Popular 'Deepfakes' Forum Is Mining For Cryptocurrency

Deepfakes, an increasingly popular form of media that masks the face of a celebrity or other party over the face of a person in a video, continue to be pushed off internet platforms, a new website has cropped up as a popular home for the content—and is using its newfound popularity to mine for cryptocurrency.

A website called Deepfakes.cc has become the defacto home to Deepfakes content. The forum, created less than one week ago, has drawn a considerable amount of traffic and has implemented cryptomining code that uses the computing power of visitors’ machines to mine for cryptocurrency, according to security researchers at Malwarebytes.

The forum, which boasts more than 2,300 registered users in just a few days since it began operating, is used to post so-called “deepfakes”—images and videos that map one person’s face over the top of another, making it possible to place someone in a video and have their face show the same expressions as the person they are mapped over.

Deepfakes can be used for any number of purposes but have gained popularity for creating pornographic content. Deepfakes users place the faces of celebrities and other people atop the faces of porn actors in explicit scenes.

The content is a technical achievement and have quickly grown in popularity, as evidenced by the new website’s immediate audience. Prior to being shut down yesterday, a Reddit community dedicated to posting deepfakes had amassed nearly 100,000 subscribers.

Deepfakes require a graphics processing unit (GPU) from Nvidia, a fair amount of processor power and some technical knowhow to pull off. The trick uses Nvidia’s GPU to run an application that analyzes two sets of images and allow the user to map one image atop the other.

Given the high-power computing equipment required to create deepfakes, the makers are also the perfect target for a cryptomining effort—which the newly formed forum has secretly launched, unbeknownst to its visitors.

According to researchers at Malwarebytes, the website hosts a script that hijacks the computing power of a visitor's machine and uses it to mine for the anonymous cryptocurrency Monero. The script uses a victim’s processor to generate the cryptocurrency—a task that involves solving complicated mathematical problems in order to process transactions and release additional currency—which is likely collected by the website owners.

The site uses Coinhive, a popular mining script itself is not intended to be malicious—at least according to its creators—but has gained a reputation for being used in these types of attacks, often referred to as cryptojacking.

Cryptojacking attacks have cropped up a number of ways online. Some websites have used the tactics to generate income without disclosing the practice to users. Cryptomining code has also been hidden in web browser extensions and other tools that hijack a user’s processor. Generally speaking, it is harmless other than using a victim’s processing power without their permission.

The community around deepfakes has had trouble finding a home. Reddit and Pornhub announced earlier this week that they would be removing any faked content from their respective platforms. Twitter has also taken action to block the computer-generated videos, as have image hosting sites Imgur and Gfycat and communications platform Discord.

International Business Times contacted Namecheap, the domain registrar where Deepfakes.cc was registered, to see if the host would take any action against the site. Namecheap did not respond at the time of publication.