Group-IB, a leading creator of predictive cybersecurity technologies to investigate, prevent, and fight digital crime, is warning retail investors and financial institutions across the GCC that two investment fraud models documented by its researchers this year are readily transferable to Gulf markets.

The assessment comes from Group-IB’s regional team in the META region and draws on a two-part investigation, published earlier this year, into fraud operations targeting victims in Australia and the United States. Both operations recruit through deepfake videos of well-known finance professionals and private WhatsApp groups. Neither is tied to the markets where it was observed: the advertising, the messaging-app coordination and the platform infrastructure can be pointed at a new country within days.

What the researchers documented

The first scheme, run by an actor Group-IB tracks as GoldBull, begins with short-lived paid advertisements on Facebook and Instagram that use deepfake video to replicate the voice and likeness of well-known financial professionals. 

Victims are funnelled into private WhatsApp groups and told to buy a specific small-cap stock on a real, regulated exchange — which is what makes the fraud so hard to spot. In one documented case, victims were told to buy at US$24.79 a share. Coordinated buying pushed the stock up 12.4%, to US$27.87, before collapsing to US$14.27, a 42.4% loss from the victim entry price. The estimated capital required to cause this movement was US$1.5 million to US$3 million, achievable with as few as 500 to 3,000 participants—well within the capacity of an operation running multiple WhatsApp groups.

The second scheme, attributed to an actor Group-IB tracks as CoinLure, operates a network of more than 200 connected fake cryptocurrency investment platforms, run from shared templates and shared infrastructure so the operation survives individual takedowns. Group-IB’s on-chain analysis of a single platform identified over US$90,000 in victim deposits across BTC, ETH, and USDT-TRC20 addresses active since 2022. The platforms display fabricated returns, offer daily profits that are mathematically impossible, and accept only cryptocurrency. When victims try to withdraw, the platforms demand invented taxes, compliance charges and account upgrades — each payment followed by a new one. Victims are then often approached again by “recovery firms” run by the same operators.

Why Gulf markets fit the pattern

• WhatsApp is the region’s default channel for business and money conversations — precisely the channel both schemes depend on.
• Crypto adoption is high and rising. The UAE ranks fifth globally on the 2025 Henley Crypto Adoption Index, and Saudi Arabia recorded 154% year-on-year growth in crypto activity, to around US$31 billion in transaction value.
• The retail investor base is growing quickly across Gulf capital markets, and newer investors are the primary target for these schemes.
• Fraudsters are already cloning the branding and licence numbers of regulated firms, which is harder to spot for expatriate investors who may be less familiar with local licensing.
• Regional regulators have issued repeated warnings about unlicensed investment firms and about advisors operating through messaging apps and social media.

What investors and institutions should do

• Treat any investment opportunity promoted through a private WhatsApp or Telegram group as fraudulent until proven otherwise, and verify the firm with your national financial regulator before sending any money.
• Do not treat a video endorsement as proof. Deepfake tools can convincingly replicate any public figure.
• Be cautious of any platform that accepts only cryptocurrency deposits. Legitimate providers offer bank transfers and card payments.
• If a platform demands a payment of any kind before releasing a withdrawal — tax, fee, insurance or compliance charge — it is fraudulent. So, usually, is the “recovery firm” that contacts you afterwards.
• Financial institutions and public figures should monitor for deepfake content using their brand or likeness, and arrange for automated takedowns.

The research was carried out by Group-IB’s Fraud Protection team with analysts from Investigations, Threat Intelligence and CERT-GIB. It applies Group-IB’s Cyber Fraud Fusion approach, which links what is seen in advertising, infrastructure and cryptocurrency flows so a whole fraud network can be disrupted at once, not one piece at a time.