Typical use cases and intent Most tools (approximately 11) were positioned towards creative, entertainment and social media use cases (memes, parody, live streaming, avatar creation). In total, four tools were marketed for legitimate professional applications – digital marketing, visual effects (VFX), academic research and artist assistance. Meanwhile, two tools appeared to be built for security testing or red team operations. Despite stated benign intentions for some platforms, capabilities such as high-quality video generation and real-time swapping present potential for misuse in identity spoofing and KYC bypass scenarios. Observed artefacts and indicators for detection Consistent artefact classes that may be harnessed for detection were identified: • Temporal artefacts: timing slippage during challenge– response, irregular blink/lip synchronization • Spatial seams: edge blending inconsistencies, flicker amplified by compression • Lighting mismatches: abrupt colour or shadow discontinuities during illumination changes• Motion inconsistency: loss of micro-expressions and unnatural head pose transitions • Network patterns: atypical combinations of upstream video traffic with virtual camera injection These artefacts were more pronounced in tools without advanced motion or lighting models, and were often exacerbated by low bandwidth, device resource constraints or aggressive compression in verification pipelines. KYC risk implications Risk was found to be highest where the following conditions were jointly met: 1) genuine real-time swapping capability, 2) virtual camera or injection path into the verification flow, and 3) high dynamic expression fidelity and reasonable lighting blending. Tools that were offline or cloud-based without virtual camera injection posed lower immediate risk to live liveness checks, but could still be repurposed when combined with injection techniques or used in conjunction with separate voice synthesis tools. Image- only manipulations presented the lowest immediate risk to active liveness mechanisms unless coupled with additional tooling. Summary In total, eight camera injection tools were evaluated to determine their technical behaviours, platform coverage, persistence characteristics and potential to facilitate digital KYC bypass. The sample comprised a mix of free and commercial solutions; three tools were freely accessible, and five were commercial (price range: approximately $10–3,000). Overall, three tools supported both pre-recorded and livestreaming workflows. Another three tools supported only pre-prepared media. Tools were observed across Android, iOS and Windows platforms. Overall, camera injection capabilities were found to be technically diverse but constrained by latency, content format requirements and detectable device artefacts. As a result, most tools seem limited in their ability to reliably defeat modern KYC systems that use dynamic prompts and software development kit (SDK)-level integrity checks.Limitations of the evaluation The assessment was limited to high-level observations and aggregated testing. Full validation against every commercial KYC product was not performed. Tool capabilities may have changed following the collection window; vendor updates or new driver signatures may alter the detection surface. Additionally, the analysis covered only a small subset of deepfake tools available in the wild, and the evaluated samples may not fully represent the diversity or sophistication of the broader ecosystem. Sample bias was possible due to the sources used to obtain these tools. The scope of the paper encompasses open-source intelligence (OSINT) findings and case analyses collected between early 2024 and late 2025. While the paper is based on current technological capabilities and observed threat activity, it should be noted that the rapid pace of AI development may render some conclusions less applicable in the future.Evaluation of camera injection tools Unmasking Cybercrime 11

Unmasking Cybercrime Strengthening Digital Identity Verification against Deepfakes 2026