Deepfake Mugur Isărescu and Florin Talpeș used in fake ‘National Investment Platform’ scam abusing Bitdefender’s name

Fraudulent ads running on Meta platforms are promoting a fake investment opportunity branded as the “National Investment Platform,” using a deepfake video of Romanian central bank Governor Mugur Isărescu and fabricated claims of a partnership with Bitdefender CEO Florin Talpeș.

In some versions, attackers escalate the deception further by abusing Bitdefender’s name under the false branding:

“The Bitdefender Project: A New Solution for Financial Independence for Romanians.”

The promoted website, romania-investition.info, is blocked by Bitdefender as fraudulent.

Key findings from Bitdefender Labs

• Around 130 fraudulent Meta ads were launched from a single page starting February 22, 2026, designed to persuade Romanians to deposit money into a fake AI investment scheme and surrender personal information
• A deepfake video of Mugur Isărescu combined with fabricated claims of a partnership with Florin Talpeș, creating the false impression of official endorsement
• False branding under “The Bitdefender Project: A New Solution for Financial Independence for Romanians” to exploit public trust in Bitdefender
• Victims instructed to deposit 1,200 lei to activate a non-existent AI trading algorithm promising guaranteed daily profits
• The domain romania-investition[.]info is detected and blocked by Bitdefender as fraudulent infrastructure linked to this campaign

Telemetry insights highlight campaign traction

Bitdefender Labs telemetry shows that engagement with the fraudulent content increased rapidly.

The number of views on one of the promoted videos grew from approximately 9,000 to over 30,000 within 24 hours, indicating accelerated distribution and active audience exposure.

Analysis also shows that roughly 1 in 14 users who viewed the ad clicked on it, a notable engagement rate for financial fraud content. This suggests the campaign’s combination of authority impersonation, AI promises, and urgent messaging is driving user interaction.

High click-through rates significantly increase the likelihood of deposit conversion and potential financial loss.

Details of the fraudulent campaign

The scam relies on AI-generated video manipulation and authority impersonation. The deepfake video of Mugur Isărescu is paired with promotional visuals suggesting institutional backing. One widely circulated image shows Mugur Isărescu shaking hands with Florin Talpeș in what appears to be an official setting, reinforcing the illusion of legitimacy. The Facebook page distributing the ads appears to operate from abroad, with indicators pointing to Vietnam. Rapid ad rotation suggests deliberate attempts to evade moderation systems while maintaining campaign reach.

The deepfake video contains visible inconsistencies, including unnatural hand movements and visual artifacts typical of AI-generated manipulation. The messaging combines urgency, authority, and technological language to pressure users into making hasty financial decisions. 

The ads claim the platform is integrated into Romania’s national digital development program and represents an official decision for Romanian citizens.

There is no such government-backed investment initiative.

Users who click on the ads are redirected to romania-investition[.]info, which presents the fake investment app under the name Profit Gold Românesc.

The landing page is designed to mimic an official financial platform and immediately reinforces credibility through fabricated authority signals.

Fabricated endorsements and authority claims

The site displays staged quotes attributed to Florin Talpeș and Mugur Isărescu, portraying them as supporters of the AI-based investment system. The messaging claims that the platform is integrated into Romania’s national development strategy and backed by advanced artificial intelligence certified in the European Union.

These endorsements are false.

Visitors are told they can:

• Earn 4,000 to 6,000 lei per day
• Generate profits automatically while sleeping
• See their first earnings within 24 hours
• Achieve average weekly profits of 35,000 lei

A dynamic calculator labeled “What is the possible income?” allows users to simulate projected dividends based on a selected investment amount, visually reinforcing unrealistic returns.

Fake testimonials and social proof

The website includes multiple five-star reviews from individuals presented as satisfied investors. Testimonials claim profits of 5,000 lei on the first day and praise the platform’s support team and reliability.

Registration funnel and data collection

Users are prompted to complete a registration form requiring:

• First name
• Last name
• Email address
• Phone number

After submission, the site informs users that they will be contacted by a “personal manager” who will guide them through the investment process.

The final step instructs users to deposit between 1,200 and 1,700 lei to activate the AI trading algorithm and begin generating profits.

At this stage, victims are exposed to both financial loss and potential abuse of their personal data.

Escalation through Bitdefender brand abuse

This campaign represents an escalation of a well-documented scam structure.

Beyond impersonating public officials and political figures, attackers are now directly abusing Bitdefender’s name to gain credibility. By combining a well-known central bank official alongside a prominent Romanian technology entrepreneur and a recognized cybersecurity brand, threat actors layer trust signals to increase the likelihood of deposits.

Bitdefender does not operate, endorse, or participate in any AI investment platform, financial trading scheme, or national investment initiative.

Any advertisement, website, or video claiming that Bitdefender has launched or partnered in such a project is fraudulent.

If you encounter Bitdefender’s name, logo, or leadership being used to promote investment opportunities, we urge you to report it immediately and contact Bitdefender through official channels so the abuse can be investigated.

Connection to previous deepfake investment scams

This structure is not new. In 2024, Bitdefender reported waves of audio deepfakes, celebrity-endorsed giveaway scams, and fraudulent AI investment platforms spreading across social media.

In 2025, attackers used the same blueprint by impersonating Romanian presidential candidates in a fake “Neptun Deep” investment narrative.

Across all variations, the pattern remains consistent:

1. Impersonate a trusted authority figure
2. Claim official national integration
3. Promise guaranteed AI-driven profits
4. Require an upfront activation deposit
5. Rotate ads quickly to avoid detection

The current campaign builds upon that foundation by incorporating Bitdefender’s brand as an additional credibility lever.

Protective measures for users

Users encountering this campaign should avoid interacting with the promoted website and never deposit funds into platforms advertised exclusively through social media ads.

To reduce exposure to similar threats:

• Use Bitdefender Scamio to verify suspicious investment offers, messages, or screenshots before engaging
• Check unfamiliar URLs with Bitdefender Link Checker to identify fraudulent domains
• Confirm endorsements through official websites and verified accounts
• Report suspicious ads directly to Meta
• Use security software capable of blocking scam infrastructure

Remember, this so-called National Investment Platform is not a real initiative. It is a coordinated scam designed to extract deposits by exploiting trust in public figures, technology, and established brands.