> ## Content Index > Fetch the complete content index at: https://www.d-x.ae/llms.txt > Use this file to discover other available public pages before exploring further. # Group-IB Highlights Deepfake Stock and Crypto Fraud Risks for GCC Investors - URL: https://www.d-x.ae/group-ib-highlights-deepfake-stock-and-crypto-fraud-risks-for-gcc-investors/ - Published: 2026-08-28T11:11:25.000Z - Updated: 2026-08-28T11:11:25.000Z - Author: Decode-X - Tags: Developments, Investing Cybersecurity firm Group-IB has warned that investment-fraud methods combining deepfake impersonation, private messaging groups and fake cryptocurrency investment sites could be adapted for GCC markets. Its Gulf-focused warning draws on research published in May into two operations it tracks as GoldBull and CoinLure. The underlying investigation focused on activity in Australia and the United States, rather than documented GCC cases. ### How the stock scheme works GoldBull uses short-lived, geo-targeted social media advertisements featuring deepfake impersonations of well-known financial professionals. People who engage with the ads are redirected to WhatsApp contacts and groups where impersonator accounts provide specific instructions to buy small-cap shares through legitimate trading platforms. Group-IB says fabricated profit posts and other accounts within the groups are used to reinforce the recommendations. In one case analysed by Group-IB, participants were instructed to buy a NASDAQ-listed stock at US$24.79 with a target price of US$29\. The stock later reached US$27.87, 12.4 per cent above the entry price, before falling to US$14.27, a 42.4 per cent decline from that entry level. Group-IB estimated that US$1.5 million to US$3 million in coordinated purchases could have been sufficient to produce the observed movement. Its analysis estimated that this could involve roughly 1,500 to 3,000 participants contributing US$1,000 each, or fewer participants at higher amounts. These figures are Group-IB's analytical estimates, not findings confirmed by a financial regulator or exchange. The distinction matters because the underlying shares and trading platform can be legitimate. In the scenario Group-IB examined, the suspected manipulation was linked to how participants were recruited and coordinated, rather than to the legitimacy of the listed company itself. ### How the crypto scheme works The second operation, CoinLure, involves professional-looking fake cryptocurrency investment sites. Group-IB's graph analysis linked one confirmed fake platform to 23 other platforms sharing contact information and 208 IP-linked fraudulent domains. The sites use similar infrastructure and templates, display fabricated investment results and accept cryptocurrency deposits. Group-IB's on-chain analysis of one confirmed platform identified more than US$90,000 in deposits across Bitcoin, Ethereum and USDT-TRC20 addresses active since 2022\. The firm then extrapolated from that analysis across the connected network to estimate approximately US$187 million in total revenue. That estimate relates to the fraud ecosystem Group-IB investigated in **Australia and the United States**; it should not be interpreted as a GCC loss figure or as a regulator-confirmed victim-loss total. Group-IB says larger withdrawal attempts can be obstructed through demands described as taxes, compliance charges, account upgrades or other additional payments. It also found that victims may later be contacted by supposed recovery services offering to retrieve lost funds for an upfront fee, with some of those services allegedly connected to the original operators. ### What readers in the UAE can check Group-IB recommends checking investment platforms or advisers through official regulatory registers, being cautious with unsolicited investment recommendations received through social media or messaging applications and independently researching opportunities before transferring funds. That approach is consistent with UAE regulator guidance. The UAE Capital Market Authority maintains warnings concerning entities carrying out regulated financial activities without appropriate authorisation and provides access to licensed-company information. For virtual-asset services in Dubai, excluding the DIFC, VARA states that only licensed entities are authorised to provide virtual-asset services and advises users to verify licensing status before transacting. For readers, the practical issue is not that every investment discussion on social media or messaging apps is fraudulent. The stronger warning signs are unsolicited coordinated trading instructions, impersonated identities, unrealistic or fabricated returns, unclear regulatory status, cryptocurrency-only deposits, and repeated payment demands before withdrawals can be released. ## **Key Takeaways** - Group-IB says deepfake-driven investment-fraud methods investigated in Australia and the United States could be adapted for GCC markets. - In the GoldBull case studied by Group-IB, participants were directed through messaging groups to buy real exchange-listed shares, while Group-IB estimated that US$1.5 million to US$3 million in coordinated purchases could influence a small-cap stock. - Group-IB linked one CoinLure platform to a wider network of fraudulent domains and estimated approximately US$187 million in revenue across the investigated Australia-US cluster. The figure is an analytical estimate, not a GCC loss total. - UAE regulators provide official registers and warnings that readers can use to check whether financial or virtual-asset service providers hold the relevant authorisation. ![](https://storage.ghost.io/c/5b/31/5b31839b-65ca-403d-ac7b-509cf7237573/content/images/2026/08/image-28.png) **Sources:** [Group-IB](https://www.group-ib.com/blog/architecture-deception-investment-crypto-fraud/?utm%5Fsource=chatgpt.com), [Biometric Update](https://www.biometricupdate.com/202608/group-ib-warns-gcc-investors-of-deepfake-investment-fraud-risk?utm%5Fsource=chatgpt.com), [UAE Capital Market Authority](https://www.uaecma.gov.ae/en/open-data/warnings.aspx?utm%5Fsource=chatgpt.com), [VARA](https://www.vara.ae/en/enforcement/unlicensed-vasps/?utm%5Fsource=chatgpt.com). --- **Disclaimer:** This content is for educational and informational purposes only. It is not legal, financial, investment, cybersecurity, medical, business, career, or other professional advice. Verify important information with official sources or qualified professionals before acting.