In July 2025, Athenian Tech (AT) identified a coordinated AI generated deepfake campaign of Prime Minister Narendra Modi, which showed him promoting a fraudulent online investment platform which was circulated on Facebook. The manipulated video falsely portrayed the PM Modi endorsing an automated wealth‑generation scheme, while additional synthetic assets misused the identities of senior public figures, including Nirmala Sitharaman, Narayana Murthy, and Sudha Murty, to create a further perception of legitimacy. Paid advertisements amplified the operation, directing users to scam websites hosted on .top domains that harvested personal and financial information before funnelling victims into organised investment‑fraud networks.
AT’s threat‑intelligence platform, Prime, detected the campaign through continuous monitoring of the Dark Web, Deep Web, Surface Web, Telegram channels and paid-social-media ad inventories. Prime identified the deepfake source assets, traced associated syndicate accounts, and mapped TTP patterns linking the operation to Southeast Asian fraud groups specialising in deepfake‑enabled investment scams. AT’s analysis produced evidence packages that supported rapid takedown requests, platform‑level escalations, and regulatory notifications.
Impact
AT’s reporting directly contributed to the removal of fraudulent domains and Facebook ad assets, enabling coordinated action between law enforcement agencies and regulatory bodies. The case highlighted the growing national‑security implications of AI‑generated impersonation campaigns and reinforced the need for stronger public‑awareness and digital‑literacy initiatives to counter deepfake‑driven financial fraud.
