Global online scam losses exceeded USD $1 trillion in 2024, with the real figure likely much higher due to underreporting. Increasingly, social media platforms are being used to distribute and amplify fraudulent campaigns through paid advertising.

Our investigation examined a coordinated celebrity impersonation scam targeting Canadians, highlighting the scale and sophistication of a single operation.

How the Scam Works

The campaign uses celebrity endorsements as a social engineering tactic to build credibility and encourage engagement. Threat actors select well-known Canadian public figures and deploy geo-targeted social media ads to reach users within Canada.

These ads commonly portray the celebrity as:

• Arrested for revealing a “financial secret”
• Silenced by financial institutions
• Injured or hospitalized while sharing “urgent” investment advice

The goal is to trigger emotional reactions—especially sympathy and urgency—to prompt users to click.

Example: Kevin O’Leary Ads

Sponsored ads on Meta featured unauthorized images of Canadian businessman and television personality Kevin O’Leary, paired with sensationalized headlines such as:

• “Accusations against O’Leary have been confirmed!”
• “The celebrity’s secret has finally been exposed!”

These clickbait ads redirect users to fraudulent news articles.

Fake CBC News Articles

All identified ads redirected to websites impersonating the Canadian Broadcasting Corporation (CBC). These sites:

• Use randomly generated domains
• Mimic legitimate news layouts
• Promote fraudulent “investment platforms”
• Display fake “Popular Now” sections to create urgency

Our research identified over 1,200 matching page templates, indicating large-scale infrastructure.

The Investment Platform Funnel

Clicking links within the fake articles leads victims through multiple redirect stages before landing on a fraudulent investment site.

Common tactics include:

• Fake testimonials from public figures
• A countdown timer creating artificial urgency
• Mandatory ID uploads (providing name, address, credit card, and photo ID)
• Display fake “Popular Now” sections to create urgency

Platform domains rotate frequently, suggesting bulk domain registration and pre-planned infrastructure.

Ongoing Threat

Thousands of domains have been linked to this operation, with new sponsored ads appearing almost daily. The scale of domain rotation makes enforcement reactive, creating a “whack-a-mole” effect.

Without comprehensive infrastructure mapping and payment tracking, meaningful disruption remains difficult.

Flare continues to monitor and analyze this campaign as it impacts Canadians and global victims alike.