Nomani Investment Scam Explodes 62% in 2025: AI Deepfakes Drive Massive Surge Across Social Media Platforms

The Nomani cryptocurrency and investment scam — a ruthless “pig butchering” scheme whose name cynically hints at leaving victims with “no money” — recorded a dramatic 62% year-over-year increase in detections throughout 2025, according to ESET’s latest H2 2025 Threat Report.

First exposed by ESET researchers in December 2024, Nomani has rapidly evolved into one of the most aggressive and technically sophisticated social-media investment fraud operations of the decade, heavily relying on generative AI and hyper-realistic deepfake videos to deceive victims worldwide.

Core Mechanics of the Nomani Scam

Scammers flood platforms (primarily Facebook, Instagram, and increasingly YouTube) with short-lived malicious advertisements that typically run for only a few hours to avoid detection systems.

Typical bait includes:

• AI-generated deepfake videos featuring celebrities, influencers, or fabricated “successful investors” promising guaranteed high returns (often 200–500% in weeks/months)
• Professionally branded fake company posts mimicking legitimate investment firms
• Localized fake news articles claiming government agencies, celebrities, or major corporations are secretly profiting from the same “exclusive” crypto platform

Once users click, they are directed to:

• In-platform forms/surveys (abusing legitimate Meta/Google ad tools)
• Cloaked phishing pages that only show malicious content to targeted victims
• Fake trading dashboards displaying fabricated profits

The classic follow-up trap:

• When victims attempt to withdraw “earnings,” they are hit with endless demands for “taxes,” “withdrawal fees,” “compliance deposits,” or additional personal/banking information
• In many documented cases, victims are then re-targeted with fake Europol, INTERPOL, or “recovery specialist” offers promising to retrieve lost funds — for yet another fee

Major Technical Upgrades Observed in 2025

ESET analysts documented significant improvements that make Nomani scams far harder to detect:

• Deepfake video quality leap — higher resolution, dramatically reduced unnatural facial movements, breathing artifacts, blinking inconsistencies, and vastly improved audio-video synchronization (lip-sync)
• Contextual relevance — content frequently ties into current news cycles, trending personalities, or regional events to appear more credible (e.g., fabricated articles claiming Czech government agencies made huge crypto gains)
• Cloaking & evasion — non-targeted users or security crawlers see innocent landing pages
• In-platform data harvesting — increasing abuse of built-in Facebook/Instagram forms instead of external phishing sites
• AI-generated phishing templates — HTML source code shows signs of AI assistance (e.g., auto-generated checkbox comments); many templates originate from GitHub repositories linked to Russian and Ukrainian actors

Over 64,000 unique malicious URLs associated with Nomani were blocked by ESET in 2025, with the heaviest concentration of detections in Czechia, Japan, Slovakia, Spain, and Poland.

Mixed Signals: Hope Amid the Surge

While overall detections rose sharply compared to 2024, the second half of 2025 showed encouraging progress:

→ 37% decrease in detections compared to H1 2025

This decline likely reflects:

• Faster platform takedowns
• Improved AI scam detection by social networks
• Intensified global law enforcement operations targeting large-scale investment fraud rings

Broader Context: Scale of the Social-Media Ad Problem

The Nomani surge coincides with explosive investigative reporting by Reuters revealing the massive role of scam-enabling advertisements on major platforms:

• In one year alone, roughly 19% of Meta’s $18 billion ad revenue from China reportedly came from scam, illegal gambling, and other prohibited content
• Estimates suggest scam-related ads (including those tied to Nomani-style operations) may have contributed to around 10% of Meta’s entire global revenue in 2024 (~$16 billion)

Essential Protection Tips Against AI-Powered Investment Scams

• Treat any unsolicited investment opportunity seen on social media as highly suspicious
• Verify claims independently — never use links or contact details provided in ads
• Be extremely skeptical of “guaranteed returns,” celebrity endorsements, or urgent “limited time” offers
• Enable two-factor authentication everywhere and never share banking/identity details with unknown parties
• Use browser extensions and security software with strong real-time phishing and malicious URL protection
• Report suspicious ads immediately to the platform (Meta, YouTube, etc.)
• Remember the golden rule: If the promised returns sound too good to be true, they almost always are

As generative AI tools become cheaper, faster, and more accessible, scams like Nomani demonstrate how quickly fraudsters can weaponize the technology to target millions — making vigilance and skepticism more important than ever in 2025 and beyond.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.