Artificial Chinese language intelligence app Haotian is so successful that it has made millions of dollars selling its face swap technology on Telegram. The service integrates easily with messaging platforms like WhatsApp and WeChat, and claims users can customize up to 50 settings – including the ability to adjust things like cheekbone size and eye position – to lend a hand mimic the face they’re pretending to be. While Haotian is a strong and comprehensive platform, WIRED researchers and analysis have found that the service targets so-called “pig slaughter” fraudsters and those running online scams in Southeast Asia.
Scammers are using Haotian and other deepfake tools to more easily justify their scams, allowing victims to “video call” a character they believe they are talking to as part of an investment opportunity, friendship, or even romantic relationship. An analysis by cryptocurrency tracking firm Elliptic of four cryptocurrency wallets linked to Haotian shows the company received at least $3.9 million in payments in recent years, including money from cryptocurrency wallets linked to alleged criminal activity, including fraud. Additionally, almost half of his payments were related to fraud sanctioned by the US government, says Elliptic.
Hieu Minh Ngo, a reformed criminal hacker turned cybercrime investigator with Vietnamese anti-fraud nonprofit ChongLuaDao, says Haotian, which emerged around 2021, was “one of the first of its kind and very popular.” Ngo has conducted extensive research on Haotian and his activities. “The results are almost perfect,” he says. “And they’re getting better every day. If you check your cryptocurrency wallet, you’ll see money coming in every day.”
Haotian is just one part of a broader technology ecosystem that has emerged around Southeast Asia’s booming cybercrime industry and forced labor fraud. As face swapping and other deepfake video tools become more widely available, they are increasingly being used in fraud and other types of cybercrime around the world. Over the past two years, officials working for the United Nations Office on Drugs and Crime have identified more than 10 face-swapping tools potentially being used by cybercriminals in Southeast Asia, including for cryptocurrency scams and impersonating a policeman.
Haotian has a website dedicated to the face-changing tool, but it promotes its desktop app primarily through a public Telegram channel, which Ngo research said launched in October 2023. Through that channel, which currently has more than 20,000 subscribers, the company sells recent versions of the app, shares development updates and offers technical support. While software marketing via Telegram is not inherently nefarious, researchers say Haotian’s customer base continues to grow. leaning towards fraudsters who are already looking for information about a range of gray market services on the messaging app.
Telegram declined to comment. However, after WIRED contacted the company, the main public Haotian Telegram channel and some associated accounts became unavailable or appeared to have been deleted. Telegram did not return a request for comment on whether the company had removed the accounts.