The Chinese-language artificial intelligence application Haotian has gained notoriety for its highly advanced face-swapping capabilities, enabling "nearly perfect" facsimiles of individuals in live video chats. This app has reportedly generated millions of dollars, primarily through transactions conducted on Telegram, and integrates seamlessly with popular messaging platforms like WhatsApp and WeChat. Users can customize an extensive range of facial features—up to 50 different settings—to closely imitate the appearance of another person.
Research has indicated that Haotian has been marketed to scammers involved in "pig butchering" schemes, primarily based in Southeast Asia. These scammers utilize Haotian and similar deepfake technologies to enhance their fraudulent operations, allowing victims to believe they are engaging in genuine interactions, whether in romantic or financial contexts. According to Elliptic, a cryptocurrency tracing firm, Haotian has processed around $3.9 million in payments tied to fraud-related activities, with nearly half of these transactions linked to a marketplace sanctioned by the U.S. government.
Cybercrime investigator Hieu Minh Ngo, from the nonprofit ChongLuaDao, emphasizes the effectiveness of Haotian’s software. He describes it as "one of the first of its kind" that has achieved remarkable results, allowing scammers to continuously attract funds every day. The rise of Haotian is significant within the context of a burgeoning cybercrime industry prevalent in Southeast Asia, where deepfake tools have become increasingly integrated into various schemes, including impersonation scams and fraudulent financial solicitations.
Haotian’s website promotes its desktop application alongside a public Telegram channel. This channel, initiated in October 2023, serves to market new app features, provide updates, and offer technical assistance to a growing subscriber base exceeding 20,000. While promoting software through platforms like Telegram isn’t inherently malicious, researchers have noted a concerning inclination toward attracting clients who are already involved in or seeking information about illegal activities.
In a concerning development, after WIRED reached out for inquiries, the main public Telegram channel for Haotian—and several associated accounts—were either made inaccessible or deleted, raising questions about the company’s awareness and responsiveness to the scrutiny of its ties to cybercriminal enterprises.
Haotian operates out of Cambodia and offers on-site installation services, which has drawn attention from UN researchers. The company’s promotional material appears to highlight its utility for questionable purposes, suggesting that the technology can fabricate an "elite, authentic persona" that clients will believe in completely. Moreover, some of its communications allude to enhancing trust in interactions through visually convincing video calls.
In addressing questions about its operations, Haotian has claimed to have zero tolerance for fraud-related use of its software and expressed that it does not directly market to scam centers. However, when prompted regarding specific allegations on its website that suggest otherwise, the response was vague, leading to a premature end of the conversation.
While Haotian provides desktop software with various customization options, the brand’s dependence on subscription-based sales has also been evident, with annual costs reaching upwards of $4,980 for a full version. Additionally, there are indications that Haotian has ties with Huione Guarantee, a platform previously sanctioned for facilitating scams and illegal activities. Evidence has shown that Huione was involved as both a payment processor and escrow service for Haotian, leading to substantial funding flows between the entities.
The implications of these developments raise significant concerns about the evolution of technology in enabling cybercrime. Haotian is not an outlier; it represents a broader trend within a flourishing scam economy where technologies, including deepfake software, reinforce a cycle of deception and fraud. As these tools become more accessible, the need for vigilance and advanced detection measures in online interactions increases substantially.
