The Chinese language is artificial Intelligence app Haotian is so effective that it has made millions of dollars selling its face-swapping technology on Telegram. The service integrates easily with messaging platforms like WhatsApp and WeChat, and claims that users can tweak up to 50 settings — including the ability to adjust things like cheekbone size and eye position — to help imitate the face they’re impersonating. But while Haotian is a powerful and versatile platform, researchers and WIRED’s own analysis found that the service was marketed to so-called “pig slaughter” scammers and those running online scams in Southeast Asia.
Scammers have used Haotian and other deepfake tools to more easily prove their deception by allowing victims to “video chat” with the character they believe they were talking to as part of an investment opportunity, friendship, or even a romantic relationship. An analysis by cryptocurrency tracking firm Elliptic of four cryptocurrency wallets linked to Haotian shows that the company has received payments worth at least $3.9 million in recent years, including funds from cryptocurrency wallets linked to alleged criminal activity, including fraud. In addition, nearly half of its payments were related to a fraudulent market punished By the US government, Elliptic says.
Haotian, which appeared around 2021, was “one of the first of its kind and very popular,” says Hue Minh Ngo, a reformed criminal hacker turned cybercrime investigator at Vietnamese anti-fraud nonprofit ChongLuaDao. Ngo has conducted extensive research on Haotian and its operations. “The results are almost perfect,” he says. “They are getting better day by day. If you check your cryptocurrency wallet, you will see money coming in every day.”
Haotian is just one part of a broader technology ecosystem that has emerged around Southeast Asia’s burgeoning cybercrime industry and forced labor fraud complexes. As face swapping and other video deepfake tools become more widely available, they are increasingly being integrated into scams and other types of cybercrime around the world. In the past two years, officials working at the United Nations Office on Drugs and Crime have identified more than 10 face-swapping tools potentially used by cybercriminals in Southeast Asia, including cryptocurrency-related scams and… Impersonating a police officer.
Haotian has a website for its face swap tool, but mainly promotes its desktop app via a public Telegram channel, which launched in October 2023 according to Ngo’s research. Through this channel, which now includes more than 20,000 subscribers, the company markets new versions of the application, provides development updates, and provides technical support. Although software marketing via Telegram is not inherently nefarious, researchers say Haotian’s customer base has been increasingly growing. oblique towards scammers who are actually searching for information about a range of gray market services on the messaging app.
Telegram declined to comment. However, after WIRED contacted the company, the main public Haotian Telegram channel and some associated accounts became inaccessible or appeared to have been deleted. Telegram did not respond to a request for comment on whether the company had closed these accounts.