The Chinese-language artificial intelligence app Haotian is so effective that it’s made millions of dollars selling its face-swapping technology on Telegram. The service integrates easily with messaging platforms like WhatsApp and WeChat and claims that users can tweak up to 50 settings—including the ability to adjust things like cheekbone size and eye position—to help mimic the face they are impersonating. But while Haotian is a robust and versatile platform, researchers and WIRED’s own analysis have found that the service has been marketing to so-called “pig butchering” scammers and those running online fraud operations in Southeast Asia.
Scammers have used Haotian and other deepfake tools to more easily substantiate their deceptions by allowing victims to “videochat” with the character they believe they have been talking to as part of an investment opportunity, friendship, or even romantic relationship. Analysis by the cryptocurrency tracing firm Elliptic of four cryptocurrency wallets linked to Haotian shows the company has received at least $3.9 million in payments in recent years, including money from cryptocurrency wallets linked to alleged criminal activity, including fraud. Additionally, almost half of its payments had ties to a scam marketplace sanctioned by the US government, Elliptic says.
Hieu Minh Ngo, a reformed criminal hacker turned cybercrime investigator at the Vietnamese scam-fighting nonprofit ChongLuaDao, says that Haotian, which emerged around 2021, was “one of the first of its kind and very popular.” Ngo has conducted extensive research into Haotian and its operations. “Its results are nearly perfect,” he says. “And they are getting better and better every day. If you check in the crypto wallet, you will see the money coming in every single day.”
Haotian is just one part of the wider tech ecosystem that has emerged around Southeast Asia’s booming cybercrime industry and forced labor scam compounds. And as face swapping and other video deepfake tools have become more widely available, they have increasingly been incorporated into scamming and other types of cybercrime around the world. In the last two years, officials working for the United Nations Office on Drugs and Crime have identified more than 10 face-swapping tools potentially being used by cybercriminals in Southeast Asia, including for cryptocurrency scams and police officer impersonation.
Haotian has a website for its face-swapping tool, but it primarily promotes its desktop app via a public Telegram channel, which launched in October 2023 according to Ngo’s research. Through this channel, which now has more than 20,000 subscribers, the company markets new versions of the app, gives development updates, and offers technical support. While marketing software through Telegram isn’t inherently nefarious, researchers say that Haotian’s customer base has increasingly skewed toward scammers who already seek out information about an array of gray market services on the messaging app.
Telegram declined to comment. However, after WIRED got in touch with the company, the main public Haotian Telegram channel and some associated accounts became inaccessible or appeared to have been deleted. Telegram did not return a request for comment on whether the company took these accounts down.
