Deepfake as a Service: 39% More Conversations on the Dark Web

What happened?

Cybersecurity company NordStellar has published a report revealing a significant increase in dark web conversations about on-demand deepfake services (DFaaS). Between January and May 2026, 924 posts were recorded on the topic, a 39% increase from the 663 posts during the same period in 2025. The study, reported by TechRadar, points to advances in generative AI as the driving force behind this uptick, as it facilitates the creation of hyperrealistic deepfakes and lowers the technical barrier for cybercriminals.

Why is it important?

The growing availability of deepfake as a service is not just a technological curiosity; it represents a concrete threat to businesses and individuals. Experts fear this trend will fuel the next generation of 'fake boss' scams, a type of fraud that is already highly lucrative. According to the FBI, Business Email Compromise (BEC) was the second most costly tactic in 2025, with business losses exceeding $3 billion, an 11% increase from the previous year. The difference now is that deepfakes enable impersonation not only through text but also through voice and video, making the deception far more convincing.

Consequences and context

The democratization of deepfake technology through subscription models on the dark web has several implications. On one hand, it lowers the entry threshold for attackers without advanced technical skills, which will likely increase the number of incidents. On the other hand, the quality of deepfakes is constantly improving, making them difficult to detect even for trained personnel. In the words of Vakaris Noreika, cybersecurity expert at NordStellar: "The rapid growth in popularity of deepfakes as a service is likely accelerated by advances in generative AI, which help cybercriminals in two ways: speeding up the creation of deepfakes and making them hyperrealistic."

The report also emphasizes that defense lies in prevention and employee training. Since companies cannot control whether they become targets of these attacks, they must focus on reducing their exposure by monitoring the dark web for corporate data leaks that could be used to personalize the deceptions.

What should readers know?

For organizations, the main lesson is that cybersecurity can no longer be limited to passwords and firewalls. Deepfake impersonation requires multi-factor verification protocols that include alternative confirmation channels (e.g., calling the person who supposedly sent an order). Additionally, it is essential to educate employees about the risks of sharing personal or corporate information on social media and other platforms, as that data can be collected to create more believable deepfakes.

For individual users, the recommendation is to be suspicious of any unusual request, even if it appears to come from an acquaintance or superior. Deepfake technology is advancing so rapidly that traditional fraud signals (such as grammatical errors or poor image quality) are no longer reliable. Staying informed and applying healthy skepticism is the best defense.

"The more details and access attackers obtain, the easier it will be for them to craft highly realistic and targeted attacks. Monitoring the dark web for leaked company information is a critical step to prevent cybercriminals from finding credentials to breach accounts or data to use as intelligence." – Vakaris Noreika, NordStellar

In summary, the 39% increase in DFaaS conversations on the dark web is not an isolated statistic but an indicator of a trend that will likely intensify. Companies and individuals must adapt their security strategies to face a threat that is no longer science fiction but a commercial reality accessible to anyone with an internet connection and a few crypto assets.