A realtime deepfake software package called Haotian AI, obtained and tested by 404 Media reporter Joseph Cox, is being sold to operators inside Southeast Asian scam compounds, allowing users to replace their face in live video calls across WhatsApp, Microsoft Teams, Zoom, TikTok, Instagram, and YouTube. The investigation, published this week, marks the first time a journalist has directly tested the tool.
Haotian AI operates as a virtual camera that overlays a swapped face in real time, preserving lighting, hand-over-face occlusion, and facial expression movement. The software is marketed in Chinese, priced at $1,998 per year with an additional $498 per custom face model, and payment is accepted in Tether (TRC20) on the TRON network. Hardware requirements include an Nvidia RTX 4080 SUPER GPU, and the vendor offers physical installation services in parts of Cambodia. Cybercrime NGO Chong Lua Dao, which includes former hacker Hieu Minh Ngo, told 404 Media the operation is based in Cambodia, with video evidence of staff installing the software in an office building in Phnom Penh.
Security researcher Tom Cross of GetReal Security observed an installation session and analyzed the software’s binaries. Cross identified the inswapper face-swap model, maintained by InsightFace and also used in open-source tools such as FaceFusion, as a core element of Haotian AI. InsightFace told 404 Media: “The open-source models we release on GitHub (including inswapper) are strictly intended for non-commercial research and academic purposes. Any use of these models in a criminal context, such as the ‘Haotian AI’ software you mentioned, is a direct violation of our intended use cases and the spirit of our licensing terms.” This pattern of commercial fraud tooling built on top of openly licensed biometric libraries parallels dark-web operations targeting KYC biometric checks that researchers have been tracking since at least early 2025.
Blockchain analytics firm Chainalysis found the wallet address supplied by Haotian AI processed over $253,000 between January 6, 2026 and the date of publication, with more than $4 million in total inflows to Haotian AI wallets dating to October 2023. Andrew Fierman, head of national security intelligence at Chainalysis, told 404 Media those wallets “have interacted extensively on-chain with HuionePay and with Chinese-language money laundering services and scam technology vendors.” In April 2026, the vendor added a KYC bypass module, with a demo showing a user appearing to defeat a selfie liveness check by feeding a virtual camera into the verification flow. Deepfake-enabled fraud is projected to drive U.S. fraud losses to $40 billion by 2027, according to a Deloitte analysis.
A vendor demo screenshot obtained by 404 Media showed a WhatsApp video call featuring the Metropolitan Police Department of Washington, D.C. logo, indicating the tool is being marketed for impersonating at least one U.S. law enforcement agency. The MPD told 404 Media it had not received reports of deepfake-based impersonation but had previously warned that fraudsters were using video calls to impersonate MPD officials.
Standard detection tools have not kept pace. Researcher Charles Fross, co-author of a paper testing the Xception deepfake detection model, told 404 Media: “While Xception hit 89.1 percent accuracy on the control stuff, it misclassified almost 100 percent of the Haotian samples as ‘authentic’. Haotian’s work is shockingly convincing, especially with how it handles facial and body movements.” This failure rate is consistent with recent findings that modern deepfakes can defeat physiological liveness detection by replicating subtle biometric signals.
404 Media also identified at least three other Chinese-language realtime deepfake tools advertised for similar use cases: Panda AI, Xiaomi Technology AI, and Ark Technology AI. Zoom told 404 Media it will launch integrated deepfake risk detection with real-time alerts for synthetic audio or video later in 2026. Operation Shamrock founder and former prosecutor Erin West told 404 Media: “Real-time deepfake software isn’t ending up in scam compounds by accident. If prosecutors can prove knowledge or willful blindness, these companies belong in court right alongside the operators they enable. That’s how you go after the supply chain instead of chasing victims one stolen retirement at a time.” The investigation arrives as legislation to federally criminalize AI impersonation fraud is before the Senate.
Sources: 404 Media
–
By the ID Tech Editorial Team
