Scammers have devised a new method to manipulate stock markets by leveraging WhatsApp groups to deceive unsuspecting investors. This emerging scam does not require compromised trading accounts or stolen credit cards. Instead, it involves persuading individuals to execute legitimate trades, leaving them with losses when stock prices tumble.
Exploiting Social Engineering Tactics
These schemes utilize short-lived deepfake advertisements paired with promises of lucrative stock tips. Once individuals click on these ads, they are guided into specific WhatsApp groups based on their location. Within these groups, a seemingly credible ‘head analyst’ advises members on small-cap stocks, setting target prices and limits, which are actually orchestrated to manipulate the market.
According to analysts from Group-IB, this activity was uncovered during investigations into two fraudulent operations known as GoldBull and CoinLure. A report shared with Cyber Security News highlighted that scams are particularly challenging to counter when victims are manipulated into making trades themselves.
WhatsApp Groups Fueling Stock Manipulation
The GoldBull operation begins with deepfake ads posing as financial experts, creating urgency for quick action due to their brief online presence. Victims are directed into WhatsApp groups where an analyst persona presents what seems to be an exclusive investment opportunity.
Participants are instructed to purchase small-cap stocks and provide proof of their transactions. This tactic generates the necessary buying pressure to inflate stock prices. In some instances, groups with around 1,000 members managed to influence thinly traded stocks, involving $1.5 million to $3 million of victim investments in a single campaign.
For example, on November 6, 2025, participants were told to buy a NASDAQ-listed stock at $24.79, aiming for $29. The price reached $27.87 by December 9, but the target was not achieved. By February, the stock plummeted to $14.27, significantly below the purchase price.
Fake Investment Platforms and Network Expansion
The CoinLure operation employs search-engine-optimized pages and social media ads to lure individuals into sham investment platforms. Victims encounter fake registration processes and trial funds before being offered tiered plans, making the fraudulent service appear legitimate.
When victims attempt to withdraw funds, they face various obstacles such as minimum balance requirements and alleged fees, effectively trapping their investments. Some victims are even approached with deceitful recovery offers demanding upfront fees.
Investigators have linked CoinLure to 208 domains, employing common templates and hosting, with an estimated network revenue of $187 million. This infrastructure provides a pathway for authorities to trace fraudulent activities across related domains and ads.
The report emphasizes the need for comprehensive strategies that connect the dots across financial institutions and protect customer data. Individuals should verify financial advisors, avoid guaranteed returns, and refrain from sending fees to access their own funds.
