Loading story…
Check Point reported an AI-enabled investment fraud campaign branded as OPCOPRO that lures victims via unsolicited SMS, social media outreach, and ads impersonating legitimate financial firms (including messages posing as Goldman Sachs). Targets are funneled into private WhatsApp groups where the scam builds trust over weeks through daily “market” content and staged social proof: group “leaders” (e.g., Professor James and an assistant) use AI-generated profile images, while most of the ~90 apparent members are automated accounts that post uniform, enthusiastic reactions and fabricated profit screenshots to create a convincing community.
After grooming, victims are directed to install the OPCOPRO mobile app—reported as available via official app marketplaces to increase credibility (including an Android package cited as com.yme.opcopro)—and are presented with partnership claims and regulatory-looking documents to reinforce legitimacy. The app is used to collect sensitive information, including KYC-style data and government ID photos, which increases downstream risk beyond immediate financial loss (e.g., enabling recovery fraud and SIM-swap attempts). The campaign highlights how AI is being used to industrialize scams by cheaply generating believable identities, content, and “business” artifacts that mimic legitimate digital investment platforms.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Check Point publicly reported that OPCOPRO is an industrialized, multilingual scam framework that uses AI-generated personas and bot-driven social engineering rather than malware to defraud victims over time. The researchers warned that the stolen identity data could support additional abuse such as SIM swapping, help-desk social engineering, account takeover, and recovery scams.
Victims were instructed to install the O-PCOPRO mobile app from official app stores, complete KYC steps including ID photos and liveness selfies, and then deposit money based on promises of extreme returns. Check Point found the app lacked real trading functionality and mainly acted as a WebView showing manipulated figures while collecting identity data for possible follow-on fraud.
After initial contact, targets were directed into private WhatsApp groups led by fictitious personas such as “Professor James” and “Lily,” with AI-generated profile images and automated participants posting repetitive messages and fake profit screenshots to build trust. Researchers said the groups were largely populated by bots and internet-based phone numbers that could not be reached by voice calls.
Threat actors launched a large-scale investment scam using unsolicited SMS, social media messages, and Google Ads impersonating legitimate financial firms such as Goldman Sachs to attract victims with promises of high returns. The outreach funneled targets toward a fraudulent investment operation branded as OPCOPRO.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A surge in **romance scams** is leveraging **AI-enabled impersonation** to make fraud harder to detect, combining manufactured intimacy with financial theft. Australian police warned more than 5,000 people they may have been targeted in a large-scale operation linked to overseas syndicates, where scammers used mainstream dating apps to initiate relationships and then steered victims into purchasing **fake cryptocurrency**. The playbook described includes rapidly escalating emotional commitment, isolating targets, and pushing conversations off-platform to apps like *WhatsApp* or *Telegram*, reducing victims’ access to in-app safety controls and reporting mechanisms. The fraud techniques increasingly rely on **deepfakes** and automated “AI personas,” undermining traditional verification methods such as requesting custom photos or relying on video calls as proof of identity. Reported tactics include real-time face-swapping and AI voice synthesis during video calls, long-running bot-driven conversations that build trust over months, and “celebrity” impersonation to intensify emotional leverage and extract larger payments. Despite the technology shift, the core mechanism remains psychological manipulation—using scripted narratives and social engineering to move victims from online rapport to off-platform communication and ultimately to financial transfers.
Jun 29, 2026
A campaign dubbed **Boss Scam** is targeting Indian enterprises by hijacking senior executives’ **WhatsApp Web** sessions and using the real accounts to send fraudulent payment requests. Attackers reportedly lure victims with urgent compliance-themed messages, including notices impersonating regulators such as the Reserve Bank of India, and deliver malicious ZIP archives that executives are tricked into forwarding to finance staff. Indian authorities said the scheme has led to rapid transfers to mule accounts, with some cases involving losses of up to **Rs. 2,45,00,000**. The ZIP files contain a legitimate signed executable paired with a malicious DLL that abuses **DLL sideloading** on Windows. Once executed, the malware can establish persistence, search Chromium-based browsers for active WhatsApp Web sessions, and steal cookies, authentication tokens, IndexedDB data, saved credentials, and encryption material; some reports say the data is archived with `tar.exe` and exfiltrated over TCP to clone the victim’s session. The attackers then impersonate executives or trusted employees to request wire transfers, spread additional malicious messages, or steal corporate information, and may fall back to saving an attacker-controlled number under the executive’s name if the hijacked session is cut off.
Jul 3, 2026
Threat actors are running cryptocurrency investment scams across Asia—**heavily targeting Japan**—that blend **malvertising** (paid ads on platforms such as Facebook and Instagram) with **pig butchering**-style long-con social engineering. Infoblox reported identifying large clusters of suspicious domains (including domains consistent with **registered domain generation algorithms (RDGAs)**) disproportionately queried by users in Japan; victims are funneled from fake ads impersonating financial experts or “AI-driven” trading systems to lure sites that push them into messaging apps (e.g., **LINE**, WhatsApp, KakaoTalk) via links or QR codes. Once in chats, victims are engaged by **AI bots** posing as experts/assistants, fed fabricated success stories, and nudged from small “test” deposits to larger transfers; when victims attempt withdrawals, scammers demand additional payments such as a **“release fee.”** Reported losses tied to this activity have reached **up to ¥10 million** per victim. A related pattern shows scammers using **AI chatbots as high-pressure sales agents** for fake crypto offerings: Malwarebytes documented a live “**Google Coin**” presale site using a chatbot impersonating Google’s **Gemini** branding to provide tailored investment projections and steer victims toward **irreversible cryptocurrency payments**; Google does not have a cryptocurrency. While this “Google Coin” case is a separate scam instance from the Japan-focused malvertising/pig-butchering operation, it reinforces the same operational shift highlighted by Infoblox: **automation and AI-driven conversational tooling** are increasingly replacing human operators to scale persuasion, maintain consistent scam personas, and accelerate victim conversion from initial interest to payment.
Jun 29, 2026