FHN 
Scammers are using WhatsApp groups to convince ordinary investors to buy specific stocks. Instead of stealing money directly from a bank or brokerage account, they manipulate victims into making legitimate trades themselves.
The campaigns typically begin with short-lived advertisements featuring fake financial experts or deepfake videos. The ads promise exclusive stock tips and encourage people to join WhatsApp groups.
Once inside, victims are connected with a convincing “analyst” who provides a stock name, buying price and expected target. The advice appears professional, but the real goal is to create artificial demand and push the stock price higher.
Researchers at Group-IB discovered the activity while investigating two organized investment-fraud operations known as GoldBull and CoinLure.
How the Stock Scam Works
GoldBull uses advertisements designed to look like they come from trusted financial professionals. The ads are often available for only a short time, creating a sense of urgency.
Potential victims are filtered based on their location and redirected into WhatsApp groups. There, the fake analyst encourages members to purchase a genuine small-cap stock using their normal brokerage accounts.
Victims may also be asked to provide proof that they completed the purchase. This helps scammers generate enough buying activity to influence thinly traded stocks.
In one case, investors were told on November 6, 2025, to buy a NASDAQ-listed stock at $24.79, with a target price of $29. The stock eventually reached $27.87 on December 9, giving it a 12.4% gain.
The scammers used the opportunity to sell their own holdings. The promised $29 target was never reached, and by February, the stock had fallen to $14.27—about 42% below the victims’ original purchase price.
The scam therefore works without compromising a brokerage account. The victims make the trades themselves, while the scammers profit from the resulting price movement.
Fake Investment Platforms Add Another Layer
The related CoinLure operation takes a different approach by directing victims toward fake investment websites.
Scammers use search-engine pages, social media advertisements and even romance-based manipulation to attract potential victims. The fraudulent platforms are designed to look legitimate, with registration pages, identity checks and even fake trial balances.
After victims deposit money, they may be told they need to pay additional fees before they can withdraw it. Common excuses include taxes, insurance charges, minimum balance requirements, account upgrades and technical problems.
Some victims are later contacted by supposed recovery services that demand another payment to recover their funds.
Investigators found one CoinLure platform connected to 208 domains that shared templates, hosting infrastructure and contact information. This shows how one fraudulent website can be part of a much larger network.
For investors, rushed stock recommendations, guaranteed profits, deepfake financial advertisements and WhatsApp groups asking for proof of purchases should all be treated as major warning signs. Always verify investment advice independently and use official brokerage channels rather than links or instructions provided through suspicious chat groups.
About the Author
