Digital Threats Training Fuels Innovative Cyber Investigations Worldwide

Investigative Journalists Leverage Digital Training to Expose Global Scams

A wave of sophisticated digital investigations is revealing online scams and disinformation campaigns across the globe, as journalists trained through specialized programs apply advanced cyber techniques to expose fraudsters.

From India to Kenya to the Philippines, alumni of the Global Investigative Journalism Network’s (GIJN) Digital Threats courses have published exposés that illuminate complex online deceptions, helping readers protect themselves from increasingly sophisticated schemes.

The training program, launched in 2023, has equipped 107 investigative journalists and researchers with specialized skills through hands-on sessions led by cyber experts. According to a recent GIJN survey of 31 alumni, participants have been able to pursue increasingly ambitious investigations into veiled online frauds.

In India, BoomLive reporter Hera Rizwan uncovered a sophisticated WhatsApp scam that drained bank accounts through seemingly harmless image files. Her investigation, “It Wasn’t Just A WhatsApp Image That Stole Rs 2 Lakhs,” revealed how scammers used steganography and malicious APK binding techniques to gain access to victims’ devices when they clicked on innocent-looking WhatsApp images.

“The course taught how to translate complex technical concepts into accessible language for readers,” Rizwan explained, noting that most Indian media typically only report basic facts about cyber crimes. Her more comprehensive approach exposed “the technical and psychological layers behind the attack—how a harmless-looking image could carry hidden malware, and how scammers exploit trust and familiarity to deceive victims.”

Rizwan also leveraged her new skills to investigate how one of India’s largest gig economy platforms used artificial intelligence to alter service professionals’ photos without consent, raising serious concerns about both privacy and the livelihoods of vulnerable workers.

In Kenya, investigative journalist Nyekerario Omari published “Fake Bags for Sale” for the outlet Piga Firimbi, exposing a network of 112 Facebook accounts impersonating airports and airlines to sell nonexistent “unclaimed luggage” to unsuspecting consumers.

“Through the GIJN Digital Threats course, I was able to highlight how these phishing campaigns work, by digging into Facebook campaigns which rely on clickable impersonated websites with a short shelf life to collect the victim’s personal data,” Omari said. Her investigation utilized tools like WhoIs, DNS Checker, and reverse image searches to establish connections between the fraudulent accounts.

Omari, who participated in GIJN’s third Digital Threats cohort, emphasized the value of having multiple analytical methods at her disposal. “Most of the tools shared complemented each other,” she noted. “Additionally, InVid WeVerify and Photo Forensics proved valuable when a page’s transparency offered limited information.”

In the Philippines, Philippine Center for Investigative Journalism (PCIJ) reporter Regine Cabato uncovered a sophisticated “cyborg” propaganda operation combining human operators and AI-driven bots to spread coordinated misinformation supporting the country’s Duterte family political dynasty.

The investigation analyzed thousands of suspicious comments on mainstream news posts, identifying recurring scripts and coordinated messaging. “For the comment section analysis, [we] used an Apify tool for initial scraping of a sample size of some 2,000 comments. I learned about the tool via the GIJN training,” Cabato explained.

Her exposé reached impressive scale with a social media video version garnering 130,000 views across Facebook, Instagram, and TikTok. The investigation’s impact was further evidenced by the retaliatory harassment campaign it triggered from pro-Duterte supporters, later documented by news outlet Rappler.

The success of these investigations demonstrates how specialized digital training is creating a new generation of cyber journalists empowered to penetrate increasingly complex online schemes. As digital threats evolve, these journalists are developing capabilities comparable to financial reporters who track shell company networks and hidden assets.

By translating technical concepts into accessible stories and explaining scam mechanics to the public, these investigations serve the dual purpose of holding bad actors accountable while helping readers protect themselves from similar deceptions in the future.