Epi Security

contrarian cybersecurity, internet intelligence and sandboxing from @epiapp

[Epi Security @episecurity]

Epi threat intel: 363,900+ views for the Kuenssberg deepfake scam ads on X since 21 September.

[Alex Greenland @ajrgd]

Epi Security detected a new wave of crypto scam ads on X today, featuring yet again the deepfake images of the BBC presenter Laura Kuenssberg covered in green dye alongside the British entrepreneur Jim Ratcliffe, hurriedly carrying bags supposedly filled with cash.

Over 30,300 impressions generated so far.

These ads are new iterations of the £250/$250 crypto investment scams. Don't invest. After you have been heavily social engineered by the scammer and their team, you will lose all the money you end up sending, often in the thousands and tens of thousands of pounds.

@episecurity @epiapp

[Epi Security @episecurity]

Hi, we do internet intelligence 🫡

[Alex Greenland @ajrgd]

andy4leader•co•uk was Andy Burnham's campaign website for the 2015 Labour leadership contest against Jeremy Corbyn.

andy4leader•co•uk was left to expire, and on 13 May 2026 was registered on behalf of the Green Party, at the first real signs of Andy's latest campaign for Labour leadership and PM. The domain was made to redirect to the Green Party website.

At 00:08 on 14 May, andyforleader•com was registered and made to redirect to the Green Party website.

By afternoon on 14 May, Josh Simons announced his resignation as the MP of Makerfield.

andyforleader•co•uk was registered on 9 February 2026 and made to redirect to the website of Count Binface.

Evidence in tweets below.

[Epi Security @episecurity]

Read our perspective in LinkedIn's top stories today

[Alex Greenland @ajrgd]

Featured in LinkedIn News. Does this mean I made it?

[Epi Security @episecurity]

From 100+ cybersecurity vendors we track, Epi Security is the only known firm that already marks this site as malicious.

IOC (malicious domain):
quantofnews[.]com

[Alex Greenland @ajrgd]

More crypto scam ads on X.

IOC (malicious domain):
quantofnews[.]com

From 100+ cybersecurity vendors we track, Epi Security is the only known firm that already marks this domain as malicious.

@episecurity @epiapp

[Epi Security @episecurity]

IOCs (malicious URLs):

- https[://]tr[.]ee/WvJpwM

- hic-consequatur-in[.]top

Epi Security is the only known cybersecurity vendor that signals both IOCs as unsafe.

[Alex Greenland @ajrgd]

The Laura Kuenssberg deepfake crypto scam ads are still going on X, with this campaign saying "I wonder what's in the bag" in a bedroom with an unknown man. We detected over 133,000 impressions of this bad ad variant today.

The threat actors use the Linktree link shortener (tr•ee) to serve the initial link that the user clicks, then transfer to their self-hosted traffic redirect service, to decide in realtime whether to send the user to their cryptocurrency scam campaign site or an Amazon affiliate-tagged product page (where the scammer still earns revenue share). The destination is a runtime heuristic decision, scoring the user on device characteristics, geolocation and security sandbox probability.

When the ad is posted, X evaluates the link in its sandbox, and like many of these deepfake celebrity scam ads, it is provided with the final URL of the Amazon website, so determines the ad is safe.

X should display the initial URL in ads. X and Linktree should move to resolve redirects and check URLs in realtime, at click-time, to limit traffic-shifting redirect chain attacks.

IOCs (malicious URLs):

- https[://]tr[.]ee/WvJpwM

- hic-consequatur-in[.]top

Epi Security marks the IOCs as malicious, and Epi is the only known cybersecurity vendor that signals both as unsafe.

[Alex Greenland @ajrgd]

BRK EXCL: The crypto investment scam celebrity deepfake ads are still spreading across X, now impersonating BBC broadcaster Laura Kuenssberg @bbclaurak and Jim Ratcliffe (one of UK's richest people and owns 28% of Manchester United).

I detected these ads in the last hour. Total views: 62,000+

The threat actors are using an Amazon affiliate A/B redirect switch to cloak their intended destination of bogus concocted news articles that drive users to initially invest £250+ in scam crypto products and fake investment platforms. You will lose your money. You will not get your stake back from them.

The news cycle may be tired of these stories, but I won't stop reporting on the fraud.

[Epi Security @episecurity]

Epi Security has observed customers of @Allstate and @Zelle being targeted with phishing links hosted on this IEEE site.

[Alex Greenland @ajrgd]

New: IEEE's open source standards and code hosting, on opensource[.]ieee[.]org, is compromised and unsafe.

The IEEE hosts their Standards Association repositories on GitLab. Phishing links for bank logins, ClickFix instructions and malware are currently being hosted in snippets on this site. GitLab snippets are similar to GitHub gists.

Do not trust IEEE snippets and code hosted on opensource[.]ieee[.]org at this time.

Given the IEEE host their code on a first-party subdomain upon their root trust domain ieee•org, many existing content filters and firewalls will automatically subsume opensource[.]ieee[.]org as safe and trusted, failing to take into account the grey area and mixed trust of a site of this nature.

This also reveals a failure of Google, in how they are ranking and displaying phishing links in search results for bank logins.

IOCs:
opensource[.]ieee[.]org/-/snippets
opensource[.]ieee[.]org

[Epi Security @episecurity]

The scam ads on X are still going.

38,100+ impressions from 4 malicious X ads detected in the space of 3 minutes at lunchtime.

[Alex Greenland @ajrgd]

The scam ads on X are still going, in case you were wondering.

38,100+ impressions from 4 malicious ads detected in the space of 3 minutes at lunchtime.

[Epi Security @episecurity]

IOC:

profoaminsulationcontractor[.]com

[Epi Security @episecurity]

Fresh threat intel: Epi Security detected a new deepfake crypto scam campaign featuring the likeness of Harry Kane and Nigel Farage. We track the threat intel of 100+ cybersec vendors, and at this time, Epi is the only known org that marks this malicious domain as unsafe.

[Alex Greenland @ajrgd]

Now AI-enabled threat actors are using the image of Harry Kane @HKane and Nigel Farage to peddle scams.

The headline — "Scandal: Footballer vs. Politician"

This is a cryptocurrency investment scam, fronted by a bogus news article extolling the virtues of crypto, with fake testimonials from public figures.

Detected at 07:39 UK. X reports the country of origin as Hong Kong while connected with the X Android app from the Kenya account region of the Google Play app store.

IOC:
profoaminsulationcontractor[.]com

(pro foam insulation contractor)

We track the threat intel and verdicts of 100+ cybersec vendors, and at this time, Epi Security is the only known security org that marks this malicious domain as unsafe.

[Epi Security @episecurity]

These IOCs were all marked unsafe by Epi Security as soon as the domains were registered. Epi is the only known cybersecurity org to do so (we checked 100+ other vendors).

giftroar[.]com

londonnews[.]blog

wearenottheproblem[.]com

[Alex Greenland @ajrgd]

Detecting new scam ads on X, featuring the image of Richard Tice (deputy leader of Reform UK) and Steven Bartlett (entrepreneur and Diary of a CEO podcaster).

These public figures have been in the news recently, which is why their likeness is being exploited by scammers and threat actors.

The ads have received tens of thousands of views so far.

IOCs:
giftroar[.]com
londonnews[.]blog

Epi Security is the only known cybersecurity org that marks giftroar[.]com as malicious.

Epi is the only known security org but one that marks londonnews[.]blog as malicious. We produced this verdict immediately when the domain was registered — today at 9:59am UK time.

cc @TiceRichard @StevenBartlett @reformparty_uk

[Alex Greenland @ajrgd]

An Epi Special Investigation on the scam political ads plaguing X users in the UK. Over four days, we detected 425 unique malicious ads, generating over 2.3 million impressions.

From 1 to 4 July, I observed 425 distinct malicious ads that exploited the studio brand of the BBC Radio 4 Today programme and the likeness of Emily Maitlis.

1 July: 82 ads with 816,950 views
2 July: 95 ads with 433,808 views
3 July: 169 ads with 781,802 views
4 July: 79 ads with 319,412 views

Total 1–4 July: 2,351,972 views (avg: 5,534 views/ad)

Some individual ads reported over 70,000 impressions.

The vast majority of the 425 ads matched one-to-one with individual X accounts; ie. around 400 separate X accounts were used for 425 ads.

Interestingly, a large proportion of the accounts were created between 2009 and 2014, with a peak in 2011, and many of their initial tweets posted are scams and malicious links. This tells me that these Twitter accounts have not been recently created or hijacked, but are persistent scam accounts controlled and traded by organised criminals over long periods — decades, in fact.

Ads were published by X accounts originating from 89 countries, most of which X indicates are using VPNs, which obscure their true geographic location.

The ad origins include exotic and unusual countries such as: Afghanistan, Belarus, Mongolia, Palestine, Pakistan, Russia, Somalia, South Sudan, Ukraine, Uzbekistan and Venezuela.

Some important questions that need answers: Why is X allowing ads from a such an exotic variety of countries to reach British users with UK political inspired ads? Why does X let ads be published from accounts hiding behind VPNs, particularly when they acknowledge their use? What are the banks and jurisdictions of the credit cards used to pay for the ads? Why is X permitting ads from regions in active conflict zones, and most concerningly, from countries under comprehensive and targeted US and UK sanctions — including: Afghanistan, Belarus, Russia, Somalia, South Sudan and Venezuela.

Since this investigation, I have observed malicious ads exploiting the likeness of Nick Robinson on the Today programme.

Funnily enough, I will be on the Today programme on BBC Radio 4 on Wednesday morning at 06:50 to discuss my findings. I hope you join me as one of six million listening! On your radio, on BBC Sounds, or on catchup.

UK: Wed 6:50am
US Eastern: Wed 1:50am
US Pacific: Tue 10:50pm
Sydney: Wed 3:50pm

@epiapp @episecurity

[Alex Greenland @ajrgd]

I've been tracking these campaigns extensively for weeks. This is not an isolated incident. The posts are directing users to crypto investment scams on Discord and Telegram

https://t.co/nc8RGIjfsQ

[Alex Greenland @ajrgd]

Movie piracy isn't the story. The free full-length movies are merely the vehicle for crypto investment scams.

[BBC Radio 4 Today @BBCr4today]

'Power went out in the studio, but the mic stayed on.'

Alex Greenland, CEO of Epi Security, explains why scammers use fake ads featuring the BBC's Today studio and a lookalike of @bbcNickRobinson to build credibility.

[Epi Security @episecurity]

Hear Alex discuss the findings on the Today programme on BBC Radio 4 on Wednesday morning at 06:50 — or don't — listen on catchup!

UK: Wed 6:50am
US Eastern: Wed 1:50am
US Pacific: Tue 10:50pm
Sydney: Wed 3:50pm

[Alex Greenland @ajrgd]

An Epi Special Investigation on the scam political ads plaguing X users in the UK. Over four days, we detected 425 unique malicious ads, generating over 2.3 million impressions.

From 1 to 4 July, I observed 425 distinct malicious ads that exploited the studio brand of the BBC Radio 4 Today programme and the likeness of Emily Maitlis.

1 July: 82 ads with 816,950 views
2 July: 95 ads with 433,808 views
3 July: 169 ads with 781,802 views
4 July: 79 ads with 319,412 views

Total 1–4 July: 2,351,972 views (avg: 5,534 views/ad)

Some individual ads reported over 70,000 impressions.

The vast majority of the 425 ads matched one-to-one with individual X accounts; ie. around 400 separate X accounts were used for 425 ads.

Interestingly, a large proportion of the accounts were created between 2009 and 2014, with a peak in 2011, and many of their initial tweets posted are scams and malicious links. This tells me that these Twitter accounts have not been recently created or hijacked, but are persistent scam accounts controlled and traded by organised criminals over long periods — decades, in fact.

Ads were published by X accounts originating from 89 countries, most of which X indicates are using VPNs, which obscure their true geographic location.

The ad origins include exotic and unusual countries such as: Afghanistan, Belarus, Mongolia, Palestine, Pakistan, Russia, Somalia, South Sudan, Ukraine, Uzbekistan and Venezuela.

Some important questions that need answers: Why is X allowing ads from a such an exotic variety of countries to reach British users with UK political inspired ads? Why does X let ads be published from accounts hiding behind VPNs, particularly when they acknowledge their use? What are the banks and jurisdictions of the credit cards used to pay for the ads? Why is X permitting ads from regions in active conflict zones, and most concerningly, from countries under comprehensive and targeted US and UK sanctions — including: Afghanistan, Belarus, Russia, Somalia, South Sudan and Venezuela.

Since this investigation, I have observed malicious ads exploiting the likeness of Nick Robinson on the Today programme.

Funnily enough, I will be on the Today programme on BBC Radio 4 on Wednesday morning at 06:50 to discuss my findings. I hope you join me as one of six million listening! On your radio, on BBC Sounds, or on catchup.

UK: Wed 6:50am
US Eastern: Wed 1:50am
US Pacific: Tue 10:50pm
Sydney: Wed 3:50pm

@epiapp @episecurity

[Epi Security @episecurity]

Epi Security is the only cybersecurity company we can find that marks these IOC domains as malicious.

- agreemet[.]com

- metaworkmeetings[.]com

- makeitwithplastics[.]com

We marked them as malicious before today.

[Alex Greenland @ajrgd]

SCOOP: Threat actors running malicious political ads on X are trying a new strategy: affiliate marketing on trusted domains, to optimise their campaigns and obscure the scams.

They are using multiple redirect hops, starting with Linktree's redirect service, tr•ee, then landing on real Amazon product pages — as seen in X's link resolver and Epi's sandbox.

X shows a trusted domain as the display URL for the ad, like amazon•co•uk or amazon•nl.

In the redirect chain, the intermediary domain is controlled by the threat actor, so they can change the redirect to a dedicated scam site on demand, depending on the user, IP and geolocation.

IOCs (malicious intermediary domains) seen so far:

- agreemet[.]com

- metaworkmeetings[.]com

Epi Security is the only cybersecurity company I can find that marks these domains as malicious.

These new campaigns are about maximising the payoffs per ad impression.

In the best case, landing on affiliate-tagged Amazon product storefronts, the scammers gain a share of the product price when a sale is completed.

But of course, the ads' images and messages are still focused on "look what they discussed and didn't want you to hear", not jumpers and Amazon products. So phishing and proper scams are still the aim. We just can't observe it clearly.

Meanwhile, I have been working on a four-day-long investigation into these scam ads. Hope to report my findings today. I can say already that the total ad impressions run into the millions.

@Linktree_ @Safety @kyliem @ads

Credit: @episecurity @epiapp

[Epi Security @episecurity]

Epi Security — early and first.

[Epi @epiapp]

Epi works hard to keep you safe when other cybersecurity companies don't.

We already identified this phishing site as not trusted, ever since the domain was registered on 22 May, and this verdict is reflected across our link checker apps and APIs.

The 92 cybersecurity vendors listed in VirusTotal do not yet mark this site as malicious — including Google Safe Browsing, Cloudflare, Netcraft, Bitdefender, Quad9, OpenDNS, BforeAI PreCrime, Hunt•io, GreyNoise, SOCRadar, Sophos, OpenPhish, PhishTank, URLhaus, Mimecast, Malwarebytes, ZeroFox and ScamAdviser — all report the domain is clean.

[Alex Greenland @ajrgd]

Talked to @ConnorSephton on @RoxomTV about the Nigel Farage and Andrew Bailey scam adverts flooding X in the past few weeks, with fresh waves seen in recent days.

00:19. Is this a new issue?

00:51. Who is behind this?

01:40. What happens if I click on one of these ads?

03:05. Are people losing money?

04:08. Why have X appeared slow to take down the ads?

08:54. What about deepfakes and the effect of AI on scams?

10:01. What Alex does to tackle deepfakes and avoid scams overall

11:18. Alex's main advice on phishing and scams. Why people can't read URLs and why you need a good link checker

[Alex Greenland @ajrgd]

BREAKING & EXCL: Malicious Farage and Andrew Bailey scam ads are continuing today.

Threat actors are now pixelating the faces of Farage and Bailey to evade automated detection.

This confirms what I suspected: X is using AI image models and face recognition to detect the scam ads.

X needs to check the URLs of ads and posts to defeat the scams.

I stand ready to work together, as always, in service of the public.