Uncovered: Meta ad campaign seeking donations for prosthetic legs for Father Miguel, an AI-generated priest
::: spoiler FATHER MIGUEL / PÈRE MIGUEL DONATION CAMPAIGN – IOCs (ICD, 18 Oct 2026)
== Campaign domains (operator-controlled) == peremiguel[.]online French site reg. 2026-09-21 Hostinger smmartwork[.]com Spanish site reg. 2026-07-09 privacy-redacted pmiguel[.]online Spanish mirror reg. 2026-10-14 Hostinger, Cloudflare DNS
== Campaign subdomains == checkout.peremiguel[.]online CNAME checkout.stelar-checkout[.]com checkout.smmartwork[.]com CNAME checkout.stelar-checkout[.]com payments.pmiguel[.]online CNAME checkout.stelar-checkout[.]com sst.smmartwork[.]com CNAME sst.metrito[.]com sst.pmiguel[.]online CNAME sst.metrito[.]com sst.peremiguel[.]online historic CNAME sst.metrito[.]com (no longer resolves)
== Payment path == hxxps://checkout.smmartwork[.]com/safe-pay/ six fixed tokens, $25–$1,000, shared by smmartwork[.]com and pmiguel[.]online hxxps://checkout.smmartwork[.]com/resume?id=…&client_reference_id=lead_… Checkout provider: Stelar Payments (Stelar Business Digital LTDA, Brazil) Card fields: Stripe.js (live publishable key prefix pk_live_51UAaCH2et0NUVNdRj…)
== Tracking == Meta Pixel: 2121505952101984 (smmartwork[.]com, pmiguel[.]online) Metrito project tags: MTC-QVY3ZL9S (French), MTC-ZPA7E54 (Spanish) JS globals: window.GFM_FUNDRAISER_STATE, window.GFM_DONATIONS Files: /js/milo-donations.js, /js/fundraiser-state.js, /fonts/GoFundMeSans-Variable.woff2
== Meta == Page "Miguel", Ad Library Page ID 1321474444382233 Profile ID 61594850122311 Video 61594850122311/videos/2260232108167354 Ad Library IDs: 1590812402051683 (55-ad group, top reach), 2305975576867585 (removed), 1118182984058833, 1356396553233596, 2043656019685708, 1166792105871399, 1955517442094148, 39197567273190424, 1426190338934839, 1414693726862679, 1461078202578773, 1413656324090544, 4483213251992218, 1174038834949165, 1655548506280010 Active 26 Sep – 18 Oct 2026, ~170 ad versions, FR + ES
== File hashes (SHA-256) == 4585cce7e3fd76ebb7cc18b1168bf71c1030962963edd07a377c49eaca92a763 hero image, identical on all 3 domains
== IPs as of 18 Oct 2026 (shared hosting/CDN – context only, do NOT block) == 195.35.60.59, 191.96.144.208 peremiguel[.]online (Hostinger) 92.112.198.119, 147.79.120.153 smmartwork[.]com (Hostinger) 172.67.154.68, 104.21.40.152 pmiguel[.]online (Cloudflare) Historic (22 Sep): 147.79.79.111, 147.79.72.139, 2.57.91.91 (peremiguel), 2.57.91.21 (smmartwork)
== Unconfirmed lead == caminhopadremiguel[.]com reg. 2026-08-12, same story in Portuguese with PIX; offline, no link confirmed :::
Scammers have used AI, religion and disability to steal money from unknowing users of Facebook, Instagram and WhatsApp, powered by Meta ads.
The ads ran from a Facebook page called Miguel between 26 September and 18 October. Meta's Ad Library lists about 170 versions in French and Spanish.
The biggest ran on Facebook, Instagram, WhatsApp, Threads and Meta's Audience Network. All are now inactive.
One ad reached 9,565 accounts in France, Meta's figures show. Nearly 8 in 10 were women, and most were over 45.
It says Miguel is a priest in a town of 5,000 people in São Paulo state, Brazil. The Spanish donation site says the organiser is in Colombia.
An AI-detection scan in our investigation scored Father Miguel's face 0.91 for AI generation.
The crucifix reads "VDX" instead of INRI, his face changes from photo to photo, and his wheelchair warps.
The sites are built to look like GoFundMe pages, down to GoFundMe's own typeface. None of them is on GoFundMe.
The donations shown on his sites are static code, fake.
2 of them send donors to the exact same 6 payment links, from $25 to $1,000.
In the Spanish version, the medical note says both legs were amputated above the knee, while the clinic quote beside it prices below-knee prostheses.
The note is signed in the name of a real Brazilian haematologist. We found no evidence he wrote it.
The trail leads to Brazil. Donations go through a checkout from Stelar, a Brazilian payments platform, with Stripe card fields.
Visitors are tracked by Metrito, a Brazilian ad-tracking service, and some comments in the sites' code are written in Portuguese.
Meta lists a Brazilian sole trader, registered in Roraima in May as a driver-for-hire business, as payer for the French ads.
The Spanish ads name a car repair business in Rondônia whose website has nothing to do with Miguel.
Either identity may have been misused.
The checkout preselects a $5 add-on and names no merchant or charity.
Stelar's terms say sellers plug in their own payment gateway. Meta, Stelar and Stripe hold the records that would show who is behind the ads and who gets the money.
Meta removed one version of the ad for "Unacceptable business practices", while others kept running until 18 October.
The donation sites are still online today.
Source:
International Cyber Digest:
1 reply
This little lady sat next to me and said I'll never forget these words.
I'm father Miguel....
Did she now?