In 2025, #ESETresearch saw a 62% year-over-year increase in detections of fake investment and snake oil scams – tracked as HTML/Nomani – amounting to hundreds of thousands of detections and over 64,000 unique URLs blocked. The highest activity was reported from Czechia, Japan, Slovakia, Spain, and Poland. But there’s a silver lining to the yearly detection trend: H2 2025 saw a 37% drop compared to H1, hinting at possible improvement. New trends seen in Nomani scams include spread to other platforms such as YouTube, better resolution and audio-video sync of deepfakes, and ads and phishing content mirroring trending news and personalities. Scammers have also shortened campaign lifespans and leveraged user tracking to redirect non-targets to benign cloaking pages. Phishing page templates show signs of AI-generated content – such as checkbox emojis in code comments. For more insight into these scams, read the dedicated section in the latest #ESETThreatReport https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h22025.pdf