear licensed), and trial-fund traps into tiered 'investment plans.' Deposits are accepted only in cryptocurrency (BTC, ETH, USDT-TRC20). When victims attempt to withdraw, operators impose scripted friction: minimum-balance requirements, fabricated 10-30% 'tax' or 'insurance' fees, forced account upgrades, indefinite 'technical issues,' or a compliance freeze. The same operators subsequently resurface as a fund-recovery service demanding a further upfront fee. Group-IB linked one confirmed CoinLure platform (tethergloballtd.com, with on-chain deposits observed since 2022) to 208 other domains sharing 23 near-identical website templates, the same hosting infrastructure, and repeated registrant contact details (name, email, phone, address), evidencing centralized, common operator control across the cluster. Estimated combined network revenue across the 208-domain cluster is $187M; stolen cryptocurrency was traced moving directly to KYC-compliant centralized exchanges without obfuscation.

Both operations sit inside a broader wave of AI-deepfake investment-fraud activity documented by the Australian Securities and Investments Commission (ASIC) in the same week: ASIC reported removing 19,400 scams in the prior 12 months (a 182% year-over-year increase) and over 33,400 scam websites/social posts over three years, with Australians reporting more than $2B in total scam losses in 2025 ($837.7M of it investment-fraud specific -- the same figure cited in the originating hunt article). Separately reported deepfake impersonation targets in this same Australian wave include Prime Minister Anthony Albanese, ABC finance journalist Alan Kohler, economist Stephen Koukoulas (deepfaked promoting an 'undervalued stock' and directing viewers to a WhatsApp trading community -- structurally identical to the GoldBull mechanic), RBA Governor Michele Bullock, and several other public figures, with Scamwatch reports tied to these ten most-impersonated figures alone totaling $7.4M in FY26 losses. Meta (Facebook/Instagram) hosted the majority of the underlying scam advertisements per ASIC.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1589 Gather Victim Identity Information
- T1583.001 Domains
- T1583.006 Web Services
- T1583.008 Malvertising
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1588.007 Artificial Intelligence
- T1608.006 SEO Poisoning
- T1566.002 Spearphishing Link
- T1684.001 Impersonation
- T1657 Financial Theft

## Sources

- [Deepfake Ads Funnel Investors Into WhatsApp Groups Controlled by Fake Financial Analysts](https://gbhackers.com/deepfake-investment-scam/)
- [One Adversary: Fraud Is a Network, Not a Payment](https://www.group-ib.com/blog/one-adversary-fraud-network/)
- [The Architecture of Deception: How a $187 Million Fraud Ecosystem Exploits Trust Across Australia and the United States](https://www.group-ib.com/blog/architecture-deception-investment-crypto-fraud/)
- [Scammers Use WhatsApp Groups to Coordinate Millions in Victim Trades and Pump Real Stocks](https://cybersecuritynews.com/scammers-use-whatsapp-groups/)
- [AI deepfake scams 'an emergency in the making' as ASIC reports rise in false investment endorsements](https://www.abc.net.au/news/2026-08-17/asic-ai-powered-impersonation-scams-warning-alan-kohler/107038256)
- [Top Aussie public figures impersonated in investment scams](https://www.bitdefender.com/en-us/blog/hotforsecurity/top-aussie-public-figures-impersonated-in-investment-scams)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2109