A threat actor operating under the alias Jinkusu is allegedly marketing cybercrime tools capable of bypassing Know Your Customer (KYC) verification systems used by banks and cryptocurrency platforms. The tools rely on deepfake technology and voice manipulation to deceive biometric identity checks. Cybercrime tracker Dark Web Informer first reported the activity in a post on Sunday. Cybersecurity firm Vecert Analyzer added further detail, noting that Jinkusu employs AI-driven real-time face swaps through InsightFace to enable fluid gesture transfers alongside voice modulation.
The emergence of such tools represents a significant warning for the financial and crypto industries, according to Deddy Lavid, CEO of blockchain security platform Cyvers. Lavid described the development as a wake-up call that exposes the shortcomings of existing KYC systems. He stated that as AI lowers the barriers to synthetic identity fraud, the front door of these platforms will remain vulnerable. Lavid urged companies to adopt a layered security approach that combines identity verification with real-time AI monitoring.
Concerns about deepfake threats to KYC systems are not new. Binance chief security officer Jimmy Su raised the alarm in May 2023, warning that advancing AI algorithms could eventually crack identity verification systems using only a single photograph of a target individual. The current tools attributed to Jinkusu suggest those earlier warnings are now materializing in commercially available fraud packages.
Beyond KYC bypass capabilities, the fraud kit also enables users with no technical background to conduct romance scams, including a scheme known as pig butchering. This type of fraud involves building false relationships with victims before manipulating them into fraudulent cryptocurrency investments. Crypto investors lost a combined $5.5 billion across approximately 200,000 flagged pig butchering cases in 2024, underscoring the scale of the threat.
Jinkusu is also suspected to be the same actor behind the phishing kit Starkiller, which surfaced in February 2026. Unlike conventional HTML-based phishing tools, Starkiller operates by creating a real-time reverse proxy through a headless Chrome browser running inside a Docker container. The system loads the genuine login page of a targeted brand and relays all user input, including credentials, directly to the attacker. Cybersecurity platform Abnormal detailed the mechanism in a report published on February 19.
The broader landscape of crypto-related cybercrime shows mixed trends. Losses attributed to crypto phishing attacks declined by 83% in 2025, according to a January report by Scam Sniffer. However, the firm noted that malicious crypto wallet drainer scripts remained active throughout the period, and new forms of malware continued to emerge, indicating that the threat environment is evolving rather than receding.
Originally reported by CoinTelegraph.
