The tools behind the fake face: AI tooling on compromised African devices

What 411,628 stealer logs tell us about who is acquiring the tools to build synthetic people, and where those tools cluster across the continent.

Introduction

Most reporting on romance fraud describes it from the victim's side. This assessment examines the operator. CYJAX took every infostealer-compromised device in its holdings located in Africa and asked which of them held accounts for tools that fabricate a voice, a face or an entire person.

The result is a view the published record does not offer: which deepfake capabilities are actually being acquired, rather than which ones exist. Across 54 countries and 93 mapped platforms, credentials for at least one AI tool were recovered from 61,710 devices, or 15.0% of the corpus.

The intuitive assumption is that synthetic personas are being built voice first. The data shows that assumption is wrong, and the signal that genuinely distinguishes the fraud geography is visual.

What the analysis reveals

Voice cloning is the largest category and the weakest indicator

Voice cloning tools appear on 6,129 devices, more than any other category. However, once adjusted for general AI adoption, uptake is close to identical across West, East, North and Southern Africa. It behaves like a mainstream product with mainstream distribution, which makes it a poor fraud signal on its own.

The visual stack marks out the fraud geography

Seven tools concentrate in West and Central Africa at 1.3 to 2.7 times the rate seen elsewhere after adjustment. Together, two virtual cameras, face swap services, photo animation platforms and a synthetic portrait generator form a workflow that places a fabricated face on a live video call. CYJAX calls this the visual stack, and no voice tool shows comparable concentration.

Behaviour agrees with the tooling

A second, independent measure counts devices holding three or more distinct usernames for Match Group dating sites, a pattern consistent with running multiple personas. Nigeria and Ghana account for 38% of those devices while representing only 9% of the population, and the behavioural measure correlates closely with the visual stack across the continent.

Raw figures can mislead

Kenya ranks highly on raw counts, but this reflects the most digitally engaged population on the continent rather than an operator base. Adjusted for its own AI adoption, Kenya carries less of the visual stack than any other major country, which aligns with the INTERPOL African Cyberthreat Assessment 2026 characterisation of East Africa as a mobile money fraud hub.

Who should read this report

This assessment is written for trust and safety teams at dating and social platforms, fraud prevention and financial crime teams, threat intelligence analysts, and anyone responsible for identity verification or public awareness campaigns. If your defences or guidance still treat a video call as proof of identity, this report explains why that assumption no longer holds.