That Celebrity Video Pitching You Stocks? One Scam Ring Built 15,500 Fake Sites to Fool You.

One criminal group. Fifteen thousand, five hundred fake websites. Deepfake videos of famous faces endorsing investments that don't exist. And the whole system was built specifically to look totally normal — because that was the point.

This isn't the story of one shady link that landed in one unlucky person's inbox. This is something different. Something that should make you pause the next time a familiar face tells you about an investment opportunity from any screen, anywhere.

This Wasn't a Scam. It Was a Factory.

Security researchers at Malwarebytes uncovered the full scope of this operation, and the details are genuinely jaw-dropping. One single criminal group — not dozens of separate bad actors, one ring — operated over 15,500 domains (think of domains as the web addresses, like "smartaitrading.com," that make a website look like a real company). That's not a typo. Fifteen thousand, five hundred fake storefronts, all dressed up to look like legitimate investment platforms.

Each site had a name designed to feel trustworthy. Researchers found brands like "Smart AI Trading Technology" and "Intelligent Trading Solutions" — the kind of name that sounds exactly like something your financially savvy coworker might mention over lunch. The sites looked polished. The branding was consistent. There were "testimonials." And in some cases, there were video interviews featuring famous faces — except those faces never actually said any of it. They were deepfakes: AI-generated videos (short for "deep learning fakes," meaning a computer stitched together a convincing fake video using someone's real face and voice patterns).

Here's where it gets interesting — and honestly, a little unsettling. The operation didn't just build fake websites. It built a system to make sure you saw the scam pages, but security scanners and fraud reviewers did not. The group reportedly used a real commercial tool called Keitaro — software that legitimate advertisers use to track which ads bring in real customers — and twisted it into something else entirely: a cloaking device. When a security scanner visited one of these sites, it saw a harmless, boring page. When a real person who fit the "ideal victim" profile showed up — someone in a targeted country, clicking from a social media ad — they saw the scam. The site switched faces depending on who was looking. This article is part of a series — start with Your Phone Number Is About To Need Your Face.

That's not improvised. That's engineered.

Your Brain Was the Real Target

Let's be honest about why this works. It's not because people are naive. It's because human brains take shortcuts — and scammers know exactly which shortcuts to exploit.

Psychologists call it the availability heuristic (fancy term, simple idea: your brain judges how likely something is based on how easily you can picture it). When you see a recognizable face — a celebrity you've watched for years, someone who feels familiar and trustworthy — your brain immediately files the situation under "probably fine." It doesn't stop to verify. It doesn't ask for credentials. It just... relaxes. That's not a flaw in your character. That's just how brains work to process the flood of information they get every day.

Now pair that with a polished website, consistent branding across multiple pages, an "interview" where a familiar person says the returns are real, and a testimonials section full of five-star reviews. At what point does your gut raise a flag? For most people — honestly, for most of us — it doesn't. Not until money is gone.

"Scam sites promise 'Smart AI Trading Technology' or 'Intelligent Trading Solutions' with consistently high returns, reinforced by deepfake images, fabricated media, and fake interviews with well-known public figures." — Malwarebytes Security Research, May 2026

A woman in Ontario lost $83,000 after watching AI deepfake videos — real money, real loss, real devastation. She's not the only one. She's just one of the people we know about, because her story made the news. The ones who lost $8,000 or $12,000? They often quietly disappear from the statistics.

The Shift Nobody Is Talking About Enough

For a long time, the conversation about deepfake scams focused on individual incidents. One fake video. One targeted victim. One bad actor. The advice was always the same: look for blurry edges around the face, watch for weird blinking, check if the mouth movements match the words. Previously in this series: 200 People Just Marched On Openai Heres Why Your Face Is The.

That advice is now almost beside the point.

What this 15,500-site operation reveals is that deepfake fraud has gone from tactical to architectural. The deepfake video isn't the scam — it's just the front door. Behind it is an entire ecosystem: a traffic routing system that profiles victims in real time, thousands of domains that create the illusion of a well-established company, and evasion tools that keep the whole operation invisible to the people whose job it is to find it. According to analysis from Security Boulevard, the cloaking infrastructure alone represents a significant leap in how organized these operations have become — not a basement hacker, but something closer to a fraudulent corporation with a tech stack.

Think about what that means practically. Before, a fraud investigator could find one suspicious site, trace it back, and have a decent shot at understanding the whole operation. Now? That one suspicious site might be domain number 7,842 out of 15,500. The scope of what investigators are up against has changed completely.

So What Can You Actually Do?

The honest answer is that most standard advice — "do your research," "check reviews," "look for the padlock icon" — was written for a different era. Reviews can be faked. Web presence can be manufactured. The padlock just means the connection is encrypted; it says nothing about whether the site is run by criminals.

Here's what actually helps: break the loop before money moves. The sequence these scams rely on is: see familiar face → feel reassurance → click link → trust polished site → send money. The moment you can interrupt that sequence anywhere before the last step, you're safe. The most reliable interruption point? Adding a real-world verification step that has nothing to do with anything the scam can control. Call the actual company the "celebrity" supposedly works with. Google the investment platform's name alongside the word "scam." Look up who actually registered the website domain — tools for that are free and take 30 seconds. Up next: Age Related Face Recognition Eye Movement Patterns.

If you've ever found yourself wondering whether a photo, a profile, or a video is really who it claims to be — that instinct is worth trusting. That exact question is what facial comparison technology exists to help answer: not just "does this look real?" but "does this face match any known public identity, and does the metadata around it hold up?" It's the kind of check that takes seconds with the right tool and catches what your eye can't.

According to research drawing on Gartner and Experian forecasts, one in four candidate profiles online could be fake by 2028 — and most organizations currently lack reliable tools to detect them. That number applies to investment platforms just as much as it applies to job listings.

The uncomfortable truth about this story isn't the technology. Deepfake videos are genuinely impressive — and genuinely unnerving — but they're not magic. They still need a person to watch them and decide to trust them. The criminal operation wasn't 15,500 technical attacks. It was 15,500 psychological ones.

Which brings us back to that number. Fifteen thousand, five hundred fake websites. Not a thousand. Not even five thousand. Fifteen thousand, five hundred. At some point, the question isn't "how did investigators miss this?" The question is: if one group can build that quietly, at that scale, what's the one running right now at 30,000?