{"schema_version":"0.10.0","id":"LR-2026-0409","record_version":1,"title":"Deepfake scam abuses Bitdefender name with Romanian officials' likenesses","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.88,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"f0e9d95f94d461c42fd9b43276e216e53b0f3708b1c7cb7af48116e22376fa7d"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-26","incident_class":"other","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Fraudulent Meta ads promoted a fake investment platform called the National Investment Platform, using a deepfake video of Romanian central bank Governor Mugur Isărescu and false claims of a partnership with Bitdefender CEO Florin Talpeș. The ads also abused Bitdefender's name. Bitdefender Labs telemetry showed engagement rising rapidly, with one promoted video's views growing from approximately 9,000 to over 30,000 within 24 hours and roughly 1 in 14 viewers clicking the ad. Users were redirected to a site presenting the app as Profit Gold Românesc, which asked for registration details and a deposit of 1,200 to 1,700 lei. Bitdefender stated that it does not operate or endorse any such platform and blocked the website as fraudulent. Bitdefender described the ad rotation as an apparent attempt to evade moderation systems. The sources do not state the number of victims or the losses.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":"In 2024, Bitdefender reported waves of audio deepfakes, celebrity-endorsed giveaway scams, and fraudulent AI investment platforms spreading across social media. In 2025, attackers used the same blueprint by impersonating Romanian presidential candidates in a fake Neptun Deep investment narrative."},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: moderate, data or systems of others touched with a bounded scope stated. Fact: victims' personal data and deposits are at stake, and the source states view counts (about 9,000 rising to over 30,000 within 24 hours) but no count of affected parties or losses.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/deepfake-mugur-isarescu-and-florin-talpes-used-in-fake-national-investment-platform-scam-abusing-bitdefenders-name","publisher":"Bitdefender","date":"2026-02-26","type":"press","title":"Deepfake Mugur Isărescu and Florin Talpeș used in fake ‘National Investment Platform’ scam abusing Bitdefender’s name - Bitdefender","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.adversarial_actor":"C","event.detection_method":"C","event.precursor_events":"C","event.incident_class":"D","impact.severity_because":"D","impact.severity":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.adversarial_actor":[{"source_index":0,"quote":"Beyond impersonating public officials and political figures, attackers are now directly abusing Bitdefender’s name to gain credibility."}],"event.detection_method":[{"source_index":0,"quote":"Bitdefender Labs telemetry shows that engagement with the fraudulent content increased rapidly."}],"event.precursor_events":[{"source_index":0,"quote":"In 2024, Bitdefender reported waves of audio deepfakes, celebrity-endorsed giveaway scams, and fraudulent AI investment platforms spreading across social media."}],"event.incident_class":[{"source_index":0,"quote":"Analysis also shows that roughly 1 in 14 users who viewed the ad clicked on it, a notable engagement rate for financial fraud content."}],"impact.severity_because":[{"source_index":0,"quote":"The number of views on one of the promoted videos grew from approximately 9,000 to over 30,000 within 24 hours, indicating accelerated distribution and active audience exposure."}],"impact.severity":[{"source_index":0,"quote":"Analysis also shows that roughly 1 in 14 users who viewed the ad clicked on it, a notable engagement rate for financial fraud content."}],"event.summary":[{"source_index":0,"quote":"Fraudulent ads running on Meta platforms are promoting a fake investment opportunity branded as the “National Investment Platform,” using a deepfake video of Romanian central bank Governor Mugur Isărescu and fabricated claims of a partnership with Bitdefender CEO Florin Talpeș."},{"source_index":0,"quote":"Bitdefender Labs telemetry shows that engagement with the fraudulent content increased rapidly."},{"source_index":0,"quote":"The number of views on one of the promoted videos grew from approximately 9,000 to over 30,000 within 24 hours, indicating accelerated distribution and active audience exposure."},{"source_index":0,"quote":"The final step instructs users to deposit between 1,200 and 1,700 lei to activate the AI trading algorithm and begin generating profits."},{"source_index":0,"quote":"The promoted website, romania-investition.info, is blocked by Bitdefender as fraudulent."},{"source_index":0,"quote":"Bitdefender does not operate, endorse, or participate in any AI investment platform, financial trading scheme, or national investment initiative."},{"source_index":0,"quote":"Rapid ad rotation suggests deliberate attempts to evade moderation systems while maintaining campaign reach."}]},"notes_on_gaps":"No AI agent is described, so no system fields, failure class or agent_involved value are given. The source is a Bitdefender blog post with no stated publication date in its body, so date_disclosed is omitted. No dates of occurrence or detection are given beyond relative timing. Loss amounts, victim counts and data categories collected by the registration form are not stated. The model or tool that produced the deepfake is not named. Judgements: incident_class set to other because no closed class fits a deepfake investment scam; detection_method set to third_party because Bitdefender is the impersonated brand rather than the victim; D7 linked as got_around because the source reports evasion of moderation systems without naming the control, and the party is taken as Meta from the ad platform named in the source; J9 is the closest control for the website block; context.country RO is inferred from the Romanian officials and the Romanian-language targeting, and the quoted sentence is an ad claim rather than a statement of location; severity moderate is a judgement since no count of affected parties is stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"analysis":{"sections":{"timeline":[{"text":"Bitdefender reports earlier waves of deepfake and fraudulent AI investment scams.","quote":"In 2024, Bitdefender reported waves of audio deepfakes, celebrity-endorsed giveaway scams, and fraudulent AI investment platforms spreading across social media.","source_index":0,"when":"2024"},{"text":"Attackers ran a similar scam impersonating Romanian presidential candidates.","quote":"In 2025, attackers used the same blueprint by impersonating Romanian presidential candidates in a fake “Neptun Deep” investment narrative.","source_index":0,"when":"2025"},{"text":"Views of one promoted video grew from approximately 9,000 to over 30,000.","quote":"The number of views on one of the promoted videos grew from approximately 9,000 to over 30,000 within 24 hours, indicating accelerated distribution and active audience exposure.","source_index":0,"when":"within 24 hours"},{"text":"Rapid ad rotation is observed, suggesting attempts to evade moderation.","quote":"Rapid ad rotation suggests deliberate attempts to evade moderation systems while maintaining campaign reach.","source_index":0,"when":null},{"text":"Bitdefender blocks the promoted website as fraudulent.","quote":"The promoted website, romania-investition.info, is blocked by Bitdefender as fraudulent.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bitdefender.com/en-us/blog/hotforsecurity/deepfake-mugur-isarescu-and-florin-talpes-used-in-fake-national-investment-platform-scam-abusing-bitdefenders-name"]}}