Nomani Investment Scam Surges 62% Using AI Deepfake Ads on Social Media

Key Findings

• The fraudulent investment scheme known as Nomani has witnessed a 62% increase, according to ESET.

• Nomani campaigns have expanded beyond Facebook to include other social media platforms, such as YouTube.

• ESET blocked over 64,000 unique URLs associated with the Nomani threat this year, with the majority of detections originating from Czechia, Japan, Slovakia, Spain, and Poland.

• Nomani leverages social media malvertising, company-branded posts, and AI-powered video testimonials to deceive users into investing in non-existent products.

• The scam has received notable upgrades, including more realistic AI-generated videos and the use of benign cloaking pages to avoid detection.

• Despite the increase in detections, the number dropped in the second half of 2025, indicating the attackers are likely revamping their tactics.

Background

Nomani was first documented by ESET in December 2024 as a fraudulent investment scheme that uses social media malvertising, company-branded posts, and artificial intelligence (AI)-powered video testimonials to deceive users into investing in non-existent investment products. When victims request payout of the promised profits, they are asked to pay additional fees or provide personal information, leading to financial loss.

Expansion and Sophistication

The Nomani scam has witnessed a 62% increase, according to data from ESET. The campaigns distributing the threat have expanded beyond Facebook to include other social media platforms, such as YouTube. ESET blocked over 64,000 unique URLs associated with the Nomani threat this year, with the majority of detections originating from Czechia, Japan, Slovakia, Spain, and Poland.

Upgrades and Tactics

Nomani has received notable upgrades, including making their AI-generated videos more realistic to make it harder for prospective targets to spot the deception. The fabricated content often leverages topical events or personalities to lend more credibility to the scheme. To avoid detection, the threat actors ensure that their malicious ads are run only for a few hours and redirect users to benign cloaking pages instead of external phishing forms.

Decline in Detections

Despite the overall increase in detections, the number of Nomani detections in the second half of 2025 dropped, indicating that the attackers are likely being forced to revamp their tactics in the face of increased law enforcement efforts to combat such scams.

Sources

• https://thehackernews.com/2025/12/nomani-investment-scam-surges-62-using.html

• https://thehackernews.com/2025/12/sec-files-charges-over-14-million.html

• https://x.com/shah_sheikh/status/2003826257922867300

• https://www.sepe.gr/en/it-technology/cybersecurity/22669325/nomani-investment-scam-surges-62-using-ai-deepfake-ads-on-social-media/

• https://bvtech.org/nomani-investment-scam-surges-62-using-ai-deepfake-ads-on-social-media/

• https://x.com/shah_sheikh/status/2003825800030924960/photo/1