AI Face‑Swapping Platform Haotian Fuels Southeast Asian Scam Ecosystem

Haotian’s Capabilities and Market Reach

Haotian is a Chinese‑language artificial‑intelligence application that provides users with the ability to swap faces during live video chats. The platform offers up to 50 adjustable settings, allowing precise manipulation of facial attributes such as cheekbone size and eye position. In addition to facial transformation, Haotian advertises real‑time voice cloning, enabling users to change gendered tones or imitate specific individuals. The output can be streamed on a variety of messaging and video‑calling services, including WhatsApp, Telegram, WeChat, Zoom, and others.

Promotion Through Telegram and Target Audience

The company primarily markets its desktop software via a public Telegram channel launched in October 2023, which quickly amassed more than 20,000 subscribers. The channel is used to announce new versions, provide technical support, and share promotional material. While Haotian claims its target customers are “entertainment streamers or live salers,” its Telegram posts frequently reference the creation of “elite, authentic persona” and the ability to make a video call appear convincing, language that aligns with the needs of fraud operators.

Adoption by Scammers and Pig‑Butchering Schemes

Security researchers have identified a growing overlap between Haotian’s user base and operators of “pig‑butchering” scams—online fraud schemes that combine social engineering, romance, and investment deception. The deep‑fake video capabilities allow scammers to conduct convincing video calls with victims, reducing the likelihood of detection. Haotian’s own marketing occasionally uses phrases that translate to “deep chat,” a term associated with social‑engineering tactics in the region.

Financial Flows and Cryptocurrency Links

Analysis of cryptocurrency wallets linked to Haotian reveals that the company has received approximately $3.9 million in payments, primarily in the stablecoin USDT. More than 3,500 payments were recorded, with a substantial portion tied to wallets associated with known fraud instances. The largest single transaction amounted to $14,890, and many payments clustered around $500. Approximately $1.2 million of the total flowed between Haotian and the escrow service Huione Guarantee.

Connection to Huione Guarantee and the Gray‑Market Ecosystem

Huione Guarantee, a Telegram‑based escrow and payment processor, has long facilitated transactions for a range of illicit services, including victim‑data sales, deep‑fake tools, and even hardware used in human‑trafficking operations. Researchers observed that Haotian’s customers often used Huione’s platform to complete payments for the face‑swapping software. Huione Guarantee was later sanctioned by the United States government for its role in supporting scam operations.

Company Response and Platform Controls

When approached, Haotian’s Telegram account responded in Chinese, stating an inability to communicate in English and asserting that the company does not accept interviews. The account claimed the service is intended for live streaming and that it does not permit illegal use. Haotian also noted that it imposes limitations on creating deep‑fake pornography and that accounts would be terminated if used for fraud, though researchers have documented continued usage by scammers.

Broader Implications for Cybercrime

Haotian represents one component of a larger technology stack that fuels the Southeast Asian scam economy. While the monetary amounts involved in Haotian’s transactions are modest compared with the overall scale of fraud, they provide essential tools that enable scammers to execute sophisticated deception campaigns. Security experts emphasize that even a few thousand dollars can significantly bolster illicit operations, underscoring the importance of monitoring and disrupting the supply chain of such AI‑driven tools.