Cybercriminals and hacker gangs are using AI-powered deepfakes of Bitcoin websites such as Coinbase, Kraken, Gemini, and MetaMask. The high-end cryptocurrency scams use convincing fakes to gain access to their victims' bitcoin wallets.

Once they create an operational clone site, they use search engine optimization (SEO) techniques. Sophisticated DEO usually involves a large network of bots. The bots post links to phishing pages on other websites on blogs and in comments sections.

According to Elon Musk bots are running rampant on Twitter. 

 The end result is to boost the fake sites up on the search engine rankings places like Google. And it typically works. Researchers claim some of these fake websites rank higher than the legitimate site that’s been cloned.

The FBI’s cyber division warned about deep fakes in 2021.  The tech was deemed a “critical emerging threat.” And the DeepFake technology has been used to create websites, to manipulate videos, or appear as a real person clone, usually someone famous or a business owner or influencer.

Faking Identities

Recently fraudsters created a deep fake of Binance chief communications officer (CCO) Patrick Hillmann. And used it to extort money by convincing them they were in the running for a listing on the crypto exchange.

Any crypto start-up would be thrilled to have their tokens listed on a global hub like Binance. It would give them validation. And exposure to a huge number of cryptocurrency owners and traders. This would be a boost to the token’s price 

In reality getting listed on Binance is not easy. And the process is long and expensive.

Using artificial intelligence, they replicated Hillmann, and used the fake on multiple video calls. The scammers were trying to convince potential listing candidates to pay for their “listing”.

While no specific threat actor was named in the scam Hillmann claimed a “sophisticated hacking team” had used old news interviews and TV appearances of him to create the AI-powered deepfake hologram. 

He said the deepfake was good enough to fool some highly intelligent crypto community members. But it wasn’t accurate because it was missing 15 pounds, he gained during COVID.

Fortunately, Hillman discovered the deepfake attack.

Malicious links to AI-powered deepfakes

When a victim clicks a malicious link, it is intended to take them to the fake site. These websites are very realistic-looking imitations hosted on either Google Sites or Microsoft Azure. 

This part of the cyberattack is known as phishing.

Security researchers say in most cases users will be directed to either “Download’ or “Login.” And this part will try to get and get access to a   user's crypto wallet or their username and password. 

This includes never entering credentials after clicking on a link, and instead, always navigating directly to the site you are trying to log in to. 

For organizations, it's highly recommended to use a secure web gateway that will detect and block phishing attempts.

Recommended endpoint protection includes Avast, ESET Protect, Trend Micro Worry-Free Services, Bitfinder Gravity Zone, and Watchguard.