Argentina Gmail ad scam impersonates VT Markets

ESET analyzed a fraudulent campaign circulating in Argentina through Gmail ads and a supposed investment platform used to try to steal money. The operation combines digital advertising, impersonation of VT Markets and public figures, artificial intelligence, phone-based social engineering, and a platform designed to look like legitimate financial activity.

What did ESET detect in this campaign?

ESET identified a fake investment scheme circulating in Argentina that mixes Gmail ads with a fraudulent platform to capture victim deposits. According to coverage by Noticias SIN, the scheme imitates a real financial company and uses public figures to create an appearance of legitimacy.

The same report says the campaign uses several tactics at once, from digital advertising to phone-based social engineering. It also mentions artificial intelligence as part of the setup, along with a platform built to simulate real financial operations.

How were they trying to convince victims?

The campaign sought to get people to make initial deposits and then keep adding money after being shown supposed profits. Derecho y Negocios cited ESET's research as having detected at least nine fraudulent Gmail ads between May and September 2026, and said the promotions asked for an initial deposit of 150,000 Argentine pesos.

That same coverage said the scam could demand additional payments when the victim tried to withdraw funds. Diario Extra, for its part, described fake dashboards showing fictional growth in the money to push larger deposits, and noted that the fraudulent platform operated on domains different from those of the legitimate broker.

What elements did the fake site copy?

The setup imitated VT Markets and also relied on fake media and public figures. According to the sources cited, the goal was to build enough trust for victims to start investing and keep sending money.

Diario Extra added that the dashboards showed invented increases in funds, a tactic designed to drive more deposits. The difference between the scam's domains and the legitimate broker's domains was also cited as one of the signs that this was a separate platform, not the real service.