The Chinese-language artificial intelligence app Haotian is so effective that itâs made millions of dollars selling its face-swapping technology on Telegram. The service integrates easily with messaging platforms like WhatsApp and WeChat and claims that users can tweak up to 50 settingsâincluding the ability to adjust things like cheekbone size and eye positionâto help mimic the face they are impersonating. But while Haotian is a robust and versatile platform, researchers and WIREDâs own analysis have found that the service has been marketing to so-called âpig butcheringâ scammers and those running online fraud operations in Southeast Asia.
Scammers have used Haotian and other deepfake tools to more easily substantiate their deceptions by allowing victims to âvideochatâ with the character they believe they have been talking to as part of an investment opportunity, friendship, or even romantic relationship. Analysis by the cryptocurrency tracing firm Elliptic of four cryptocurrency wallets linked to Haotian shows the company has received at least $3.9 million in payments in recent years, including money from cryptocurrency wallets linked to alleged criminal activity, including fraud. Additionally, almost half of its payments had ties to a scam marketplace sanctioned by the US government, Elliptic says.
Hieu Minh Ngo, a reformed criminal hacker turned cybercrime investigator at the Vietnamese scam-fighting nonprofit ChongLuaDao, says that Haotian, which emerged around 2021, was âone of the first of its kind and very popular.â Ngo has conducted extensive research into Haotian and its operations. âIts results are nearly perfect,â he says. âAnd they are getting better and better every day. If you check in the crypto wallet, you will see the money coming in every single day.â
Haotian is just one part of the wider tech ecosystem that has emerged around Southeast Asiaâs booming cybercrime industry and forced labor scam compounds. And as face swapping and other video deepfake tools have become more widely available, they have increasingly been incorporated into scamming and other types of cybercrime around the world. In the last two years, officials working for the United Nations Office on Drugs and Crime have identified more than 10 face-swapping tools potentially being used by cybercriminals in Southeast Asia, including for cryptocurrency scams and police officer impersonation.
Haotian has a website for its face-swapping tool, but it primarily promotes its desktop app via a public Telegram channel, which launched in October 2023 according to Ngoâs research. Through this channel, which now has more than 20,000 subscribers, the company markets new versions of the app, gives development updates, and offers technical support. While marketing software through Telegram isnât inherently nefarious, researchers say that Haotianâs customer base has increasingly skewed toward scammers who already seek out information about an array of gray market services on the messaging app.
Telegram declined to comment. However, after WIRED got in touch with the company, the main public Haotian Telegram channel and some associated accounts became inaccessible or appeared to have been deleted. Telegram did not return a request for comment on whether the company took these accounts down.
