The Nomani investment scam has increased by 62% and expanded beyond Facebook to YouTube. ESET blocked over 64,000 unique URLs associated with the threat. The scam uses AI-powered deepfake video testimonials with improved quality, higher resolution, reduced unnatural movements, and better A/V synchronization. Attackers run malicious ads for only a few hours to avoid platform detection, use benign cloaking pages for users who don't meet targeting criteria, and abuse legitimate social media ad framework tools like forms and surveys instead of external webpages. The scammers use AI tools to generate HTML code for phishing page templates, with evidence of AI-generated comments containing checkboxes in source code. GitHub repositories hosting these templates are associated with Russian and/or Ukrainian users.