Loading threat actor…
FaiKast is a financially motivated scam actor associated with AI-themed investment fraud, particularly fraudulent cryptocurrency investment schemes promoted through deepfake and synthetic-media advertising. The actor is known for using programmatic advertising and social-media promotion to lure victims to fake investment platforms, including near-perfect replicas of legitimate news outlets. Its campaigns have used AI-generated news anchors, fabricated celebrity or public-figure endorsements, fake news articles, and urgent call-to-action messaging to create credibility and pressure victims into submitting contact details or enrolling in fraudulent platforms. FaiKast is part of a broader criminal ecosystem abusing advertising traffic-distribution and cloaking infrastructure, including Keitaro, to selectively route victims while hiding malicious content from reviewers and defenders. The actor’s operations demonstrate strong spoofing and social-engineering tradecraft rather than malware-centric intrusion activity. Observed behavior centers on initial access to victims through deceptive ads and fake media personas, followed by collection of victim information and redirection into investment scam funnels. FaiKast has been distinguished from other investment-fraud clusters by its reliance on deepfake personas and AI-generated broadcast-style content as a primary lure mechanism. High-confidence reporting links FaiKast campaigns to localized targeting in multiple countries, with content tailored to regional audiences and trusted media brands. The actor has targeted victims in France, the United Kingdom, Canada, Japan, and Kazakhstan. No high-confidence attribution to a specific nation-state or operating country is currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Attributed with using synthetic/deepfake videos, fake news articles, and fabricated celebrity endorsements to promote fraudulent AI-powered investment scams.
Investment scam actor noted for leveraging AI and deepfake personas in investment scam campaigns.
Runs AI-generated deepfake investment scam advertising campaigns through programmatic advertising, using fake news broadcasts, fabricated endorsements, and localized content to drive victims to fraudulent cryptocurrency platforms.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.