Alleged Fabricated News Sites and Deepfakes Impersonated Maltese Ministers, Financial Experts, and Media to Promote NethertoxAGENT Fraud

Purportedly AI-generated deepfake videos and fabricated news pages impersonating Maltese ministers, journalists, financial experts, and major media outlets reportedly promoted the fraudulent "NethertoxAGENT" investment platform. The scam used synthetic interviews, cloned branding, and falsified testimonials to mislead social media users, reportedly inducing financial losses and prompting law enforcement concern in Malta.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves the use of AI-generated deepfakes to impersonate trusted public figures for the purpose of executing a financial scam.

Additional risk subdomains

• 3.1 False or misleading information: The campaign relied heavily on fabricated news articles, fake interviews, and falsified expert testimonials to mislead the public.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human malicious actors who intentionally deployed deepfake technology post-deployment to defraud social media users.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the creation of AI-generated content such as deepfakes, which falls under Limited Risk and requires transparency obligations to inform users they are interacting with AI-generated content.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Video Generation; Voice Generation
• Behaviour type: Tool
• Alleged developer: Unknown voice synthesis technology developers, Unknown generative AI developers, Unknown deepfake technology developers
• Alleged deployer: Unknown scammers, Unknown scam network based in Malta, NethertoxAGENT scammers
• Alleged harmed parties: TVM, Times of Malta, Silvio Schembri, Rosianne Cutajar, Roberta Metsola, Robert Abela, Newsbook, Michael C. Bonello, Matthew Bonanno, MaltaToday, Malta Independent, Malta Financial Services Authority, Lombard Bank Malta, Kenneth Farrugia, Journalists in Malta, Journalists, Journalistic integrity, Investors in Malta, Investors, Ian Borg, General public of Malta, General public, Francis J. Vassallo, Epistemic integrity, Clyde Caruana

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Minor
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Minor
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Minor
• Epistemic: direct Minor, indirect Minor
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report explicitly describes financial losses, noting that a woman lost her life savings to a similar deepfake scam and that the current scam solicits 215 euros per user.

Indirectly caused: Victims lost money to the fraudulent trading platform, including one woman who lost her life savings in a related deepfake scam.

Inferred additional harm: Given the wide reach of the campaign on Maltese social media, it is highly likely that multiple victims lost money, with total losses potentially reaching tens of thousands of euros.

Malicious content

Reported: The report explicitly describes the creation and spread of malicious deepfake videos and fabricated articles.

Directly caused: AI was used to generate deepfake videos of Economy Minister Silvio Schembri and others to deceive the public.

Indirectly caused: The deepfakes were embedded within highly deceptive fake news articles mimicking legitimate media outlets to promote a financial scam.

Inferred additional harm: Additional deepfake variations and promotional materials may have been generated and distributed across social media platforms.

Psychological

Reported: The report explicitly describes psychological distress and emotional devastation caused by online scams in Malta.

Indirectly caused: The report notes that online scams cause severe emotional devastation, specifically citing a woman who lost her life savings to a similar deepfake scam.

Inferred additional harm: It is highly likely that victims who fell for the NethertoxAGENT scam experienced severe anxiety, distress, and trauma upon realizing they had been defrauded.

Epistemic

Reported: The report explicitly describes epistemic harm through the fabrication of news articles, fake interviews, and falsified expert testimonials.

Directly caused: The AI-generated deepfakes fabricated statements from ministers endorsing a fraudulent scheme.

Indirectly caused: The scam fabricated entire interviews and testimonials, mimicking the Times of Malta and other media houses, undermining trust in legitimate journalism.

Inferred additional harm: The widespread dissemination of such highly realistic fake articles and deepfakes likely increases public skepticism towards genuine news and official communications.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 6

Potential causes

Technology

• Deepfake Video Generation: AI tools allowed creation of realistic fake videos of ministers.
• Voice Cloning Synthesis: AI voice cloning mimicked ministers' voices to deceive targets.

Data Inputs

• Public Visual Media Exploitation: Scammers used public images and videos of ministers to train AI.
• Stolen Corporate Logos: Genuine logos and expert photos were input to increase credibility.

Human Factors

• Low Digital Literacy: Users failed to notice suspicious URLs like 'sicilyunwrapped.com'.
• Financial Vulnerability: High-return promises exploited individuals' desires for quick wealth.

Process and Methods

• Weak Ad Moderation: Social networks failed to detect and block deepfake scam promotions.

Regulatory Environment

• Weak Deepfake Regulation: Lack of stringent legal frameworks governing deepfake generation.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear, consistent details about the nature of the scam, the specific public figures targeted, the platforms used, and the types of media fabricated. The role of AI (deepfakes) is explicitly stated, and the financial/epistemic harms are well-documented.
• Ambiguities identified: The exact number of victims and total financial losses specifically from the NethertoxAGENT campaign (as opposed to general online scams in Malta) is not quantified.
• Alternative interpretations: None. The incident is clearly a financially motivated deepfake scam campaign.

Malicious actors deployed deepfake videos and voice clones of Maltese government ministers to promote a fraudulent investment platform. While the incident caused financial and psychological harm to individual citizens, its national security impact remains minor as it was a financially motivated scam rather than a coordinated attack on government functions or critical infrastructure.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Malta
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic concern regarding the proliferation of synthetic media scams rather than an active national security crisis.
• Autonomy: Human-controlled. The AI deepfake and voice cloning tools were directly controlled and deployed by human actors to execute the fraud.
• Novelty: Established threat. Using synthetic media and deepfakes of public figures for financial scams is an established threat method observed globally.

Impact by dimension

• Physical security: Negligible. No threat to physical systems, critical infrastructure, or human safety was reported in connection with this incident.
• Information security: Minor. AI-generated deepfakes and fabricated news cloned minister likenesses, but the primary motivation was financial fraud rather than systematic state-sponsored information warfare.
• Sovereignty: Minor. The scam impersonated high-level government ministers, which could marginally affect public trust, but did not disrupt core government operations or sovereign decision-making.
• Economic security: Minor. Caused financial losses to individual citizens through a fraudulent trading scheme, but did not pose a systemic threat to Malta's national financial systems or critical supply chains.
• Societal stability: Minor. Resulted in localized psychological and financial harm to individual scam victims, but did not cause large-scale civil unrest or population-level societal instability.