FaiKast

Also known asFaiKast

FaiKast is a threat actor associated with AI-themed investment fraud campaigns. Reporting from Infoblox and Confiant attributes to FaiKast the use of synthetic and deepfake video ads, including AI-generated news anchors, to promote fraudulent cryptocurrency and investment platforms. The actor used Facebook Ads and the programmatic advertising ecosystem to lure victims, and directed them to near-perfect replicas of legitimate news outlets, including fake CBC broadcasts. The campaigns used fabricated celebrity or public-figure endorsements, fake news articles, fabricated quotes, and urgent prompts to drive victim enrollment. FaiKast targeted victims in France, the United Kingdom, Canada, Japan, and Kazakhstan with localized content. The activity was observed in the broader context of criminal abuse of the Keitaro traffic distribution and cloaking platform. Alias: faikast.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

Financial Services

MITRE ATT&CK

Tradecraft

3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

3 of 15 tactics4 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

1 technique

T1566

Phishing

T1566.002

Spearphishing Link

TA0005

Stealth

1 technique

T1036

Masquerading

TA0011

Command and Control

1 technique

T1102

Web Service

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

the hacker newsNews

Apr 27, 2026

Fake CAPTCHA IRSF Scam and 120 Keitaro Campaigns Drive Global SMS, Crypto Fraud

Attributed with using synthetic/deepfake videos, fake news articles, and fabricated celebrity endorsements to promote fraudulent AI-powered investment scams.

infoblox threat intel blogNews

Mar 26, 2026

Inside Keitaro Abuse Part 2: One Platform, Many Threats

Investment scam actor noted for leveraging AI and deepfake personas in investment scam campaigns.

confiant blogNews

Mar 24, 2026

Tracking Software Weaponized by Criminals - Confiant

Runs AI-generated deepfake investment scam advertising campaigns through programmatic advertising, using fake news broadcasts, fabricated endorsements, and localized content to drive victims to fraudulent cryptocurrency platforms.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping3

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.