The Digital Altar of Deceit: Unmasking an AI Priest Scam via Meta Ad Transparency

Online crowdfunding has unlocked unprecedented avenues for genuine charitable causes, yet it simultaneously empowers sophisticated threat actors to manufacture emotional fraud at scale. Recent threat intelligence observations revealed a targeted charity scam exploiting human empathy across Francophone digital spaces. The scheme orchestrated a synthetic narrative centered around “Père Miguel”, an alleged Brazilian Catholic priest who supposedly underwent double leg amputation following severe medical complications. Through artificial testimonials, synthetic imagery, fabricated medical invoices, and cloaked ad distribution, the perpetrators sought direct donations while mimicking authentic GoFundMe infrastructure.

By conducting a targeted open-source intelligence investigation and utilizing platform transparency mechanisms, the infrastructure behind the campaign unravels, leading directly to the individual accountable for financing the disinformation campaign.

The Anatomy of the Campaign

The challenge brief outlines an elaborate social engineering narrative engineered to capture donations under false pretenses.

The campaign operated through the primary landing page peremiguel.online, which mirrored GoFundMe interface components, styling, and donation progress counters. The French text presented an emotional plea to fund leg prosthetics and specialized rehabilitation:

CAMPAIGN_NAME = 'Pere Miguel - protheses et reeducation'

While surface infrastructure was built to replicate legitimate platforms, distribution relied heavily on paid ad placement across social channels to reach vulnerable demographics.

Locating the Social Asset

To evade automated detection, threat actors create intermediary assets that mirror legitimate community organizations. Searching for the persona behind the distribution network revealed a dedicated Facebook page styled as a nonprofit entity titled “Miguel”.

The page exhibited clear markers of an asset created purely for ad orchestration:

• Account creation date precisely aligned with the malicious campaign deployment window.
• Minimal public interaction, with the page profile featuring an AI-rendered portrait of a cleric.
• Absence of authentic organic engagement, regular church parish activity, or verifiable institutional affiliations.

Leveraging Page Transparency

While public timelines often obscure attribution, platform compliance features preserve the historical context of ad operations. Accessing the Page Transparency pane provides an unalterable operational baseline.

The Page Transparency audit confirmed crucial metadata:

• The page was launched on September 22, 2026 under the name “Miguel”.
• The asset holds the internal Meta Page ID: 1321474444382233.
• A direct link enabled navigation into Meta’s centralized Ad Library to evaluate active and inactive distribution runs.

Meta Ad Library Discovery and Inactive Campaign Filtration

Generic ad searches across Meta’s repository frequently return broad commercial noise due to common naming conventions. Querying global indexes requires filtering specifically for inactive runs and historical snapshots.

Because malicious campaigns are quickly suppressed by safety teams or manually terminated once reach quotas are hit, default queries that isolate active ads fail to return results.

Configuring filters to capture historical ad instances associated with Page ID 1321474444382233 uncovered a consolidated cluster of 58 distinct ad variants deployed between October 17 and October 18, 2026. Each variant utilized synthetic video scripts in French detailing the priest’s alleged struggles in the interior of São Paulo, paired with urgent donation appeals.

Unveiling the Payer Behind the Fraud

Under regulatory mandates established across the European Union through the Digital Services Act, platforms are required to log and disclose verified payment entities for political, social, and charitable advertising.

Opening the granular details for Ad ID 1426190338934839 unlocks the internal compliance statement recorded during payment authorization.

The transparency record definitively identifies the registered advertiser and paying entity behind the operation:

• Page Name: Miguel
• Page Identifier: 1321474444382233
• Advertiser (Reklamveren): Ronayra Conceicao da Silva
• Payer (Ödeyen): Ronayra Conceicao da Silva

Intelligence Extraction and Verification

The financial accountability record establishes the attribution link required to resolve the objective:

OSINT{Ronayra_Conceicao_da_Silva}

This investigation reinforces a foundational rule of digital forensics and threat tracking: no matter how convincingly synthetic content mimics legitimate charity efforts, financial rails and compliance transparency archives remain indispensable choke points for de-anonymizing disinformation operators.

Socials

• LinkedIn: Alp Akciğer