Group-IB warns AI deepfake fraud schemes could hit Gulf markets

Singapore-headquartered cybersecurity firm Group-IB has warned retail investors and financial institutions across the Gulf Cooperation Council (GCC) that two AI-powered investment fraud models documented by its researchers this year are readily transferable to Gulf markets, according to Biometric Update and Security MEA. The warning, issued in late August 2026 by Group-IB's regional team covering the Middle East, Turkey and Africa (META), draws on a two-part investigation published earlier in 2026 into fraud operations that targeted victims in Australia and the United States. Neither scheme is tied to the market where it was first observed, Group-IB said: the advertising, the messaging-app coordination and the platform infrastructure can be redirected at a new country within days.

Group-IB's research was carried out by its Fraud Protection team together with analysts from its Investigations, Threat Intelligence and CERT-GIB units, applying what the firm calls a "Cyber Fraud Fusion" approach that links advertising, server infrastructure and cryptocurrency flows so an entire fraud network can be disrupted at once rather than piece by piece. The two schemes it tracked, respectively named GoldBull and CoinLure, both recruit victims through deepfake video and private WhatsApp groups — the exact channel combination that Security MEA notes is the default way Gulf businesses and individuals already discuss money.

What the researchers documented

GoldBull begins with short-lived paid advertisements on Facebook and Instagram that use deepfake video to replicate the voice and likeness of well-known financial professionals. Victims are funnelled into private WhatsApp groups and told to buy a specific small-cap stock on a real, regulated exchange — which is precisely what makes the fraud hard to spot, since the shares themselves are genuine. In one case Group-IB documented, victims were told to buy at US$24.79 a share; coordinated buying by the group then pushed the price up 12.4% to US$27.87 before it collapsed to US$14.27, a 42.4% loss from the victims' entry price. Group-IB estimates the capital required to drive that movement at US$1.5 million to US$3 million, achievable with as few as 500 to 3,000 coordinated participants.

CoinLure, the second scheme, operates a network of more than 200 connected fake cryptocurrency investment platforms built on shared templates and shared infrastructure, so the operation survives individual takedowns. Group-IB's on-chain analysis of a single platform identified more than US$90,000 in victim deposits across Bitcoin, Ethereum and USDT-TRC20 addresses active since 2022. The platforms display fabricated returns and offer daily profits that are mathematically impossible, Group-IB found, and they accept only cryptocurrency. When victims try to withdraw, the platforms demand invented taxes, compliance charges or account upgrades — each payment followed by a new one — and victims are often later approached again by "recovery firms" that are in fact run by the same operators.

Why Gulf markets fit the pattern

Group-IB laid out several reasons the GCC is a plausible next target. WhatsApp is the region's default channel for business and money conversations, precisely the channel both schemes depend on. Crypto adoption is high and rising: the UAE ranks fifth globally on the 2025 Henley Crypto Adoption Index, and Saudi Arabia recorded 154% year-on-year growth in crypto transaction value, to roughly US$31 billion. The retail investor base across Gulf capital markets is growing quickly, and newer investors are the primary target for schemes like GoldBull and CoinLure. Fraudsters are already cloning the branding and licence numbers of regulated firms, Group-IB noted — a tactic that is harder to spot for expatriate investors less familiar with local licensing regimes. Regional regulators have separately issued repeated warnings about unlicensed investment firms and advisers operating through messaging apps and social media.

• GoldBull: deepfake video ads on Facebook/Instagram funnel victims into WhatsApp groups that coordinate small-cap stock purchases, one documented case showing a 42.4% loss from entry price
• CoinLure: 200+ fake crypto platforms on shared templates, over $90,000 in tracked deposits on a single platform since 2022, crypto-only, fake withdrawal fees
• UAE ranks 5th globally on the 2025 Henley Crypto Adoption Index; Saudi Arabia's crypto transaction value grew 154% year-on-year to ~$31 billion
• Group-IB's broader research found a $187 million fraud ecosystem in Australia and the US, and more than 20 fake WhatsApp accounts impersonating one Australian economist
• US investment scams generated $7.9 billion in reported losses last year; Australia recorded $837.7 million

Treat any investment opportunity promoted through a private WhatsApp or Telegram group as fraudulent until proven otherwise, and verify the firm with your national financial regulator before sending any money. Do not treat a video endorsement as proof — deepfake tools can convincingly replicate any public figure.

What it changes for investors and platforms in the Gulf

The warning lands as Saudi Arabia's data and AI authority, SDAIA, has already issued its own deepfake guidelines this year in response to rising AI-enabled attacks, and as a UN report published in July documented how deepfakes have become an integral part of organised, cross-border investment fraud. For a Gulf-based brokerage, exchange or bank, Group-IB's specific findings point to concrete defensive steps rather than general caution: monitor for deepfake video using the institution's own executives or its licence number, since branding and licence cloning is already documented in the schemes; treat crypto-only platforms and WhatsApp-coordinated stock tips as red flags to actively warn customers about, not just passively disclaim; and prepare a takedown process for impersonating content, since Group-IB's research shows the same deepfake footage and platform templates are simply redeployed against a new market once one country's defences catch up. For an individual investor in the region, the practical test is simpler: a stock tip that arrives through a WhatsApp group and a video of a recognisable financial expert is, on Group-IB's evidence, more likely to be a reused fraud template than a genuine opportunity.