Thomas Unise
An AI face-swapping technology called Haotian has generated millions of dollars in revenue by marketing its services to scammers, particularly those running “pig butchering” fraud operations in Southeast Asia. The technology allows criminals to create convincing deepfakes for video calls with victims, enhancing the credibility of their scams.
The Haotian Operation
Haotian, a Cambodia-based company, offers sophisticated face-swapping software that integrates with popular messaging platforms like WhatsApp, WeChat, and Telegram. Users can adjust up to 50 facial settings to create convincing impersonations during video calls. The technology has become particularly valuable for scammers who use it to “video chat” with victims, reinforcing the deception in investment scams and romance frauds.
According to cryptocurrency tracing firm Elliptic, Haotian has received at least $3.9 million in payments, with nearly half linked to a scam marketplace sanctioned by the US government. The company markets primarily through Telegram channels with over 20,000 subscribers.
Marketing to Criminals
Haotian’s marketing materials frequently reference the tool’s utility for deceptive activities. Promotional messages highlight how the technology can create an “elite, authentic persona” that the “client completely believes.” The company’s materials openly discuss social engineering techniques, particularly using the Chinese phrase “jingliao” which connotes “pig butchering” scams.
When contacted by WIRED, Haotian claimed its target customers are “entertainment streamers or live salers” and denied marketing to scam centers. However, after being confronted with evidence, the company deleted the entire conversation.
Technical Capabilities
The software offers several advanced features:
- Real-time face swapping during video calls
- Voice impersonation and gender-changing capabilities
- Resistance to common deepfake detection methods (like hand-waving tests)
- Integration with numerous messaging and video conferencing platforms
- Granular facial adjustments for more convincing impersonations
Annual subscriptions for the “fully functional” version reportedly cost up to $4,980, with cheaper packages available.
Financial Connections
Researchers found Haotian used Huione Guarantee (also known as Haowang Guarantee) as its payment processor. This Telegram-based marketplace facilitated the sale of various tools used in scamming operations before being shut down and sanctioned by the US government. Huione Guarantee was estimated to have facilitated more than $24 billion in gray market transactions.
Elliptic’s analysis revealed that cryptocurrency wallets used by Haotian received 3,558 payments totaling $3.9 million, with $1.2 million flowing between Haotian and Huione entities. Some wallets paying Haotian were linked to known fraud instances, confirming its use by criminals.
Broader Impact
Haotian represents just one component of the expanding technological ecosystem supporting Southeast Asia’s cybercrime industry. The UN Office on Drugs and Crime has identified more than 10 face-swapping tools potentially being used by cybercriminals in the region over the past two years.
While Haotian’s individual revenue might seem modest compared to the overall scale of scam operations, security experts note that these incremental transactions to technology sellers collectively sustain the illicit ecosystem, as relatively small investments can launch sophisticated fraud operations.
GIPHY App Key not set. Please check settings