\u201c"Oh my God. Oh my God," I blurted out when I saw my own face reflected on someone else's body. Nothing was missing: from the scraggly beard, the goofy smile, to even the dark circles under their eyes.<\/p>\n\n\n\n
I was on a Microsoft Teams call at the time, and the person on the other end of the screen was\u2026 me. To be precise, the person on the other end was a complete stranger, whose face bore no resemblance to mine. However, all he needed was a gaming laptop and the latest software that scammers are hunting for to "superimpose" my face onto his own right in the middle of the call. That "me" face on the screen pinched his cheeks, covered his nose, stroked his chin, and yet it looked so real, as if I were looking in a mirror, without revealing any flaws.<\/p>\n\n\n\n
Deepfake videos in the past mostly just involved pasting someone's face onto a pre-recorded video. But what I have in my hands is completely different: it allows you to impersonate anyone during a live call. After weeks of haggling with the Chinese-speaking scam group behind it, a tool called Haotian AI, I finally obtained a copy of the software. Haotian AI is specifically designed to run on the popular platforms we use every day: WhatsApp, Microsoft Teams, Zoom, TikTok, Instagram, and YouTube.<\/p>\n\n\n\n
Haotian AI opens a new chapter in deepfake fraud, a chapter that perhaps neither users nor technology companies have been prepared for. Now, fraudsters can change their appearance during a phone call to commit scams. Romance scams, tax fraud, virtual kidnappings: all are at risk of escalating more intensely as real-time deepfake software becomes increasingly sophisticated.<\/p>\n\n\n\n
This is the first time 404 Media has had the chance to get hands-on with this software to see how it works, how effective it is, and what its appearance reveals about the present and near future of deepfake scams. Through our investigation, we found that Haotian AI had previously showcased this tool as a way to impersonate at least one police department in the US. We also traced its connection to money laundering rings run by Chinese speakers and to the ecosystem that "backs" massive scam operations in Southeast Asia. Furthermore, this tool has helped those behind it pocket over $4 million. More importantly, Haotian AI is likely just a rehash of open-source deepfake tools, meaning its true value lies in its dedicated technical support service. Thanks to this, even criminals with no technological knowledge can now use it, paving the way for real-time deepfake scams to spread globally.<\/p>\n\n\n\n
\u201c"It surpasses everything currently on the market," the Haotian AI interface advertises itself.<\/p>\n\n\n\n
Haotian AI's real-time deepfake technology keeps up with changes in lighting and objects gliding across its screen, according to promotional clips the company released on Telegram. One ad shows an Asian woman "transforming" into actress Gal Gadot. In it, the "fake Gadot" blows a kiss, covers one eye, and then quickly swipes her hand across her face without the video stuttering. Many other tools malfunction as soon as the user touches their face, revealing the real face underneath. Haotian AI, however, remains unfazed, its mask remaining perfectly in place. <\/p>\n\n\n\n
In a live demo via Telegram, a technician from Haotian AI showed me that the software can make lips thicker or thinner, jawline sharper or rounder, all in the blink of an eye. Its interface also allows users to adjust the nose size for the deepfake, press a "remove acne" button, and even change the shape of the eyes. <\/p>\n\n\n\n
Worryingly, Haotian AI not only fools the naked eye, but can also bypass tools designed to detect deepfakes. Xception is one of them; however, in a study published in June 2025, scientists found that it failed to identify deepfakes created by Haotian AI.<\/p>\n\n\n\n
\u201cWith the control samples, Xception achieved an accuracy of 89.11 TP3T. Yet with Haotian\u2019s sample, it misidentified almost 1001 TP3T as genuine,\u201d Charles Fross, one of the study\u2019s authors, said via email. \u201cHaotian\u2019s product is frighteningly convincing, especially in how it handles facial and body movements.\u201d<\/p>\n\n\n\n
There are many ways to create deepfakes, but simply put, they all involve training a machine learning model from a series of photos of a person's face, then superimposing that face onto another face in a video, frame by frame. This can take a few seconds, a few minutes, or longer, depending on the method and the length of the clip. Real-time deepfakes are similar, only much more complex, because they must both closely follow a single face and continuously apply the fake layer without a single pause.<\/p>\n\n\n\n
Haotian AI is a link in a massive Chinese-speaking criminal ecosystem that serves multi-billion dollar fraud rings in Southeast Asia. In fact, these networks thrive on Telegram. Simply getting into one of these channels unlocks a nearly endless black market: money laundering, malware, and more \u2013 every service is "vetted." These Chinese Telegram networks are easy to access, extremely dangerous, and enormous. Researchers say one marketplace, Xinbi Guarantee, facilitated up to $21 billion in transactions. Authorities even had to shut down another marketplace, Huione Group, from the US financial system.<\/p>\n\n\n\n
In December 2025, when WIRED published an article about Haotian AI and contacted Telegram for feedback, Haotian AI's official Telegram channel suddenly disappeared and became inaccessible. However, the company remained successful, continuing to release regular updates and sell its technology as usual, according to 404 Media.<\/p>\n\n\n\n
I found Haotian AI's Telegram account and used Google Translate to message them that I wanted to buy the technology. For weeks, nothing came of it. Every time someone from the company asked if I had a PC powerful enough to run the software, I said yes, and they went silent again. It wasn't until March that things started to change; they began responding much more quickly. I also timed my Telegram messages perfectly to coincide with when Haotian AI's representatives were online.<\/p>\n\n\n\n
According to the Anti-Fraud Organization, Haotian AI is based in Cambodia. The organization's founder, Ngo Minh Hieu, provided 404 Media with a series of screenshots showing Haotian AI even offering on-site software installation services "in some areas of Cambodia." Hieu also included a video that appears to show Haotian AI customer service representatives installing software in an office building in Phnom Penh.<\/p>\n\n\n\n
During our conversation, a representative from Haotian AI sent me a list of required computer specifications. Looking at the specifications, it was no different from a mid-range to high-end gaming PC: an i7 processor, 16GB of DDR5 RAM, and most importantly, an Nvidia 4080 SUPER graphics card. Having such a powerful graphics card with its parallel processing capabilities is key to creating a high-quality real-time deepfake video, just like any other AI-generated content.<\/p>\n\n\n\n
Next, they requested a series of screenshots to prove we actually had a system that met or exceeded those specifications. I asked Emanuel Maiberg of 404 Media to take individual screenshots of his high-performance gaming PC. It took several days of going back and forth like that, probably to reassure them we weren't just wasting our time, before Haotian AI finally let us proceed to the next step.<\/p>\n\n\n\n
\u201cCome in,\u201d the company contact messaged, after setting up a private Telegram group chat to connect us with other departments at Haotian AI. The group included me, the person I\u2019d been communicating with for a while, and two more Telegram contacts, one of whom was referred to as a \u201ctechnician.\u201d They would guide me through the software installation.<\/p>\n\n\n\n
This person uploaded four files: the Haotian AI software, split into three password-protected files, and a remote control software called AnyDesk. It turned out I didn't have to install anything myself. In the service package, Haotian AI wanted to remotely access Emanuel's computer to install everything for him. "Just sit in front of your computer and watch the whole process while I connect remotely," the representative said, using Telegram's automatic translation.<\/p>\n\n\n\n
As journalists who regularly work with sensitive information, we were uneasy about allowing a group with ties to crime free access to our computers, as it was difficult to predict what they might do. Finally, Tom Cross, head of threat research at cybersecurity firm GetReal Security, agreed to let us test it on one of his machines. Cross downloaded remote control software and then opened the door for the fraudsters to enter.<\/p>\n\n\n\n
Cross recounted that he watched the technician create a new partition on his hard drive, disable numerous Windows security layers, including the firewall, then download and install WinRAR, and set up a pre-installed Windows Defender package. Once finished, the technician extracted the Haotian AI software to the new partition, installed it, logged in, and downloaded a specific Nvidia driver update. Finally, they installed Telegram. These were all highly professional operations that even an average user or scammer might not be able to perform so smoothly and quickly. Yet everything was in place in just a few minutes.<\/p>\n\n\n\n
To mark me as a new guest, they changed the group chat profile picture to Haotian AI's distinctive wolf logo, adding the English text "New!" right below it.<\/p>\n\n\n\n
Then, the company offered to call me on Telegram for a live demo of the tool. Assuming I wasn't a native speaker, a representative asked, "Do you understand Chinese?" I told them I could only text, not speak. They brushed it off, saying it was fine.<\/p>\n\n\n\n
The technician called via Telegram, showing the software running while typing out each step of the process. From beginning to end, I don't think I saw his real face. As soon as the call started, he superimposed his face onto Andy Lau, the famous Hong Kong actor. At one point, he even transformed into a woman. The technician, likely sitting somewhere on the other side of the globe, covered his mouth and one eye with his hand. This live demo was no less impressive than the Gal Gadot clip they had filmed earlier.<\/p>\n\n\n\n
Haotian AI gave me a free one-day trial, but I could only transform into a few pre-set faces. To have a custom model to transform into anyone I wanted, we had to submit a series of photos of that person, and of course, pay. Their price was $1,998 per year for the software, plus $498 per custom model. The company demanded payment in TRON (TRC20), a form of Tether cryptocurrency running on the TRON blockchain. Unlike Bitcoin, which fluctuates wildly, Tether is always pegged to the US dollar. We transferred the full amount they requested.<\/p>\n\n\n\n
The fact that Haotian AI still readily sold the tool to someone who doesn't speak Chinese suggests that it may have spilled over beyond the region's specific cybercrime ecosystem. Compared to tools used by scammers in Nigeria, for example, Haotian AI's deepfake is clearly superior. The only thing holding it back is probably the language barrier, or sometimes the price. <\/p>\n\n\n\n
I provided the payment wallet address to Chainalysis, a company specializing in cryptocurrency tracking, to ask if they could obtain any information. \u201cThis wallet has processed over $253,000 between January 6, 2026, and now. In total, Chainalysis has traced over $4 million flowing into Haotian wallets, going back to October 2023,\u201d Andrew Fierman, head of national security intelligence at Chainalysis, stated in an email report. \u201cThese wallets have very heavy on-chain transactions with HuionePay, along with money laundering services and Chinese-speaking phishing technology providers, such as image editing and translation services, all aimed at identifying, targeting, and manipulating victims.\u201d<\/p>\n\n\n\n
To create their own model, Haotian AI asked me to send 3 to 8 photos of the subject's face. They wanted the photos to be taken looking directly into the camera, with nothing obscuring facial features like hair covering them, no grinning or strange expressions, and no excessive Photoshop editing.<\/p>\n\n\n\n
Sitting at my desk, I took nine selfies. I deliberately wore glasses in some of them, just to see if Haotian AI would ask me to take them again. Afterward, a Haotian AI customer service representative invited me to another private chat group on Telegram. They explained it was a "technical support group created specifically for you.".<\/p>\n\n\n\n
Someone in the team asked me which chat platforms I planned to use Haotian AI with. I said WhatsApp and Zoom, and they immediately sent instructions on how to include the software's video output in calls on those two platforms. To put it simply, Haotian AI acts as a virtual webcam; users just select it whenever they join Microsoft Teams or other platforms.<\/p>\n\n\n\n
While showing me how to configure WhatsApp, the support staff sent me some screenshots. One of them was a WhatsApp video call that even displayed the distinctive logo of the Metropolitan Police Department (MPD) in Washington DC. The MPD told 404 Media that they had not received any reports of scammers using deepfakes, but in November 2025, they had warned the public about people impersonating MPD officials in video calls.<\/p>\n\n\n\n
Fraudulent operations in Southeast Asia sometimes set up elaborate Hollywood-style film sets to deceive victims into believing they are speaking with authorities, from the rooms and flags to the scammers wearing military uniforms. They are often backed by organized crime bosses from China.<\/p>\n\n\n\n
<\/p>\n\n\n\n
Images of Haotian AI's interface, photos sent to the company by 404 Media, and a WhatsApp demo with the MPD logo. Photo: 404 Media.<\/em><\/p>\n\n\n\n 404 Media contacted a number of companies targeted by Haotian AI to see if they had any ways to prevent this type of real-time deepfake. A Zoom spokesperson said: \u201cWe just announced that Zoom is further tightening meeting security with a built-in deepfake detection solution that will alert you immediately when it detects synthesized audio or video. This tool will be available this summer.\u201d<\/p>\n\n\n\n Meta didn't directly answer the question, only mentioning other efforts targeting the infrastructure that phishing centers rely on, including the deletion of tens of millions of Facebook, Instagram, and WhatsApp accounts.<\/p>\n\n\n\n Microsoft, TikTok, and Google confirmed receiving requests for comment but ultimately did not issue any statement.<\/p>\n\n\n\n The very day I sent the selfie, someone in the group chat reported that my custom model was finished. The software updated automatically, and only then were we able to actually test it on my face.<\/p>\n\n\n\n The first time, we tried it with Cross from GetReal. The result was terrible, and that's putting it mildly. I vaguely noticed my sunken eyes, a bit of stubble, but my whole face seemed stretched and haphazardly superimposed onto Cross's face, who was of a different build than me. Cross was sitting in a dimly lit hotel room.<\/p>\n\n\n\n To make deepfakes convincing, scammers have to invest more: the lighting must be perfect, and the stand-in should have a facial structure that closely resembles the subject. "Because AI only swaps facial features, if the stand-in's face shape deviates too much from the character being recreated, the result will not be satisfactory," Haotian AI's customer service explained to me.<\/p>\n\n\n\n When I switched to trying it with Ian McGrew, a product manager at GetReal Security, the results were much better. His face was closer to mine. That said, McGrew's facial features don't actually resemble mine at all. Yet, even though McGrew was sitting in a Starbucks, gaming on his laptop via public Wi-Fi, Haotian AI still transformed his face into mine.<\/p>\n\n\n\n Comparison image: McGrew on the left, and the deepfake on the right. Photo: 404 Media.<\/em><\/p>\n\n\n\n I opened a Microsoft Teams call to test it out. As soon as I joined, I was greeted by my own face. The mischievous deepfake raised one eyebrow, then smiled broadly and waved just as I started yelling, "Oh my god, oh my god!".<\/p>\n\n\n\n Just like in the Haotian AI demo clips, I told McGrew to touch faces, pull cheeks, and cover eyes. While not as smooth as the Gal Gadot scene, the result was still good enough to fool others. <\/p>\n\n\n\n There were also a few shortcomings. Haotian AI could handle people waving their hands in front of it, but only if the fingers were held together in a single block. As soon as the fingers were spread apart, the image started to warp and distort. This seems to be a common weakness of real-time deepfakes today, to the point that those wary of scams have even come up with a trick called the three-finger test. At one point, McGrew brought his fingers close to his eyes, and his eyes bulged out.<\/p>\n\n\n\n Cross also dissected Haotian AI's own files. "This software uses several popular AI libraries to select faces, swap faces, and then refine them after swapping, including 'inswapper,' a face-swapping machine learning model available on HuggingFace and integrated into many popular open-source face-swapping tools like FaceFusion," he said.<\/p>\n\n\n\n Inswapper is developed and maintained by a company called InsightFace. InsightFace has an open-source version of Inswapper and a paid product for businesses. \u201cThe open-source models we release on GitHub, including Inswapper, are for research and academic purposes only, not for commercial use. Using them for criminal purposes, like the \u2018Haotian AI\u2019 software you mentioned, goes against the intended use and spirit of our licensing terms,\u201d an InsightFace spokesperson told 404 Media via email. \u201cWith any legitimate commercial application, we have a formal licensing process to ensure that the technology only falls into the hands of vetted organizations, for proper and legitimate purposes. That\u2019s a world apart from anonymous individuals secretly using our research code without permission.\u201d<\/p>\n\n\n\n The company acknowledges that the "dual-use" nature of AI is a major headache for researchers. "Once research code is published to the scientific community, we have no control over how anonymous individuals will manipulate it. But we do not condone, encourage, or associate with criminals," a spokesperson affirmed.<\/p>\n\n\n\n While Haotian AI has largely evolved from open-source face-swapping tools, the company's true value ultimately lies in its technical support. Even a tech-illiterate scammer, someone who knows how to trick people but is stumped by the intricate details of deepfakes, can now swap their face in real time.<\/p>\n\n\n\n The non-profit organization Anti-Fraud informed 404 Media that the fraudulent complexes used all sorts of deepfake tools. These could be free, open-source software, internally developed programs, or outsourced to external contractors.<\/p>\n\n\n\n In 404 Media's own survey of this ecosystem, several other tools also emerged: Panda AI, which is said to be able to run WhatsApp on phones; Xiaomi Technology AI, priced similarly to Haotian AI; and Ark Technology AI, with comparable capabilities.<\/p>\n\n\n\n For years, these fraudulent camps in Southeast Asia operated almost openly, while local authorities largely ignored the wave of criminals and victims of human trafficking forced into hard labor inside. Only recently have some agencies begun to crack down on these camps, even allowing reporters to see them firsthand.<\/p>\n\n\n\n In a court filing submitted last month, an FBI agent meticulously recounted how the agency obtained statements from victims at the complexes and dissected the mountain of evidence gathered at the scene. As part of that investigation, the U.S. prosecuted two Chinese nationals, seized $700 million in cryptocurrency, and shut down a Telegram channel that was luring people to work at a complex in Cambodia.<\/p>\n\n\n\n This raises a question: will those providing technology services to these complexes face legal consequences? \u201cProsecuting the app providers is a tricky matter. The technology itself isn\u2019t the crime; the relationship behind it is. You have to prove the seller knew, or deliberately turned a blind eye to, that their customers were part of a scam,\u201d Erin West, a former prosecutor and founder of Operation Shamrock, an organization that warns the public about and dismantles organized scam groups, told 404 Media via email.<\/p>\n\n\n\n \u201c"Real-time deepfake software didn't just appear in these complexes out of nowhere. If prosecutors can prove that the sellers knew, or deliberately ignored, then those companies deserve to be brought to court and sit alongside the very people they aided. That's the way to cut off the entire supply chain at its root, instead of chasing after and patching up each victim after every lost retirement savings," she added.<\/p>\n\n\n\n Recently, the FBI also shut down another provider accused of using "neural networks" to create fake documents that looked incredibly realistic. In February 2024, 404 Media exposed OnlyFake, where people could get fake driver's licenses and passports for a small amount of cryptocurrency. Two years later, the US Department of Justice announced it had indicted the site's creator, a Ukrainian citizen named Yurii Nazarenko, who later pleaded guilty to fraud and charges related to conspiracy to commit a crime.<\/p>\n\n\n\n In response to a barrage of detailed questions from 404 Media, the Haotian AI representative simply uttered a single word, "OK," in Chinese.<\/p>\n\n\n\n Haotian AI didn't stop there; it ventured into areas that directly targeted fraud in a far more blatant way. One such tool is designed to bypass the KYC (Know Your Customer) identity verification process. Normally, when opening an online account, people have to take a selfie and provide a copy of their identification. Haotian AI's new tool promises to help customers skip all those steps simply by controlling a virtual face to look directly into a webcam.<\/p>\n\n\n\n \u201cHello! To celebrate our business expansion, we are launching new products, including custom facial recognition technology and KYC verification. We invite both new and existing customers to learn more. Free trials are available! Thank you for your trust and support,\u201d Haotian AI wrote in a Telegram announcement in April. In the accompanying illustrative clip, a user appears to have passed the selfie KYC test by controlling a video of a woman.<\/p>\n\n\n\n Haotian AI concluded his announcement with the words: "Wishing you prosperous business and long-lasting success!"\u201c<\/p>\n\n\n\n According to Joseph Cox, 404 Media, published May 7, 2026. <\/em><\/p>","protected":false},"excerpt":{"rendered":" “\u00d4i tr\u1eddi \u01a1i. \u00d4i tr\u1eddi \u01a1i,” t\u00f4i bu\u1ed9t mi\u1ec7ng k\u00eau l\u00ean khi th\u1ea5y g\u01b0\u01a1ng m\u1eb7t c\u1ee7a ch\u00ednh m\u00ecnh l\u1ea1i n\u1eb1m tr\u00ean th\u00e2n m\u1ed9t ng\u01b0\u1eddi kh\u00e1c. Kh\u00f4ng s\u00f3t th\u1ee9 g\u00ec: t\u1eeb b\u1ed9 r\u00e2u l\u00fan ph\u00fan, n\u1ee5 c\u01b0\u1eddi ng\u1edd ngh\u1ec7ch, cho t\u1edbi c\u1ea3 qu\u1ea7ng th\u00e2m d\u01b0\u1edbi m\u1eaft. L\u00fac \u0111\u00f3 t\u00f4i \u0111ang trong m\u1ed9t cu\u1ed9c g\u1ecdi Microsoft Teams, […] from Kh\u00e1m ph\u00e1 ph\u1ea7n m\u1ec1m deepfake th\u1eddi gian th\u1ef1c Trung Qu\u1ed1c \u0111\u1ee9ng sau c\u00e1c v\u1ee5 l\u1eeba \u0111\u1ea3o to\u00e0n c\u1ea7u<\/span><\/a><\/p>\n","protected":false},"author":10,"featured_media":5892,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[7,10],"tags":[],"class_list":["post-5890","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-canh-bao-pho-bien","category-chieu-tro-lua-dao-pho-bien"],"_links":{"self":[{"href":"https:\/\/chongluadao.vn\/blog\/en\/wp-json\/wp\/v2\/posts\/5890","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chongluadao.vn\/blog\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chongluadao.vn\/blog\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chongluadao.vn\/blog\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/chongluadao.vn\/blog\/en\/wp-json\/wp\/v2\/comments?post=5890"}],"version-history":[{"count":1,"href":"https:\/\/chongluadao.vn\/blog\/en\/wp-json\/wp\/v2\/posts\/5890\/revisions"}],"predecessor-version":[{"id":5891,"href":"https:\/\/chongluadao.vn\/blog\/en\/wp-json\/wp\/v2\/posts\/5890\/revisions\/5891"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/chongluadao.vn\/blog\/en\/wp-json\/wp\/v2\/media\/5892"}],"wp:attachment":[{"href":"https:\/\/chongluadao.vn\/blog\/en\/wp-json\/wp\/v2\/media?parent=5890"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chongluadao.vn\/blog\/en\/wp-json\/wp\/v2\/categories?post=5890"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chongluadao.vn\/blog\/en\/wp-json\/wp\/v2\/tags?post=5890"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}