Fraudsters Use Deepfake Video of Tim Cook to Promote Apple Crypto Scam on YouTube

Fraudsters repurposed an old interview with Apple CEO Tim Cook using AI or video editing to promote a fake crypto event on YouTube. The altered video was designed to mislead viewers into believing Tim Cook endorsed a new cryptocurrency scheme. The stream attracted tens of thousands of viewers, potentially exposing them to the scam before it was removed for violating YouTube’s terms of service.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves fraudsters using the public likenesses of tech CEOs in fake live streams to run a cryptocurrency scam, which falls under fraud, scams, and targeted manipulation.

Additional risk subdomains

• 3.1 False or misleading information: The fake streams spread misleading information about Apple launching a cryptocurrency venture, which was amplified by YouTube's recommendation algorithm.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human fraudsters who intentionally hijacked YouTube channels and edited videos of tech executives to run a cryptocurrency scam post-deployment.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3. Limited Risk: The incident involves the use of manipulated media and deepfakes/repurposed video to deceive users, which falls under transparency obligations for AI-generated content. The report notes that 'Fraudsters take an image of a famous person... and package videos... to make it appear like they're talking about some new crypto venture.'

AI system and alleged parties

• AI system: unspecified
• AI purpose: Content Recommendation; Deepfake Video Generation
• Behaviour type: unknown
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Unknown scammers, Unknown deepfake creators
• Alleged harmed parties: YouTube viewers, Tim Cook, General public, Cryptocurrency investors, Apple

Harm severity

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Minor
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Minor
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: Yes, the reports describe malicious streams designed to execute a cryptocurrency scam.

Directly caused: Fraudsters created and distributed fake live streams using hijacked YouTube channels to promote a crypto scam.

Indirectly caused: N/A

Inferred additional harm: Similar malicious streams likely targeted other high-profile tech events, exposing more users to fraudulent content.

Privacy

Reported: Yes, the reports mention that the YouTube channels used to host the streams were likely hijacked.

Directly caused: N/A

Indirectly caused: The hijacking of the YouTube channels implies unauthorized access and compromise of the original channel owners' accounts.

Inferred additional harm: The original channel owners likely suffered a breach of privacy and loss of control over their personal accounts and subscriber data.

Epistemic

Reported: Yes, the reports describe fake live streams that misled viewers into believing Apple was hosting a cryptocurrency event.

Directly caused: The streams used old, edited interviews of Tim Cook and Elon Musk to fabricate a live event about Apple and cryptocurrency.

Indirectly caused: YouTube's recommendation algorithm amplified the fake stream, presenting it on users' homepages and misleading them.

Inferred additional harm: Such incidents erode public trust in live digital broadcasts and official corporate announcements.

People affected

• Occurrences reported: 2
• People reportedly exposed: 80000

Potential causes

Management

• Engagement-Driven Optimization: Platform prioritized viewer engagement metrics over content safety checks.

Technology

• Recommendation Algorithm Bias: Algorithm recommended scam streams based on user's recent watch history.
• Inadequate Automated Moderation: Automated systems failed to detect and block the fraudulent live stream.

Data Inputs

• Manipulated Stream Metadata: Scammers filled titles and descriptions with trending Apple keywords.
• Hijacked Channel Data: Algorithm used historical data from hijacked accounts to trust the stream.

Human Factors

• User Trust in Recommendations: Viewers assumed recommended homepage streams were safe and legitimate.
• Exploitation of Event Buzz: Scammers targeted users looking for Apple's Far Out event announcements.

Process and Methods

• Inadequate Stream Verification: No proactive verification of high-traffic live streams before promotion.

Information quality

• Classification confidence: High
• Reason for confidence: The reports clearly describe the mechanics of the scam, the channels hijacked, the specific videos repurposed, and the viewer counts. There is little ambiguity about the nature of the event, although the specific AI tools used to edit the videos (if any) are not detailed.
• Ambiguities identified: It is unclear whether AI was used to generate deepfake elements (like voice cloning) or if it was purely traditional video editing of old footage, though the reports describe it as 'repurposing' and 'editing'.
• Alternative interpretations: None. The event is clearly a coordinated cryptocurrency scam exploiting a major tech announcement.

Fraudsters hijacked YouTube channels to broadcast fake live streams promoting a cryptocurrency scam, using repurposed footage of prominent tech CEOs. While the streams reached over 80,000 viewers before being removed, the incident represents a low-level financial scam with negligible direct national security implications.

• Overall national security impact: Minor
• Response level: Moderate
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic concern regarding algorithmic amplification of deceptive media rather than an active crisis.
• Autonomy: Human-controlled. The creation and deployment of the deceptive streams were fully controlled by human fraudsters, though platform algorithms aided distribution.
• Novelty: Established threat. Cryptocurrency scams using hijacked channels and repurposed celebrity footage are an established threat with numerous prior occurrences.

Impact by dimension

• Physical security: Negligible. No threats to physical systems, infrastructure, or human safety were reported in this incident.
• Information security: Minor. Deceptive streams used repurposed footage of tech CEOs to mislead tens of thousands of viewers, but lacked state-actor sponsorship or targeting of national security institutions.
• Sovereignty: Negligible. No impact on state authority, government operations, or constitutional processes.
• Economic security: Minor. The incident was a financial scam targeting individual cryptocurrency assets, with no systemic risk to national financial infrastructure or strategic technologies.
• Societal stability: Negligible. No threats to societal cohesion, civil liberties, or large-scale population safety were identified.