Deepfake Influencer Ads Drive Investment Fraud Across Social Media

Jul 29, 2025 · Original article ↗

Summary

CloudSEK investigated a scam using deepfake influencer videos and social-media ads to lure victims into Telegram investment schemes, where scammers withheld funds and demanded further payments. It identified over 120 ads across 20 Facebook accounts.

Key points

Scammers impersonated beauty influencer Prerna Nigam as “Shweta Sharma,” promising to double investments in two or three hours in exchange for upfront payments.
Victims were directed from Facebook and Instagram ads to Telegram channels; scammers then withheld invested funds as “stuck payments” and demanded more money to release them.
CloudSEK found over 120 active scam ads originating from 20 Facebook accounts, with multiple versions using the same images or videos.
The operation used deepfakes and misused bank advertisements and public figures’ identities to make fraudulent investment pitches appear credible.
CloudSEK identified other bogus finfluencer personas and reported a 400% increase in deepfake scam videos between 2023 and 2025, based on its analysis of open-source and Meta Ad Library data.
The article advises verifying financial advisers and platforms with SEBI or recognized financial institutions, and treating guaranteed or unusually high returns as a warning sign.

Article Details

Attack Vectors: Scammers used deepfake videos and impersonated influencers and public figures to promote investment schemes promising unrealistic returns.
Fraudulent ads on Facebook and Instagram redirected users to Telegram channels, where scammers solicited investments and further payments to release purportedly stuck funds.
The scammers used fabricated payment screenshots and testimonials to lend credibility to the investment pitches.
Defensive Notes: Treat guaranteed or unusually high returns, especially those requiring upfront payments, as warning signs.
Verify that an adviser or platform is registered with SEBI or affiliated with a recognized financial institution before transferring funds.
Banks are advised to conduct customer awareness drives about unreliable finfluencers and fraudulent investment promises.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`gclnk[.]com`	Redirect domain identified as being used in scam Facebook pages to send users to scammer-endorsed Telegram channels.
DOMAIN	`shweta-sharma[.]vip`	Domain listed among those associated with the scam ads.
DOMAIN	`shwetasharmaind[.]pro`	Domain listed among those associated with the scam ads.
URL	`hxxps[:]//indiahomework[.]com/?campaign_id=e32bd76324d03c3cc4039ae056c75d10`	Scam-associated investment domain and landing-page URL listed among domains used to promote the fraudulent ads.
URL	`hxxps[:]//mahakaladagency[.]systeme[.]io/13c3c195`	Specific Systeme.io resource listed among domains associated with the scam ads.
URL	`hxxps[:]//masumkritima[.]systeme[.]io/8087f03d`	Specific Systeme.io resource listed among domains associated with the scam ads.
URL	`hxxps[:]//professional-world-coach[.]pro/?campaign_id=48e4d8ae9f89a0f922e337ed5ae6ac24`	Scam-associated investment domain and landing-page URL listed among domains used to promote the fraudulent ads.
URL	`hxxps[:]//reliable-income-today[.]com/?campaign_id=a24ccd4b9167404d603c7f3f9d703c5b`	Scam-associated investment domain and landing-page URL listed among domains used to promote the fraudulent ads.
URL	`hxxps[:]//shweta-sharma[.]club/c8Fy8R9F?sub_id_1=adset9`	Scam-associated investment domain and landing-page URL listed among domains used to promote the fraudulent ads.
URL	`hxxps[:]//shweta-sharma[.]help/pY5wfYVW?sub_id_1=adset8`	Scam-associated investment domain and landing-page URL listed among domains used to promote the fraudulent ads.
URL	`hxxps[:]//smartincome[.]live/?campaign_id=ba14341d380eec8fb96d1978cce23ec4`	Scam-associated investment domain and landing-page URL listed among domains used to promote the fraudulent ads.
URL	`hxxps[:]//t[.]me/+5IfaDSVlktlmOWE1`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//t[.]me/+F3D2sJ4QV_A0NmE0`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//t[.]me/+gAI7Pvk2cS00Nzc9`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//t[.]me/+OLTngh6mfORmZjEx`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//t[.]me/+UyOa88DE13Q5NTEy`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//t[.]me/officeal_shweta_sharma`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//t[.]me/SHARMA_SHWETA1`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//t[.]me/Shweta_sharm`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//t[.]me/Shweta_Sharma_official`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//t[.]me/Shweta_Sharma_Officialll`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//t[.]me/shweta_sharma_original0`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//t[.]me/Shweta_Sharma_Trader_1`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//t[.]me/Shweta_Sharma_Trader_Official`	Telegram channel listed as involved in establishing contact with victims of the scam.
URL	`hxxps[:]//vip-invest[.]info/?campaign_id=2241be5df18e4256d87c3900d1bcae0c`	Scam-associated investment domain and landing-page URL listed among domains used to promote the fraudulent ads.
URL	`hxxps[:]//workfromhomeindia[.]store/?campaign_id=a55f271323e27f81c26d576cf0c55902`	Scam-associated investment domain and landing-page URL listed among domains used to promote the fraudulent ads.
URL	`hxxps[:]//www[.]instagram[.]com/shweta_sharma_invstment/`	Instagram page listed as involved in swindling the public through the fraudulent investment scheme.
URL	`hxxps[:]//www[.]instagram[.]com/shweta_sharma_official_/`	Instagram page listed as involved in swindling the public through the fraudulent investment scheme.
URL	`hxxps[:]//www[.]instagram[.]com/shweta_sharma_official0/`	Instagram page listed as involved in swindling the public through the fraudulent investment scheme.