Search

𝗨𝗻𝗶𝘁𝗲𝗱 𝗦𝘁𝗮𝘁𝗲𝘀 — 𝗧𝗵𝗲 𝗶𝗻𝗳𝗹𝘂𝗲𝗻𝗰𝗲 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝗯𝘂𝗶𝗹𝘁 𝗳𝗼𝗿 𝗔𝗜, 𝗻𝗼𝘁 𝘃𝗼𝘁𝗲𝗿𝘀 A newly exposed US political influence network appears to have been designed around a different target from most election propaganda. Its primary audience was not necessarily the voter reading a website, but the automated systems that search the web on behalf of AI chatbots. Threat-intelligence company VisionHeight initially identified 37 anonymous websites presenting themselves as state or local news organisations, opinion publications and national issue sites. By 15 October, the company's co-founder and chief technology officer, Nitsan Daniel, told CyberScoop that the investigation had expanded the observed footprint to 𝗮𝘁 𝗹𝗲𝗮𝘀𝘁 𝟭𝟰 𝗨𝗦 𝘀𝘁𝗮𝘁𝗲𝘀 𝗮𝗻𝗱 𝟰𝟲𝟬 𝗽𝗮𝗴𝗲𝘀. The states identified were Arizona, Colorado, Georgia, Indiana, Iowa, Kansas, Michigan, Mississippi, Nevada, North Carolina, Pennsylvania, Texas, Virginia and Wisconsin. The infrastructure shows unusually strong signs of coordination. All 37 domains in the original dataset were registered during a single evening; 36 were registered within approximately eight minutes. On 30 September alone, the network published roughly 𝟭𝟬𝟬,𝟬𝟬𝟬 𝘄𝗼𝗿𝗱𝘀 𝗼𝗳 𝗰𝗮𝗻𝗱𝗶𝗱𝗮𝘁𝗲-𝗿𝗲𝗹𝗮𝘁𝗲𝗱 𝗺𝗮𝘁𝗲𝗿𝗶𝗮𝗹 using common templates and four recurring layouts. VisionHeight assesses that the scale and production pattern strongly suggest extensive automation, although that does not by itself prove which generative-AI system, if any, produced the text. 𝗧𝗵𝗲 𝗰𝗼𝗻𝘁𝗲𝗻𝘁 𝗶𝘀 𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲𝗱 𝗳𝗼𝗿 𝗺𝗮𝗰𝗵𝗶𝗻𝗲 𝗿𝗲𝘁𝗿𝗶𝗲𝘃𝗮𝗹. Candidate profiles can run to about 5,000 words, accompanied by similarly long voter guides containing 50 to 63 questions phrased in the style of queries someone might put to an AI assistant. Across the network, formulations such as a candidate being “the stronger choice” were repeated hundreds of times. One profile contained the phrase 34 times. In several voter guides examined by VisionHeight, the favoured candidate was named more than 110 times while an opponent appeared only six or seven times. The websites were also configured to make themselves unusually accessible to AI. Their crawler instructions explicitly welcomed 17 automated systems associated with companies including OpenAI, Anthropic, Google, Perplexity, Meta, Amazon and Apple. Some pages were marked in machine-readable metadata as news articles, while apparently separate publications cited one another. The result is a manufactured ecosystem in which several apparently independent local sources can reinforce the same conclusion. That is the central technique. 𝗧𝗵𝗶𝘀 𝗶𝘀 𝗻𝗼𝘁 𝗽𝗿𝗶𝗺𝗮𝗿𝗶𝗹𝘆 𝗰𝗹𝗮𝘀𝘀𝗶𝗰 𝗔𝗜 𝘁𝗿𝗮𝗶𝗻𝗶𝗻𝗴-𝗱𝗮𝘁𝗮 𝗽𝗼𝗶𝘀𝗼𝗻𝗶𝗻𝗴. The more immediate objective appears to be manipulation of the retrieval and search layer: place highly optimised material online, make it easy for automated crawlers to index, create the appearance of corroboration, and increase the chance that an AI assistant retrieves those pages when answering a political question. There is evidence that the network crossed that boundary. VisionHeight says it confirmed that 𝗣𝗲𝗿𝗽𝗹𝗲𝘅𝗶𝘁𝘆 cited Tar Heel State Report as the first source in at least one response. Separately, one of the network's candidate pages reached third place in a Google search six days after publication, above Ballotpedia for the tested query. These findings demonstrate that the material can enter AI-relevant search and retrieval pipelines. They do 𝗻𝗼𝘁 demonstrate that the operation changed anyone's vote, nor establish how frequently major chatbots have used the network. The timing matters because AI has become part of the election-information environment. An AAPC Foundation survey of 1,568 likely US voters found that about one in five planned to use AI to investigate a race on their ballot, while 38 per cent reported having received election information through an AI-generated search summary. A separate NewsGuard audit found that leading chatbots frequently cited partisan websites disguised as local journalism without clearly identifying their political affiliations. The newly identified network appears to take that existing vulnerability one step further by constructing content specifically around the way machines search and summarise information. 𝗪𝗵𝗼 𝗶𝘀 𝗯𝗲𝗵𝗶𝗻𝗱 𝗶𝘁? 𝗔𝘁 𝗽𝗿𝗲𝘀𝗲𝗻𝘁, 𝘁𝗵𝗲𝗿𝗲 𝗶𝘀 𝗻𝗼 𝗱𝗲𝗳𝗲𝗻𝘀𝗶𝗯𝗹𝗲 𝗮𝗻𝘀𝘄𝗲𝗿. VisionHeight has not attributed the operation to any individual, campaign, company, political party or foreign government. No confirmed name of an operator has been publicly established. Nitsan Daniel is the researcher who helped expose the network, not a person connected to its operation. Some components have explicitly partisan branding. VisionHeight's indicators include domains such as Affordability Democrats, Democratic Women House, Public Safety Democrats and Republican Incumbent Watch, while the live Affordability Democrats site promotes Democratic candidates across 11 competitive House races. That provides evidence about the political direction of some of the published material, but it does 𝗻𝗼𝘁 establish who commissioned, financed or operated the infrastructure, and it would be unjustified to attribute it to the Democratic Party or any particular campaign. The network also appears broader than congressional politics. The live Tar Heel State Report has carried material on county commission and judicial contests, illustrating why the method may be particularly effective in down-ballot races where established local reporting is thin. 𝗧𝗵𝗲 𝘀𝗶𝗴𝗻𝗶𝗳𝗶𝗰𝗮𝗻𝗰𝗲 𝗼𝗳 𝘁𝗵𝗶𝘀 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻 𝗶𝘀 𝘁𝗵𝗲 𝗮𝘁𝘁𝗮𝗰𝗸 𝘀𝘂𝗿𝗳𝗮𝗰𝗲. Propaganda no longer has to persuade a human being directly. It can instead attempt to shape the information environment from which an apparently neutral machine constructs its answer. 𝗦𝗧𝗔𝗧𝗨𝗦: Active / newly exposed and expanding as of 15–16 October 2026. 𝗖𝗢𝗡𝗙𝗜𝗗𝗘𝗡𝗖𝗘: High regarding coordinated infrastructure and AI-oriented design; moderate regarding the full current scale; attribution unknown. 𝗦𝗢𝗨𝗥𝗖𝗘𝗦 VisionHeight — primary investigation, “Someone Is Manipulating Your AI to Swing Your Vote” https://www.visionheight.com/resources/someone-is-manipulating-your-ai-to-swing-your-vote CyberScoop — Derek B. Johnson, 15 October 2026 https://cyberscoop.com/ai-chatbots-election-influence-hyperlocal-networks/ Tar Heel State Report — live network site used for OSINT verification https://tarheelstatereport.com/ Affordability Democrats — live network site https://affordabilitydemocrats.com/ AAPC Foundation — 2026 AI Voter Study https://theaapc.org/release-foundation-research/ NPR — reporting on voters using AI chatbots for the 2026 midterms https://www.wusf.org/2026-10-05/people-are-asking-chatgpt-to-help-them-decide-how-to-vote-in-the-midterms NewsGuard — “Pink Slime Is Infecting AI Chatbots Ahead of the Midterms” https://www.newsguardtech.com/press/pink-slime-is-infecting-ai-chatbots-ahead-of-the-midterms/ 𝗞𝗘𝗬𝗪𝗢𝗥𝗗𝗦 #Disinformed #Disinformation #Propaganda #InfluenceOperations #AI #ArtificialIntelligence #AIChatbots #ElectionSecurity #USMidterms #USElections #InformationWarfare #CognitiveWarfare #OSINT #ThreatIntelligence #CyberSecurity #DataPoisoning #RetrievalManipulation #SearchManipulation #GenerativeAI #LLM #AIManipulation #PoliticalInfluence #FakeNews #LocalNews #PinkSlime #Perplexity #ElectionIntegrity #InformationIntegrity #DigitalPropaganda #AIsecurity

𝗜𝗿𝗮𝗻’𝘀 𝗳𝗮𝗸𝗲 𝗜𝘀𝗿𝗮𝗲𝗹𝗶𝘀 – 𝗵𝗼𝘄 𝗮 𝗳𝗼𝗿𝗲𝗶𝗴𝗻 𝗶𝗻𝗳𝗹𝘂𝗲𝗻𝗰𝗲 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝗲𝗻𝘁𝗲𝗿𝗲𝗱 𝗜𝘀𝗿𝗮𝗲𝗹’𝘀 𝗲𝗹𝗲𝗰𝘁𝗶𝗼𝗻 𝗱𝗲𝗯𝗮𝘁𝗲 Ahead of Israel’s 27 October election, hundreds of social-media accounts have been presenting themselves as ordinary Israelis while injecting political messages into genuine domestic conversations. They appear as women, reservists, secular voters, religious activists and frustrated citizens. Some attack Benjamin Netanyahu, others have previously promoted narratives associated with the Israeli right, while many focus less on parties than on a broader message: Israel is divided, its institutions cannot be trusted and its political system is approaching crisis. A detailed investigation by the OSINT company Golden Owl has mapped this activity as a substantial Iran-linked influence network. Its October analysis identified at least 694 accounts, with 445 attributed at high or medium-high confidence to the operation. Between 11 August and 11 October, the network generated at least 4.7 million views and more than 160,000 interactions. The researchers found no evidence that these accounts were simply a group of independent Iranian commentators expressing political opinions. Their assessment rests instead on coordinated behaviour, false identities, account histories, copied content, language patterns and platform metadata linking significant parts of the infrastructure to Iran. 𝗙𝗿𝗼𝗺 𝟯𝟱 𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝘀 𝘁𝗼 𝗵𝘂𝗻𝗱𝗿𝗲𝗱𝘀 𝗼𝗳 𝗳𝗮𝗸𝗲 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 The investigation developed in two stages. Golden Owl’s first report, published in September, identified an operational core of 35 accounts: 32 personas presenting themselves as Israelis and three Hebrew-language media-style channels. During the 30-day period measured in that study, active accounts generated 947,322 impressions and more than 9,000 interactions. The October investigation expanded the dataset dramatically. Researchers analysed more than 560,000 data points, including tens of thousands of accounts, relationships between them and more than a quarter of a million posts. The wider network showed repeated patterns of identical texts, synchronised activity and accounts created in batches. The numbers therefore describe not a sudden explosion from 35 to hundreds of accounts, but the gradual exposure of a much larger infrastructure surrounding the original core. 𝗧𝗵𝗲 𝗳𝗮𝗸𝗲 𝗜𝘀𝗿𝗮𝗲𝗹𝗶𝘀 Some of the strongest evidence comes from the histories of individual personas. One account had spent years posting exclusively in Persian under the handle “mardeankabooti” before reappearing in August 2026 as an apparently Israeli user called “Alon Strauss”, complete with an Israeli flag and Hebrew political messaging. Other personas presented themselves as Israeli professionals, activists or ordinary citizens while X transparency information showed connections through the Iranian version of the Android application or locations inconsistent with their claimed identities. The account “Yaara Shalev” presented itself as an Israeli woman concerned with democracy and peace. Investigators found that photographs used to construct the identity were inconsistent, including borrowed and apparently AI-generated imagery. A small Hebrew-language channel called KigVoice, previously identified in Israeli government reporting as part of an Iranian influence environment, repeatedly published material that later appeared on the much more visible Yaara account. In one sample, 14 of 40 KigVoice posts subsequently resurfaced as captions or opening lines in Yaara’s content. Another persona, “Miriam Kozak”, had built an audience of more than 18,000 followers and had already been exposed as fictitious by Israeli researchers in 2024. Its political messaging changed substantially over time, moving between narratives associated with different sides of Israeli politics. That inconsistency is important: the apparent purpose was not necessarily to build a stable ideological following, but to enter whichever political argument offered the greatest opportunity to intensify division. 𝗔𝗜, 𝗰𝗼𝗽𝗶𝗲𝗱 𝗺𝗲𝘀𝘀𝗮𝗴𝗲𝘀 𝗮𝗻𝗱 𝗜𝗿𝗮𝗻𝗶𝗮𝗻 𝗳𝗶𝗻𝗴𝗲𝗿𝗽𝗿𝗶𝗻𝘁𝘀 The Iran attribution is based on more than political content. Researchers identified accounts using the Iranian version of the X Android application, repeated connections to previously identified Iranian influence assets, copied posts appearing across supposedly independent personas within minutes, and Hebrew containing unusual grammatical errors or Persian and Arabic keyboard artefacts. Generative AI also appears to have become part of the production process. Some accounts inadvertently published fragments resembling chatbot instructions, while other posts displayed patterns consistent with machine-generated Hebrew. AI-generated videos and synthetic profile imagery further reduced the cost of maintaining large numbers of apparently distinct personalities. However, none of these indicators was treated as proof on its own. Golden Owl explicitly excluded accounts where the evidence was insufficient and notes that VPNs, travel and platform location labels can create misleading signals. The attribution rests on multiple independent indicators converging across the network. 𝗧𝗵𝗲 𝗴𝗼𝗮𝗹 𝗶𝘀 𝗻𝗼𝘁 𝗻𝗲𝗰𝗲𝘀𝘀𝗮𝗿𝗶𝗹𝘆 𝘁𝗼 𝗲𝗹𝗲𝗰𝘁 𝗼𝗻𝗲 𝗽𝗮𝗿𝘁𝘆 The network repeatedly exploited issues that genuinely divide Israeli society: responsibility for the 7 October attacks, the war, the hostages, ultra-Orthodox military exemptions, economic pressure, emigration and confidence in state institutions. It also circulated misleading information about the election itself, including false voting dates, claims that voting had been postponed and posts suggesting online voting mechanisms that do not exist in Israel’s parliamentary election system. The pattern suggests a strategy broader than conventional electoral campaigning. Rather than consistently promoting one political faction, the network appears designed to weaken confidence in the government, military, democratic institutions and the electoral process itself. An influence operation does not need to persuade Israelis to support a particular candidate if it can convince different groups that defeat would prove fraud, betrayal or systemic failure. 𝗥𝗲𝗮𝗹 𝗜𝘀𝗿𝗮𝗲𝗹𝗶𝘀 𝗮𝘀 𝘂𝗻𝘄𝗶𝘁𝘁𝗶𝗻𝗴 𝗮𝗺𝗽𝗹𝗶𝗳𝗶𝗲𝗿𝘀 One of the network’s most effective characteristics is that it does not depend solely on its own followers. Fake personas enter comment sections and political discussions involving real Israeli journalists, politicians and ordinary users. Authentic Israelis then repost or interact with the material, sometimes carrying it far beyond the original account. Golden Owl does not classify those genuine users as participants in the operation. In most cases they appear to be unwitting amplifiers. But once a message passes from a fabricated Iranian-operated persona to an authentic Israeli account, its foreign origin becomes much harder for the next person to recognise. 𝗧𝗵𝗲 𝟰𝟬,𝟬𝟬𝟬-𝗯𝗼𝘁 𝗳𝗶𝗴𝘂𝗿𝗲 𝗯𝗲𝗹𝗼𝗻𝗴𝘀 𝘁𝗼 𝗮 𝗱𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝘁 𝗽𝗲𝗿𝗶𝗼𝗱 A much larger figure has also appeared in recent reporting. In the first two days after the October 2023 Hamas attack, social-media intelligence company Cyabra identified more than 40,000 fake profiles participating in online discussions across major platforms. Their content generated hundreds of thousands of interactions and had a potential reach estimated at 531 million profiles. Those numbers are important historical context, but they should not be merged with the current Golden Owl investigation. There is no public evidence demonstrating that all of those 2023 accounts and the 2026 Iran-linked election network belonged to one continuous command structure. The 531 million figure is also an estimate of potential exposure, not proof that 531 million people saw or believed the content. 𝗪𝗵𝗼 𝗶𝘀 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗯𝗲𝗵𝗶𝗻𝗱 𝘁𝗵𝗲 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻? No confirmed individual operators have been publicly identified. Names such as Yaara Shalev, Miriam Kozak and Alon Strauss are personas, not verified identities of the people controlling the accounts. Golden Owl says its evidence supports an association with the Islamic Republic of Iran and with previously documented Iranian influence infrastructure, but it does not establish which Iranian institution, intelligence service, military organisation or contractor directs the network. That distinction is essential. Public OSINT supports attribution at the Iran-linked operational level. It does not currently justify naming individual Iranian officials as the people commanding this specific campaign. 𝗧𝗵𝗲 𝗱𝗲𝗲𝗽𝗳𝗮𝗸𝗲 𝗶𝘀 𝗻𝗼 𝗹𝗼𝗻𝗴𝗲𝗿 𝗼𝗻𝗹𝘆 𝘁𝗵𝗲 𝘃𝗶𝗱𝗲𝗼 The Israeli case illustrates a broader change in influence operations. The synthetic asset does not have to be a spectacular deepfake of a politician. It can be an apparently ordinary citizen who comments on politics, argues with neighbours, describes personal experiences and gradually becomes part of an authentic community. That can be more difficult to recognise because the propaganda does not arrive looking foreign. It arrives looking local. And when hundreds of fabricated citizens enter the same national conversation, they can manufacture the impression that political anger, despair or distrust is more spontaneous and more widely shared than it really is. 𝗦𝗼𝘂𝗿𝗰𝗲𝘀 Golden Owl — Exposing the Iranian Regime’s Influence Machinery Against Israeli Society https://web-dev-production-7a35.up.railway.app/resources/research/Exposing-the-Iranian-Regime-Influence-Machinery-Against-Israeli-Society Golden Owl Golden Owl — The Other Face of War: Iranian Regime–Linked Manipulation of Israel’s 2026 Election Debate https://web-dev-production-7a35.up.railway.app/resources/research/Iranian-Regime-Linked-Manipulation-of-Israel-2026-Election-Debate Golden Owl The Jerusalem Post — Iran-linked social-media accounts posing as Israelis to target election https://www.jpost.com/israel-election-2026/article-909863 The Jerusalem Post Ynet — Fake Israelis, real influence: Iran-linked network infiltrates Israel’s election debate https://www.ynetnews.com/tech-and-digital/article/syp119nqqzg ynetglobal Calcalist — Iranian influence network exposed ahead of Israel’s election https://www.calcalist.co.il/calcalistech/article/s1q0ifijzl calcalist Vesty / Ynet — Iranian fake-account network and October update https://www.vesty.co.il/main/article/rkwokjssgg vesty Israel Ministry for Diaspora Affairs — Iran’s active Hebrew-language influence campaign https://www.gov.il/BlobFolder/reports/israel-and-us-strikes-in-iran-daily-status_2_3_26/en/mashlat_Roaring_Lion_israel-and-us-strikes-in-iran-daily-status_2_3_26.pdf Government of Israel Israel Central Elections Committee — official 2026 election timetable https://www.gov.il/en/pages/time--table-26 Government of Israel Channel NewsAsia — historical Cyabra analysis of more than 40,000 fake profiles after 7 October 2023 https://www.channelnewsasia.com/singapore/how-fake-news-israel-hamas-stokes-outrage-hatred-and-potential-violence-southeast-asian-tiktok-5603221 𝗞𝗲𝘆𝘄𝗼𝗿𝗱𝘀 #DISINFORMED #Episode20 #Iran #Israel #IsraelElection2026 #IranianInfluence #IranianDisinformation #ElectionInterference #ForeignInterference #FIMI #Disinformation #InformationWarfare #InfluenceOperations #FakeAccounts #FakePersonas #SyntheticIdentity #ArtificialIntelligence #AI #AIPropaganda #SocialMediaManipulation #Astroturfing #NarrativeManipulation #PoliticalDisinformation #ElectionDisinformation #X #Twitter #Bots #BotNetwork #KigVoice #YaaraShalev #MiriamKozak #DigitalInfluence #InformationManipulation #ElectionIntegrity #GoldenOwl #OSINT #MediaManipulation #WRLD

Retired Colonel Maciej Korowaj assessed that the 17.1 trillion rubles earmarked for defense in the Russian budget for 2027 does not constitute a barrier to mobilization, but it does not signal it either. He pointed out that the overt mobilization stance remains marginal, and the contract model is exhausting its social base. In his opinion, part of the increase in defense spending may stem from transferring payments for the wounded and the families of the deceased to this sector, which were previously included in a classified section called "Social Policy." This would mean that part of the growth finances the costs of losses, rather than new capabilities. Korowaj wrote that, regardless of the budget, Russia's legal-administrative capacity to mobilize people is increasing. He noted that a decree from December 30, 2025, directed contract reservists to protect critical facilities in 2026, and a decree from July 27, 2026, increased the armed forces' personnel by 25,000, to 1,535,000 soldiers. According to him, this was the third such increase in the year, formally tied to the creation of military-construction units. He also referenced an assessment by the Ukrainian HUR that Russia aims to recruit about 600,000 people in 2026–2027, utilizing the electronic register and digital summonses, which would enable mobilization without public announcement. Korowaj identified the system's capacity as the main limitation. He wrote that Russian losses currently amount to 30,000–35,000 killed or wounded per month, and according to NATO estimates, most recruits still end up on the front lines as reinforcements. With an intake of about 30,000 people per month, the army, in his opinion, is essentially restoring its personnel rather than creating surpluses for new formations. Citing OSINT, he noted that 4,799 out of 7,342 pre-war tanks stored in depots had been used, leaving about 19% remaining. Korowaj assessed that in the short term, it would be possible to draft several hundred thousand people as reinforcements and rear echelon personnel, but not quickly create a second army capable of maneuver warfare. He emphasized that mass mobilization would require the identification, selection, training, and equipping of hundreds of thousands of individuals, while the military apparatus is busy sustaining the front. He also referred to a report by Andrei Belousov for Vladimir Putin from December 2025: in 2025, five divisions, 13 brigades, and 30 regiments were to be formed, while four divisions, 14 brigades, and 39 regiments were planned for 2026. He pointed to the establishment of the 44th Army Corps in Karelia, the elevation of brigades to the rank of divisions, including the 71st Guards Mechanized Division on the Kola Peninsula, and a rocket brigade with Iskanders. In his view, these formations mainly consisted of conscripts and trained reinforcements. He added that according to Finnish sources, the expansion of bases in Petrozavodsk, Pechenga, and Baltiysk would enable the support of 80,000–115,000 soldiers only after the war in Ukraine concludes. Korowaj agreed with the ISW assessment that, in the short term, ground operations against NATO are unlikely, as the majority of Russia's potential is engaged in Ukraine. He also cited a report from a closed NATO briefing in Ankara, during which an Alliance representative purportedly spoke about the re-establishment of the Leningrad and Moscow Military Districts, at least one new corps, and three divisions, but also mentioned a lack of signs of an intention to conduct a rapid attack. He concluded that the budget finances a long war with Ukraine and creates opportunities for the period after it is frozen, but it does not indicate preparations for an attack on NATO or a withdrawal of the Kremlin from such an option. #Rosja #wojna #defensywa (translated)

Dawid Kamizela wrote that he did not expect the first photos to appear so quickly. He assessed that they are too unclear to conduct an evaluation of the damage based on them, even in an OSINT analysis, but in his opinion, they show two serious hits on the parking lot slab where the Su-34 was parked. He described himself as a moderate optimist. https://t.co/FO4RYMZ1qp #zdjęcia #BDA #Su34 (translated)

𝗧𝗵𝗲 $𝟰𝟯 𝗺𝗶𝗹𝗹𝗶𝗼𝗻 𝗿𝗼𝘆𝗮𝗹 𝗲𝘀𝘁𝗮𝘁𝗲 𝘁𝗵𝗮𝘁 𝗭𝗲𝗹𝗲𝗻𝘀𝗸𝘆𝘆 𝗻𝗲𝘃𝗲𝗿 𝗯𝗼𝘂𝗴𝗵𝘁 A Norwegian royal residence, a $43 million price tag, an offshore company historically linked to Volodymyr Zelenskyy and a video apparently produced by the American entertainment outlet E! News. The story contained enough authentic details to look plausible. It was also fabricated. At the end of September 2026, social-media accounts began circulating a video claiming that Film Heritage Inc., a Belize-registered company with historical links to Zelenskyy and his family, had purchased the Norwegian royal estate of Skaugum for approximately $43 million. The property was described as covering 240 acres, while the supposed transaction was linked to Zelenskyy’s visit to Norway for the funeral of King Harald V. Independent investigations found no evidence that such a sale had ever taken place. 𝗔 𝗳𝗮𝗸𝗲 𝗿𝗲𝗽𝗼𝗿𝘁 𝗯𝘂𝗶𝗹𝘁 𝗮𝗿𝗼𝘂𝗻𝗱 𝗿𝗲𝗮𝗹 𝗲𝘃𝗲𝗻𝘁𝘀 The fabrication was carefully constructed around genuine information. King Harald V had died in August 2026, and Zelenskyy and First Lady Olena Zelenska travelled to Oslo for his funeral on 9 September. Skaugum is also a genuine royal estate in Asker with a long history as a residence of Norway’s heir to the throne. The false report turned those facts into a fictional property transaction. It claimed that Zelenskyy had previously attempted to buy the estate, that the Norwegian royal family had rejected an earlier approach and that the purchase had finally been completed after the property supposedly became a financial burden. No documentary evidence supporting any of these claims has emerged. Norway’s Ministry of Foreign Affairs later confirmed to fact-checkers that the allegation was false. Searches of established Norwegian and international media also produced no credible reporting about the supposed transaction. 𝗔 𝗻𝗲𝘄𝘀𝗿𝗼𝗼𝗺 𝘁𝗵𝗮𝘁 𝗲𝘅𝗶𝘀𝘁𝗲𝗱 𝗳𝗼𝗿 𝘁𝘄𝗼 𝗱𝗮𝘆𝘀 The most important part of the operation was not the property claim itself. It was the source apparently verifying it. The video was designed to resemble an E! News report, borrowing the visual language of the established American entertainment brand. But investigators found no such story on E! News’s genuine website, social-media channels or archived pages. Instead, the accompanying article appeared on eonline.news, a domain closely resembling E! News’s legitimate eonline.com address. Registration records showed that the imitation domain had been created on 27 September 2026 — only two days before the story was published. The accompanying video also showed signs of synthetic production. Fact-checkers examining the material identified indications that AI tools had been used in the narration and audiovisual elements. The operation therefore did not simply invent a news story. It created an apparently credible media environment around it. 𝗧𝗵𝗲 𝗿𝗲𝗮𝗹 𝗰𝗼𝗺𝗽𝗮𝗻𝘆 𝗶𝗻𝘀𝗶𝗱𝗲 𝘁𝗵𝗲 𝗳𝗮𝗹𝘀𝗲 𝘀𝘁𝗼𝗿𝘆 The supposed buyer was also carefully selected. Film Heritage Inc. was not invented for the fabrication. The Pandora Papers previously documented a genuine historical connection between the Belize-registered company and Zelenskyy’s former business network. Leaked documents showed that Zelenskyy and his wife had held an interest in another offshore company through Film Heritage before changes were made to the ownership structure around his 2019 presidential campaign. That authentic history gave the new fabrication an additional layer of plausibility. The same company name has previously appeared in false narratives alleging extravagant purchases by Zelenskyy, including supposed luxury-property and casino acquisitions. Those stories were also unsupported by evidence. This illustrates a recurring feature of effective disinformation: not every component has to be false. A genuine company can be combined with a genuine trip, a genuine property and a genuine media brand to manufacture an event that never occurred. 𝗧𝗵𝗲 𝗠𝗮𝘁𝗿𝘆𝗼𝘀𝗵𝗸𝗮 𝗰𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝗼𝗻 Ukraine’s Center for Countering Disinformation assessed the operation as consistent with the Russian Matryoshka disinformation playbook. The technique strongly resembles previously documented Matryoshka activity: impersonating established Western media organisations, creating fabricated video reports and distributing them through coordinated or pro-Russian social-media networks. French authorities have documented Matryoshka since 2023 as a pro-Russian influence operation targeting media organisations, public figures and fact-checkers. Investigations have shown repeated use of counterfeit reports imitating major European and North American news brands. The Norwegian-estate story fits that pattern closely. The attribution nevertheless requires precision. Independent evidence establishes that the E! News report was fake, that a newly created imitation website was involved and that the story circulated through pro-Russian information channels. Publicly available forensic evidence does not yet identify a specific individual or technical operator who created this particular asset. It is therefore more accurate to describe the Matryoshka connection as a well-supported analytical attribution rather than a publicly proven chain of command. 𝗪𝗵𝗲𝗻 𝘁𝗵𝗲 𝘀𝗼𝘂𝗿𝗰𝗲 𝗯𝗲𝗰𝗼𝗺𝗲𝘀 𝘁𝗵𝗲 𝗱𝗲𝗲𝗽𝗳𝗮𝗸𝗲 The most important element of the operation is not really the $43 million figure. It is the construction of credibility around it. A genuine royal funeral supplied the timing. A genuine Norwegian estate supplied the location. A genuine offshore company supplied a documented connection to Zelenskyy. A counterfeit E! News website supplied apparent journalistic confirmation. Synthetic audiovisual material supplied what looked like additional evidence. Each element reinforced the others. This reflects a broader change in contemporary disinformation. The most sophisticated operations no longer rely exclusively on fabricating photographs, videos or statements. Increasingly, they fabricate the source that supposedly verified them. The deepfake is sometimes the entire newsroom! 𝗦𝗼𝘂𝗿𝗰𝗲𝘀 Lead Stories — investigation into the fake E! News report https://leadstories.com/hoax-alert/2026/10/fact-check-enews-did-not-publish-report-about-zelenskyy-buying-43-million-dollar-mansion-from-norways-royal-family.html Center for Countering Disinformation of Ukraine — Norwegian royal estate fabrication https://cpd.gov.ua/en/international-threats-en/europe/fake-about-zelenskyys-purchase-of-a-norwegian-royal-family-estate/ Ellinika Hoaxes — investigation and Norwegian government response https://www.ellinikahoaxes.gr/2026/10/09/agorase-o-zelenski-ektasi-240-stremmaton-apo-ti-vasiliki-oikogeneia-tis-norvigias-gia-43-ekatommyria-dolaria/ The Royal House of Norway — funeral of King Harald V https://www.royalcourt.no/news/the-funeral-of-king-harald-v The Royal House of Norway — Skaugum and the Royal Estates https://www.royalcourt.no/the-royal-court/the-departments-the-royal-court/the-royal-estates-and-parks President of Ukraine — Zelenskyy and First Lady attend King Harald V’s funeral https://www.president.gov.ua/en/news/prezident-ukrayini-ta-persha-ledi-vzyali-uchast-u-ceremoniyi-106293 OCCRP — Pandora Papers investigation into Zelenskyy’s offshore network https://www.occrp.org/en/project/the-pandora-papers/pandora-papers-reveal-offshore-holdings-of-ukrainian-president-and-his-inner-circle AFP Fact Check — previous false luxury-purchase narrative involving Film Heritage https://factcheck.afp.com/doc.afp.com.36PG6EC VIGINUM / SGDSN — Matryoshka technical report https://www.sgdsn.gouv.fr/files/files/20240611_NP_SGDSN_VIGINUM_Matriochka_EN_VF.pdf CheckFirst — Operation Overload / Matryoshka investigation https://checkfirst.network/operation-overload-an-ai-fuelled-escalation-of-the-kremlin-linked-propaganda-effort/ Keywords #DISINFORMED #Episode19 #Zelenskyy #Ukraine #Norway #Russia #RussianDisinformation #RussianInfluence #Matryoshka #OperationOverload #Disinformation #InfluenceOperations #InformationWarfare #FIMI #MediaImpersonation #FakeMedia #ClonedWebsite #FakeNewsroom #ENews #ArtificialIntelligence #AI #AIGeneratedContent #VoiceCloning #SyntheticMedia #Deepfake #SourceLaundering #NarrativeLaundering #FilmHeritage #PandoraPapers #Skaugum #NorwegianRoyalFamily #Propaganda #DigitalInfluence #FactChecking #VIGINUM #OSINT #MediaManipulation #WRLD

Tafouk TV – how three Sahel military governments are building a common information system Mali, Burkina Faso and Niger are no longer relying only on speeches, social media or their existing national broadcasters to shape the information environment around the Alliance of Sahel States. They are building a shared, permanent media infrastructure. At its centre is Tafouk TV, the confederal television channel of the AES, broadcasting from Bamako. Its creation was formally agreed by the three governments in December 2025, its governing structure was installed in 2026 and regular programming began in September. The project is explicitly presented by AES authorities as an instrument of “information sovereignty” and what Malian Foreign Minister Abdoulaye Diop has called “narrative sovereignty”. A television channel built by three military governments Tafouk TV is fundamentally different from a covert bot network or a collection of anonymous propaganda accounts. Its ownership and political purpose are public. It is an institutional broadcaster created by the governments of Mali, Burkina Faso and Niger, all currently led by military authorities. Malian government documents describe the channel as a common media instrument intended to strengthen communication across the confederation, promote regional identities and respond to what the AES sees as hostile narratives and disinformation. The project sits alongside Daandè Liptako, a shared radio service, and broader plans to develop common information structures across the three states. That institutional architecture is important. A social-media influence network can disappear when accounts are suspended. A television channel, radio network and future news agency can develop journalists, archives, correspondents, distribution agreements and continuous daily output. The result is not a temporary campaign but potentially a long-term information system. Russia enters through RT The Russian connection is also public. In July 2026, Tafouk TV signed a cooperation agreement with RT, the Russian state-funded international broadcaster. The memorandum was signed by Tafouk TV director-general Salif Sanogo and Natalia Lebedeva, director of RT en français. It provides for content exchange, expertise-sharing and joint coverage of major events in Russia and the Sahel. RT described itself as Tafouk TV's first international partner. This makes Tafouk part of a much broader geopolitical realignment in the Sahel. Mali, Burkina Faso and Niger have reduced cooperation with France and other Western partners while deepening political, diplomatic and security relations with Moscow. But the distinction is important: there is no public evidence that Russia owns Tafouk TV, finances the entire channel or directly controls its editorial decisions. The most precise description is therefore a state-owned AES broadcaster with a formal partnership with Russian state media, rather than a Russian-controlled television station. The battle over the narrative AES officials make little attempt to hide the strategic role they expect the channel to play. During a visit to Tafouk TV shortly after regular broadcasting began, Abdoulaye Diop described communication as another strategic front alongside defence, diplomacy and development. He spoke of a geopolitical environment characterised by a “war of narratives” and said the AES needed its own media to defend its interests and strengthen its narrative sovereignty. Mali's government has similarly described Tafouk TV as an instrument of information sovereignty, regional cohesion and Sahelian identity. The first governing-board meetings emphasised digital distribution, national languages and the creation of a new generation of Sahelian journalists capable of carrying the confederation's message at home and abroad. Early reporting examined by the Financial Times found patriotic programming, interviews with officials and positive reporting from conflict zones. The newspaper described the project in the context of the three governments' attempts to challenge Western media narratives and strengthen their legitimacy while facing continuing jihadist insurgencies. Why this is not simply another disinformation operation It is important not to use propaganda and disinformation as synonyms. A state broadcaster can systematically promote the government's preferred interpretation of events without every story being false.Tafouk TV's significance therefore lies less in individual fabricated claims than in the information architecture being created around it: three governments operating a shared broadcaster, common radio infrastructure and potentially other confederal media, while cooperating with Russia's international state-media system. This development is taking place while independent media conditions across the three countries are deteriorating. Reporters Without Borders ranked Burkina Faso 110th, Niger 120th and Mali 121st in its 2026 World Press Freedom Index, pointing to arbitrary detentions, restrictions on journalists and suspensions of media outlets across the AES states. That context changes the importance of Tafouk TV. A new state broadcaster entering a diverse and competitive media environment is one thing. A common government-controlled broadcaster expanding while alternative sources face restrictions is another. From influence campaigns to permanent infrastructure Tafouk TV illustrates an important evolution in the information contest in the Sahel. Russian and pro-Russian influence in Africa has often relied on social-media networks, influencers, fake experts, local partners or apparently independent media outlets. Tafouk represents something more durable: formal state institutions can now carry many of the same geopolitical narratives openly and continuously. The audience figures are not yet sufficiently established to demonstrate how influential Tafouk TV will become. It may eventually reach far fewer people than some viral online operations, or its television, radio and digital infrastructure may give it far greater long-term significance. Sources Government of Mali — Tafouk TV governing board and strategic mission https://gouvernement.ml/conseil-dadministration-de-tafouk-tv-installe-a-bamako-le-ministre-alhamdou-ag-ilyene-trace-les-orientations-strategiques-de-la-chaine-confederale/ Government of Mali — Abdoulaye Diop and “narrative sovereignty” https://gouvernement.ml/communication-confederale-de-laes-sem-abdoulaye-diop-a-la-decouverte-de-tafouk/ Government of Mali — creation of Tafouk TV and Daandè Liptako https://gouvernement.ml/conseil-national-de-la-transition-le-cnt-adopte-deux-textes-majeurs-relatifs-a-la-creation-de-tafouk-tv-et-de-la-radio-daande-liptako/ Government of Mali — ratification and information-sovereignty objectives https://gouvernement.ml/2026/05/30/ Government of Mali — Tafouk TV board and Prime Minister Abdoulaye Maïga https://gouvernement.ml/television-de-lalliance-des-etats-du-sahel-tafouk-tv-les-membres-du-conseil-dadministration-prennent-les-orientations-et-conseils-du-premier-ministre-abdoulaye-maiga/ RT en français — cooperation agreement between RT and Tafouk TV https://rtenfrance.tv/news/136036-rt-devient-premier-partenaire-international-tafouk-tv-chaine-commune-aes APA News — Tafouk TV and Daandè Liptako common AES media infrastructure https://fr.apanews.net/communication/tafouk-tv-et-daande-liptako-le-mali-consolide-les-medias-communs-de-laes/ APA News — Tafouk TV begins regular programming https://fr.apanews.net/communication/aes-tafouk-tv-demarre-ses-programmes/ Financial Times — Sahel juntas launch Tafouk TV with Russian backing https://www.ft.com/content/259b49a1-8eda-4e8d-84c7-45323988b07b Reporters Without Borders — 2026 Press Freedom Index: Africa https://rsf.org/en/classement/2026/afrique Keywords #DISINFORMED #Episode18 #TafoukTV #AES #AllianceOfSahelStates #Sahel #Mali #BurkinaFaso #Niger #Russia #RussianInfluence #RussianMedia #RT #RussiaToday #StateMedia #StatePropaganda #InformationSovereignty #NarrativeSovereignty #InformationWarfare #InfluenceOperations #StrategicCommunication #MediaInfluence #MediaControl #Propaganda #Disinformation #ForeignInfluence #FIMI #Africa #WestAfrica #MilitaryGovernment #MilitaryRule #SahelMedia #DaandeLiptako #MediaInfrastructure #NarrativeControl #PressFreedom #MediaFreedom #Geopolitics #OSINT #WRLD

Mateusz Gołdak wrote that the addressee mocked those who pointed out that he was wrong the day before, and the next day he apologized. According to Gołdak, he should apologize under every such post. He added that unlike the "little ones from Osintopolo," the addressee has a large reach, which means that the false information disseminated by him spreads far. #przeprosiny #fejk #media (translated)

Paweł Sokala compared Gawkowski's statements about "greater activity of bots" and Siemoniak's about its decrease. He also accused the person citing ABW of having used a chart published by OSINT-polo on X earlier that same morning, which Sokala described as unreliable. He wrote that such actions mocked the institutions responsible for Poland's security. https://t.co/5asD3B6CHx #bezpieczeństwo #boty #Polska (translated)

Dr. Coolfonpl wrote that Ukraine has already won at the strategic level. He accompanied the post with laughing emojis, and OSINTPolo referred to him as a guru and stated that he removed false information about bots and corrected it. https://t.co/s3B6fsdhl9 #Ukraina #strategia #OSINT (translated)

Operation Dark Clark – Russia built a real organisation around a false identity Most influence operations create fake people, fake websites or fake news stories. Operation Dark Clark appears to have gone considerably further: Russian operators built what looked like a functioning research organisation in Latin America, employed real people to produce genuine research and concealed from those employees who was ultimately directing their work. OpenAI disclosed the operation on 8 October after banning a cluster of accounts originating in Russia. The actors used ChatGPT while targeting countries across Latin America, principally to damage Ukraine’s reputation, manipulate domestic political debates and manage a self-described research organisation called the Social Research Center, or SRC. OpenAI assessed Dark Clark as Category Five on the six-level Breakout Scale, the first operation it has disrupted since beginning its influence-operation reporting to reach that level. A front organisation with real employees The SRC presented itself as a research platform studying subjects including Latin America’s relationship with India and the Indian diaspora. OpenAI found more than 60 articles on its website, most of them apparently original rather than plagiarised. Internal reports produced by the Russian operators discussed hiring, dismissals, salary scales, staffing and unfinished research projects, strongly suggesting that the operators controlled the organisation rather than merely collaborating with it. At the centre of the structure was “Mia Clark”, a fictitious identity reportedly used to manage social-media activity and communicate with staff. According to OpenAI, the available evidence indicates that employees working for SRC in Latin America were probably unaware that the organisation was being directed by Russian actors. They interviewed experts, conducted research and wrote papers in what appears to have been good faith. The deception therefore existed primarily at the organisational level: much of the work was real, but the identity and strategic purpose of the institution commissioning it were not. OpenAI This is one reason Dark Clark differs from the familiar model of a troll farm. A reader encountering an SRC paper might be looking at research genuinely written by a Latin American employee based on genuine interviews. The manipulation lies further upstream, in who built the institution, selected its direction and controlled its infrastructure. From forged emails to real events The operation also appears to have attempted something more ambitious than online persuasion: inducing real people to produce events that could later be turned into propaganda. In May 2026, according to the operators’ internal reports, they created an email address impersonating Lima’s regional education authorities and instructed schools to organise activities about Ukraine for a cultural-diversity event. The instructions included references to Stepan Bandera, whose historical legacy remains particularly contentious in Poland and parts of Eastern Europe. The operators claimed that some schools complied, replied to the false address and sent photographs of the events. OpenAI could not independently verify every claim contained in the operators’ reports. It did, however, find Peruvian reporting matching the story, followed by publications in Poland and an English-language outlet in Hungary. Some coverage included comments from a Polish MEP calling for people displaying what he described as anti-Polish attitudes to be declared persona non grata. OpenAI therefore concluded that the fabricated starting point appears to have entered genuine political debate across national borders. The mechanism is unusually effective because the final photographs need not themselves be fabricated. If people can be tricked into staging a real event on the basis of a forged instruction, the operation creates authentic visual evidence of something that was artificially initiated. The same method in Ecuador and Bolivia Dark Clark’s internal reports describe similar efforts elsewhere. In Ecuador, the operators claimed they used a fake education email to encourage schools to stage ceremonies involving President Daniel Noboa and Erik Prince, the former head of Blackwater. Ecuadorian media subsequently covered a matching controversy, and the country’s education minister issued a detailed denial. Other Ecuador-focused material included fabricated audio attributed to Ukraine’s consul and a false television report alleging that Noboa’s government was recruiting Ecuadorians to fight in Ukraine. Local fact-checker Lupa found that the supposed Teleamazonas report had never been broadcast, that images had been taken from Instagram, that the audio was AI-generated and that a company named in a supposed recruitment contract did not exist in Ecuador’s corporate registry. In Bolivia, an internal report described a fake audio recording supposedly made by an employee of state water company EPSAS during anti-government protests. It claimed that water supplies to La Paz would be cut and a state of emergency declared. The allegation produced a fact-check and an official denial. OpenAI says the operators explicitly described their objective as worsening the political crisis surrounding the demonstrations. Possible links to the post-Wagner influence machine Dark Clark did not emerge in a vacuum. The operators repeatedly asked ChatGPT about Politology and La Compania, names associated in previous investigations with the Russian influence apparatus that developed from structures once connected to Yevgeny Prigozhin. Forbidden Stories and its partners obtained 1,431 pages of internal documents describing a network known as “The Company”, which they reported had grown to almost 100 operatives and was conducting influence projects across roughly 30 Global South countries. Their investigation found that the organisation moved under the supervision of Russia’s Foreign Intelligence Service, the SVR, after Prigozhin’s death. Its documented budget for ten months of activity in 2024 was approximately €7.3 million. Two older Argentina campaigns claimed in Dark Clark’s internal reports — a false story about Javier Milei buying Cartier collars for his dogs and the staging of anti-Milei graffiti — had already been independently attributed by investigative journalists to Politology/La Compania. That is significant corroboration, but it is not enough to prove that every Dark Clark activity was run by the same organisational structure. AI was the back office, not the mastermind Perhaps the most important finding concerns artificial intelligence itself. In most documented cases, the Russians were not using ChatGPT to generate the propaganda seen by the public. Their principal use was administrative: drafting reports for an unknown superior, summarising operations, translating material and recording the supposed success of campaigns. Those reports also expose a weakness in the operators’ own measurement. OpenAI found instances in which they tried to claim credit for developments they had probably not caused, suggesting that they were not only attempting to manipulate Latin American audiences but also presenting an inflated picture of their effectiveness to whoever was supervising them. Dark Clark nevertheless broke further into the real world than any influence operation OpenAI had previously disrupted. Under the Brookings framework, Category Five means that an operation has escaped its original network and been amplified by high-profile individuals such as politicians. Dark Clark crossed that threshold because fabricated narratives appear to have provoked governmental denials, mainstream reporting and political comment in several countries. Its most important innovation was therefore not a particularly convincing deepfake. It was the construction of a partly genuine institution around a concealed foreign controller. The research could be real. The employees could be real. The interviews could be real. What was false was who they were ultimately working for. Sources OpenAI — Disrupting AI-enabled “false front” operations https://openai.com/index/disrupting-ai-enabled-false-front-operations/ Forbidden Stories — Propaganda Machine: Russia’s foreign influence strategy across three continents https://forbiddenstories.org/propaganda-machine-secret-documents-reveal-russias-foreign-influence-strategy-across-three-continents/ Forbidden Stories — Ghost Journalists, Cash and Kremlin Scripts: Argentina https://forbiddenstories.org/ghost-journalists-cash-and-kremlin-scripts-how-russian-operatives-tried-to-influence-argentinian-media/ openDemocracy — Russian influence operation in Bolivia https://www.opendemocracy.net/en/russia-bolivia-south-america-putin-evo-morales-wagner-prigozhin-covert-operations-propaganda-disinformation-foreign-interference/ Lupa Media — Fake Teleamazonas report about recruiting Ecuadorians for Ukraine https://lupa.com.ec/verificaciones/noboa-mercenarios-ucrania-ecuador/ Brookings Institution — The Breakout Scale https://www.brookings.edu/articles/the-breakout-scale-measuring-the-impact-of-influence-operations/ Keywords: #DISINFORMED #Episode17 #OperationDarkClark #DarkClark #Russia #LatinAmerica #RussianInfluence #RussianDisinformation #Disinformation #InformationWarfare #InfluenceOperations #ForeignInterference #FIMI #FalseFront #FrontOrganisation #FakeInstitution #SocialResearchCenter #SRC #ArtificialIntelligence #AI #GenerativeAI #ChatGPT #OpenAI #NarrativeManipulation #SourceLaundering #InstitutionalManipulation #ForgedDocuments #FakeAudio #PoliticalInfluence #CovertInfluence #Peru #Ecuador #Bolivia #Argentina #Ukraine #Politology #LaCompania #TheCompany #SVR #WagnerLegacy #PropagandaMachine #GlobalSouth #BreakoutScale #OSINT #MediaManipulation #WRLD

The tanker MINERVA ZEN, loaded with Russian diesel, left St. Petersburg on September 22 and, according to the route tracked by OSINT analysts, was directed towards the east coast of the United States from the very beginning - quite some time before Donald Trump officially announced his deal with Vladimir Putin. #РускиДизел #ТръмпПутин #ВойнаВУкрайна (translated)

Russia’s war propaganda gets a soundtrack – how AI-generated songs reached global streaming platforms Russian war propaganda is no longer confined to television broadcasts, Telegram channels or political videos. A study by the Ukrainian threat-intelligence organisation Terrecon has identified 981 songs combining signs of AI generation with pro-Russian military narratives, distributed through an ecosystem that reaches YouTube, Spotify, Apple Music, Deezer and SoundCloud. The songs range from sentimental ballads to rock and heavy metal. Their recurring themes are familiar from conventional Russian wartime propaganda: the heroisation of Russian soldiers, romanticisation of the war, mobilisation, the “Russian world”, commemoration of fallen troops and attacks on Ukraine and its armed forces. Some contain derogatory or dehumanising references to Ukrainians. What is new is not necessarily the message, but the production and distribution model: generative AI allows propagandistic music to be produced rapidly, cheaply and in quantities that would previously have required musicians, studios and producers. Nearly 1,000 tracks identified Terrecon examined 3,725 tracks collected from YouTube, YouTube Music, SoundCloud and the AI music platform Suno. After manual review, researchers classified 981 as showing both indications of AI generation and pro-Russian war propaganda. In 681 tracks they identified 728 propaganda-related keywords or phrases. The largest category was the glorification of the Russian military, followed by romanticised treatment of Moscow’s so-called “special military operation”, mobilisation appeals, narratives about the “Russian world”, and the cult of fallen soldiers and the state. The reach was not merely theoretical. Listening or viewing statistics were available for 608 of the identified tracks; together they had accumulated 86.8 million plays and views, according to Terrecon. A smaller group of 13 high-performing songs accounted for more than 53 million YouTube views and more than 67 million when YouTube Music was included. Among the better-known examples is “Power of Artillery”, a Russian-language rock song praising artillery weapons that passed two million views on YouTube. Most of the tracks for which publication dates could be established appeared after 2024, broadly coinciding with the rapid expansion of consumer AI music generators such as Suno and Udio. That correlation does not prove that AI alone caused the increase, but it illustrates how drastically the economics of production have changed. A propaganda song for as little as $11 Terrecon also tested how difficult it would be to commission such material. Researchers approached 25 creators producing AI-assisted militaristic music; 15 agreed to take commissions. Prices ranged from approximately $11 to $330, while delivery times ranged from two hours to three days. According to Terrecon, some were prepared to produce highly aggressive anti-Ukrainian material, including content intended for audiences involving children from occupied Ukrainian territories. Some creators used Russian intermediary services that provided access to Western AI tools such as Suno and Udio despite restrictions. The researchers then tested several AI generators themselves. Across 40 prompts submitted to Suno, Udio, Mureka, Google Flow Music and ElevenLabs, 25 resulted in successful generations, while safeguards were circumvented in 15 cases. Terrecon reported that four of the five services tested produced Russian-language material containing wartime narratives, although technical problems prevented comparable testing on some systems. In one Udio experiment, the researchers said the model itself introduced more explicit violent language than had appeared in the original promp These tests do not demonstrate that the commercial platforms knowingly support Russian propaganda. They show something narrower: existing safeguards can be inconsistent when political messaging is packaged as music. From generation to Spotify The distribution experiment may be the most revealing part of Terrecon’s research. The team deliberately uploaded test tracks containing explicit hostile language to YouTube, SoundCloud, Spotify and Deezer. Terrecon says none was blocked during the experiment. On SoundCloud, researchers used an account identifying its location as Moscow, disclosed the use of AI and added markers including references to the Russian military and the war. The platform accepted the upload and subsequently offered paid promotional and distribution tools. This does not prove that streaming recommendation systems systematically promote pro-war music. There is currently insufficient public evidence to make that claim. It does demonstrate that material can enter the same commercial distribution infrastructure as ordinary music and, once there, potentially benefit from playlists, searches, sharing and recommendation mechanisms available to other releases. That distinction is important. Propaganda no longer has to announce itself as political communication. On a streaming platform it can look like another song. Culture as a delivery mechanism Music has always been used in wartime propaganda. What generative AI changes is scale. Instead of investing heavily in a limited number of patriotic performers or officially commissioned productions, creators can generate variations across styles, audiences and emotional registers at very low cost. Terrecon found material ranging from war rock to sentimental songs and content styled for younger audiences. Some creators also experimented with cloned celebrity voices and stylistic imitation of established musicians. The format also offers a different relationship with the audience. A political video asks a viewer to consume an argument. Music can accompany commuting, exercise or entertainment and may be encountered outside explicitly political spaces. This does not automatically make it more persuasive, and Terrecon’s research does not establish measurable effects on political attitudes. It does, however, place wartime narratives inside a cultural environment where users may not initially perceive themselves as consuming political messaging. An ecosystem, not a proven Kremlin command structure The strongest evidence supports describing this as a growing AI-assisted pro-Russian propaganda-music ecosystem, not a single operation controlled from Moscow. Terrecon did not establish that the Russian government created, financed or coordinated all 981 tracks. Reporting on the study likewise notes that the extent of direct state involvement remains unclear. There is broader evidence that the Russian state finances cultural projects and digital content supporting the war, including through state-backed funding bodies. That context matters, but it does not allow individual songs in Terrecon’s dataset to be attributed to the Kremlin without additional evidence. The significance of the case lies elsewhere. AI has reduced the cost of producing ideological content, intermediaries can help creators access generation tools, and global platforms can provide distribution. The result is a pipeline in which wartime propaganda no longer has to resemble propaganda at all. It can simply appear in a playlist. Sources Terrecon / Ukrainska Pravda — Daria Verbytska on the research https://www.pravda.com.ua/columns/2026/10/05/8056229/ Suspilne Culture — detailed breakdown of Terrecon findings https://suspilne.media/culture/1417933-rosijsku-voennu-propagandu-maskuut-pid-anime-karaoke-ta-rok-doslidzenna-si-pisen-vid-terrecon/ The Insider — AI-generated Russian war propaganda music https://theins.ru/news/297839 Institute of Mass Information — summary of New York Times reporting https://imi.org.ua/en/news/doslidzhennya-rf-masovo-stvoryu%D1%94-propagandistski-pisni-za-dopomogoyu-shi The Bridge Media — AI-generated songs and Russian military propaganda https://thebridgemedia.com.ua/en/ai-generated-songs-russian-military-propaganda/ Center for Strategic Communication — cost and production of AI propaganda music https://spravdi.org/propaganda-za-11-yak-rosiya-shtampuye-shi-pisni-z-miljonamy-prosluhovuvan/ Times of India — AI-generated Russian war songs https://timesofindia.indiatimes.com/world/europe/ai-sings-russias-war-story-inside-the-rise-of-generative-songs-about-ukraine-conflict/articleshow/134650594.cms EU Council / EUR-Lex — Presidential Foundation for Cultural Initiatives https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026D1351 Human Rights Watch — Russian state funding of digital and patriotic content https://www.hrw.org/report/2025/07/30/disrupted-throttled-and-blocked/state-censorship-control-and-increasing-isolation #DISINFORMED #Episode16 #Russia #Ukraine #RussianPropaganda #WarPropaganda #MusicPropaganda #AIMusic #ArtificialIntelligence #AI #GenerativeAI #SyntheticMedia #AIPropaganda #Disinformation #InformationWarfare #InfluenceOperations #CulturalPropaganda #DigitalInfluence #NarrativeManipulation #PropagandaMusic #StreamingPlatforms #Spotify #AppleMusic #YouTube #YouTubeMusic #Deezer #SoundCloud #Suno #Udio #RussianWorld #RusskiyMir #MilitaryPropaganda #WarNarratives #Mobilisation #AlgorithmicDistribution #RecommendationAlgorithms #MusicStreaming #PlatformManipulation #Terrecon #OSINT #MediaManipulation #WRLD

Nigeria – how pro-Russian influence networks sell military rule as the answer When Nigerians took to the streets in August 2024 to protest soaring living costs and frustration with government, some demonstrations acquired an unexpected symbol: the Russian flag. In Kano, Kaduna and other northern cities, protesters were filmed carrying Russian colours and calling for Moscow’s intervention. Some demanded a military takeover. What initially looked like an unusual expression of anger has since become part of a much larger picture. A September 2026 assessment by the Africa Center for Strategic Studies describes Nigeria as a major target of overlapping foreign information operations, with Russia the most active external actor in its information space. The report does not identify a single centrally controlled campaign. Instead, it maps an ecosystem in which genuine dissatisfaction over insecurity, corruption and living standards is repeatedly redirected towards a broader proposition: democratic government has failed, while the military-led regimes of the Sahel offer a more effective alternative. Turning a real protest into a pro-Russian message The clearest example emerged during the 2024 #EndBadGovernance protests. Nigerian investigative reporting found that a Kano-based TikTok influencer with more than 100,000 followers had been paid through a Telegram channel associated with African Initiative, a Moscow-based media operation linked by researchers to Russian influence activity in Africa. The influencer said the channel supplied photographs, videos and talking points for redistribution on TikTok and Instagram. Among the messages provided were phrases such as “Putin please come and save Nigeria” and “The army is the answer for Nigeria”. Influencers were encouraged to use Hausa-language hashtags including #Zangazanga – “protest” – alongside references to Putin and Russia. Investigators identified 38 accounts circulating similar pro-Russian and pro-military narratives during the demonstrations. Russian flags subsequently appeared among protesters in several northern cities. This does not mean the protests themselves were created by Russia. They were driven by genuine economic and political grievances, and Nigerian protesters gave different reasons for carrying Russian flags. The important feature of the influence activity was precisely that it did not need to manufacture the original anger. It could attach a geopolitical message to an existing domestic crisis. From frustration to the idea of military government The narrative fits a wider pattern seen across West Africa. Russia has developed close relations with the military governments of Mali, Burkina Faso and Niger, while pro-Russian media ecosystems routinely portray those states as examples of sovereignty, stability and resistance to Western influence. Nigeria, by contrast, has remained under constitutional civilian government since 1999. Africa Center researchers say information networks targeting Nigerians increasingly contrast these two models. Recurring messages depict elections as wasteful or predetermined, civilian institutions as incapable of protecting citizens and military governments as more decisive on security and development. Some content portrays the Sahelian juntas as delivering better roads, lower prices and stronger security even where available evidence points to continuing or worsening instability. Language is central to the strategy. Hausa is spoken across northern Nigeria and neighbouring Niger, allowing political narratives to travel across borders that are far less important online than they are on maps. HumAngle documented efforts involving Nigerien state-linked actors to cultivate Hausa-speaking journalists and distribute material favourable to Niger’s junta and hostile to France and Western influence. The Russian and Sahelian-junta information ecosystems are not identical, but their narratives frequently reinforce one another. Fake journalists inside real Nigerian media The campaign environment extends beyond social media. A 2026 investigation by Graphika and Code for Africa identified 44 ghost reporters and fake experts whose identities were used to place Russia-aligned narratives in African media. Thirty-eight were assessed with high confidence to be fabricated. Their articles or quotations appeared across 138 websites and were amplified by at least 113 Facebook accounts and Pages. Nigeria was one of the most heavily targeted countries. According to the Africa Center’s analysis of the research, Daily Post Nigeria carried 39 articles involving 14 identified ghost authors. Once published by a genuine Nigerian outlet, such material could then be cited by other websites, social-media accounts or even Russian official channels as though it had originated independently in Africa. This is information laundering rather than simple propaganda: the most valuable asset being borrowed is the credibility of the local newsroom. Generative AI added another layer. OpenAI and Meta separately disrupted a Russia-origin network that produced Africa-focused political content and operated Facebook Pages posing as local media organisations. One fabricated commentator, “Dr Manuel Godsin”, was presented as a European-trained geopolitical expert although investigators found no evidence supporting his academic biography. ChatGPT had been used to generate articles under the persona’s name, while Meta removed 37 Facebook accounts and 29 Pages connected to the broader network. Different networks, similar strategic direction It would be misleading to merge all these activities into a single Russian command structure. The African Initiative-linked influencer campaign, the ghost-reporter network and the AI-enabled operation disrupted by OpenAI and Meta were uncovered separately and used different infrastructure. Public evidence does not demonstrate that every actor reported to the same organisation. What connects them is a recurring set of themes and methods: portraying Western partnerships as exploitative, presenting Russia as an alternative security partner, amplifying failures of civilian government, and giving military-led rule greater legitimacy. Investigative reporting on leaked Russian documents has meanwhile described a much wider influence apparatus operating across Africa, involving political consultants, paid journalists, influencers and locally tailored campaigns intended to reduce Western influence and expand Moscow’s position. The underlying technique is less about inventing dissatisfaction than redirecting it. Nigeria faces real security threats, economic pressure and public frustration. Influence operators do not need to persuade Nigerians that those problems exist. They need only influence the explanation for why they exist – and which political model appears to offer the answer. That is what makes the Nigerian case significant. The most effective propaganda does not necessarily introduce a completely false reality. It takes a real crisis and changes where the audience is encouraged to look for the solution. Sources Africa Center for Strategic Studies — The Raging Information Battle in Nigeria https://africacenter.org/spotlight/the-raging-information-battle-in-nigeria/ Graphika — Umbrae Ex Machina https://www.graphika.com/reports/umbrae-ex-machina OpenAI — Operation “No Bell” https://openai.com/index/disrupting-malicious-uses-of-ai-no-bell/ TheCable — Ghost reporters in African media https://www.thecable.ng/ghost-reporters-how-fabricated-african-voices-carried-pro-russia-narratives/ HumAngle — Nigeria Is Facing an Information War in Its Own Language https://www.humanglemedia.com/nigeria-is-facing-an-information-war-in-its-own-language DAIDAC / CJID — Russian influence during #EndBadGovernance https://daidac.thecjid.org/how-telegram-tiktok-aided-russian-disinformation-that-led-to-incarceration-of-nigerian-minors/ FactCheckHub — How Nigeria’s hunger protest took a radical turn https://factcheckhub.com/from-economic-protests-to-coup-agitation-how-nigerias-hunger-march-took-a-radical-turn/ News24 — Fake Kremlin-linked analyst planted stories in African media https://www.news24.com/southafrica/news/ai-expert-exposed-fake-kremlin-linked-analyst-planted-stories-in-african-media-20260318-0560 Vanguard — AI ‘expert’ exposed https://www.vanguardngr.com/2026/03/ai-expert-exposed-fake-kremlin-linked-analyst-planted-stories-in-african-media/ Africa Confidential — How Moscow wages social media war https://www.africa-confidential.com/article/id/15961/how-moscow-wages-social-media-war Keywords #DISINFORMED #Episode15 #Nigeria #Russia #RussianInfluence #RussianDisinformation #Africa #WestAfrica #Disinformation #InformationWarfare #InfluenceOperations #ForeignInterference #FIMI #Propaganda #MilitaryRule #MilitaryGovernment #Democracy #PoliticalManipulation #NarrativeManipulation #AfricanInitiative #EndBadGovernance #Hausa #LocalInfluencers #GhostReporters #FakeExperts #ArtificialIntelligence #AI #AIPersonas #SyntheticMedia #AIPropaganda #Astroturfing #SocialMediaManipulation #Telegram #TikTok #DigitalInfluence #SourceLaundering #NarrativeLaundering #MediaManipulation #Sahel #Geopolitics #OSINT #WRLD

Brazil’s synthetic voters – when AI manufactures public opinion They look like ordinary street interviews. A reporter approaches a passer-by in a Brazilian square and asks a simple question: who will you vote for? A young voter explains why Luiz Inácio Lula da Silva deserves another term. An elderly woman says Brazil needs Flávio Bolsonaro because he represents political renewal and greater security. The locations look plausible, the microphones are visible and the answers sound much like the brief political opinions heard in television vox pops around the world. None of the people are real. Ahead of Brazil’s presidential election on 4 October, fact-checking organisation Aos Fatos identified at least 50 TikTok videos in which artificial intelligence was used to manufacture voters, reporters and apparently spontaneous political interviews. Together, the videos had accumulated around 7.4 million views by mid-August. Some promoted Lula, others Flávio Bolsonaro, while another group used synthetic characters to ridicule or stereotype supporters of one side. Aos Fatos found no apparent evidence linking the accounts producing the videos to either presidential campaign. The opinion poll that never took place The format is important. These were not conventional deepfakes in which a recognisable politician is made to say something he never said. Instead, the creators reproduced the visual language of the vox pop – the short street interview used by broadcasters and social-media creators to illustrate what ordinary people supposedly think. In pro-Lula videos, synthetic voters described themselves as beneficiaries of social programmes or credited the president with improving their lives. In videos supporting Flávio Bolsonaro, artificial interviewees associated him with political renewal, public security and fighting corruption. Other clips were openly hostile: AI-generated characters presented as poor or living in parts of Brazil’s north-east were shown in dirty clothes or run-down surroundings, declaring support for Lula because they supposedly preferred welfare payments to work. The deception is therefore subtler than fabricating a candidate’s statement. It manufactures something that political communication normally treats as evidence of public sentiment. A real vox pop may be unscientific, but the people interviewed at least exist. These videos created the appearance that identifiable social groups – young people, pensioners, welfare recipients or residents of particular regions – were spontaneously expressing political preferences when no such encounters had taken place. An electoral-law specialist interviewed by Aos Fatos described the technique as the fabrication of a “social fact that never occurred”. That captures the central innovation: AI is being used not merely to falsify political speech, but to manufacture the impression of grassroots opinion. Fifty videos, but not one proven network The available evidence does not support describing the 50 posts as a centrally controlled influence operation. Aos Fatos located them through TikTok searches and recommendations produced by the platform itself, then examined the accounts responsible for publication. Most had relatively small individual audiences, although their combined reach was substantial. The first examples identified by the investigation appeared as early as March 2026. Activity increased in June and was concentrated particularly in July and the first half of August as Brazil’s election calendar intensified. Some accounts specialised in AI-generated videos generally, including fabricated podcast-style material. Others were explicitly political or supportive of a candidate, but Aos Fatos found no apparent links between those profiles and the official Lula or Bolsonaro campaigns. That distinction is essential. The evidence demonstrates a common technique and a shared political environment, not a single command structure. Some creators may have been motivated by ideology, others by engagement or monetisation. Publicly available evidence does not establish who commissioned the individual videos or whether any coordination existed between the accounts. This decentralised model also creates a different enforcement problem from a traditional bot network. There may be no headquarters to expose and no infrastructure whose removal disables the entire operation. The format itself can be copied by anyone with access to inexpensive generative-video tools. When the algorithm mixes real and synthetic citizens Aos Fatos documented another important feature of the phenomenon: TikTok’s recommendation system placed AI-generated interviews alongside genuine street interviews. For a user scrolling quickly through the platform, the transition between an authentic citizen and an entirely fabricated one could therefore be almost invisible. In 18 per cent of the 50 videos analysed, there was no indication that the people shown had been generated using AI. After Aos Fatos provided TikTok with the videos, the company said it had removed all of them for violating its rules on edited and AI-generated media. TikTok said its policies require creators to identify synthetic content and prohibit manipulated media capable of misleading users about matters of public importance or impersonating genuine journalistic material. The issue extends beyond one platform. Factchequeado’s review of Brazil’s 2026 election campaign found that synthetic endorsements and other deepfakes had become one of the most visible forms of AI-assisted electoral misinformation, alongside fabricated candidate statements and invented scenes. Brazil already had rules for synthetic politics Brazil entered the campaign with unusually detailed electoral rules governing artificial intelligence. The Superior Electoral Court, the TSE, requires electoral propaganda using synthetic multimedia to disclose clearly that AI was used. More importantly for the fake-voter videos, its rules prohibit synthetic audio or video used to favour or harm a candidacy when it creates or alters the image or voice of a living, deceased or fictitious person. The difficulty is attribution and enforcement. When a synthetic video is published by an official campaign, responsibility can be relatively straightforward to investigate. When it comes from an apparently independent account with no demonstrated relationship to a candidate, lawyers interviewed by Aos Fatos said responsibility is more likely to fall on the individual creator, while imposing electoral sanctions on a campaign would require evidence of a connection. For the final 72 hours before the election and the 24 hours following it, the TSE has imposed additional restrictions on newly published or republished synthetic material involving candidates or public figures, reflecting the particular difficulty of correcting fabricated content immediately before voting. From deepfake politicians to synthetic electorates The Brazilian case illustrates a broader change in political manipulation. The first generation of electoral deepfakes concentrated on famous people: make a politician appear to say something damaging, or fabricate an endorsement from a celebrity. Synthetic vox pops reverse the perspective. The politician can remain completely authentic; it is the electorate around the politician that is fabricated. That changes the psychological proposition of the message. Instead of saying the candidate believes this, the video suggests people like you believe this. Age, clothing, accent, neighbourhood and social class can all be generated to construct an artificial constituency around almost any political claim. There is no evidence that the 50 Brazilian videos identified by Aos Fatos constitute a single centrally directed campaign, nor evidence that they changed voting intentions. What they demonstrate is a technique whose barrier to entry has become extremely low. AI no longer needs to forge the politician. #DISINFORMED #Episode14 #Brazil #BrazilElection2026 #Elections #ElectionDisinformation #ArtificialIntelligence #AI #GenerativeAI #SyntheticVoters #SyntheticMedia #AIAvatars #AIGeneratedVideo #VoxPop #FakeInterviews #Astroturfing #AIPropaganda #PoliticalDisinformation #InfluenceOperations #InformationWarfare #SocialMediaManipulation #TikTok #PublicOpinion #ManufacturedConsent #SyntheticPublicOpinion #DigitalInfluence #Deepfakes #ElectionIntegrity #TSE #AosFatos #FactChecking #OSINT #MediaManipulation #WRLD (translated)

We will see each other tomorrow - Shmoo turned to Sławek, accusing him of outdated military knowledge and using derogatory terms against him. He listed tasks that — as he wrote — women successfully perform on the modern battlefield: piloting helicopters, operating drones, actions in cyberspace and electronic warfare, sniper work, operating anti-aircraft systems and radars, logistics, field medicine, and OSINT intelligence analysis. The author stated that war does not differ by gender, and women serve with modern equipment, while Sławek from his safe office asks — in his opinion — questions insulting to human intelligence. #wojskowość #kobiety #technologia (translated)

Lazz reacted to the Tu-95MS aircraft crash in the Amur region and stated that there were eight crew members on board, including two lieutenant colonels and two majors. According to OSINT analysts he cited, at least three of the victims were involved in the preparation and organization of missile attacks on Ukraine, as well as in issuing and carrying out orders to launch missiles at cities and civilian infrastructure. The author labeled them as war criminals and expressed satisfaction over their deaths. #válečnízkoci #Ukrajina #vojenskáhistorie (translated)

Disinformation for hire – the network of 70 fake newsrooms sold as a service The websites looked local. Naija Pulse appeared to cover Nigeria, Echo Berlin Germany, The British Daily Britain, Fifty States the United States and Commonwealth Post Australia. Each had its own branding, articles, supposed journalists and matching social-media presence. Taken individually, they resembled small independent news outlets. According to Anthropic, however, they were parts of a single commercial influence network spanning six continents. Anthropic’s September 2026 threat report identifies the operation as GTG-54002, a commercial “influence-as-a-service” network that used Claude to generate and rewrite political content at industrial scale. Investigators linked roughly 70 fabricated news websites to around 70 matching X accounts and more than 250 additional inauthentic commenting accounts designed to create the appearance of genuine public engagement. The network produced at least 8,913 articles in about 20 languages before Anthropic disrupted the activity. The significance of the case is not simply the number of fake sites. It is the business model. The network did not consistently promote one government, party or ideology. Anthropic found that its political position changed according to the apparent interests of different customers. The company therefore described it as a commercial influence operation: political manipulation offered in much the same way as other outsourced digital services. A fake media ecosystem built at scale Anthropic says the infrastructure was created rapidly. Domains were registered from France during a roughly ten-week period in mid-2025 and deployed through shared technical infrastructure, allowing investigators to connect publications that outwardly appeared unrelated. Most of the supporting social-media accounts were also created within a narrow timeframe in June and July 2025. The sites were designed to look like functioning local newsrooms rather than anonymous propaganda pages. Articles carried fabricated bylines belonging to journalists who, according to Anthropic, did not exist. Each outlet had a corresponding account on X, while a second layer of fake profiles commented on and amplified the articles. Many of those accounts used AI-generated profile photographs. The result was a three-tier structure: the newsroom published the story, the branded social account distributed it, and apparently ordinary users supplied the appearance of public reaction. Some of those sites remained publicly visible after the operation was exposed. The British Daily, for example, described itself as providing “conservative insights” on British sovereignty and migration, while Commonwealth Post presented itself as an Australian liberal publication focused on democracy, migration and regional security. Those contrasting editorial identities illustrate the central feature identified by Anthropic: the network was capable of taking different political positions in different markets. Claude as a publishing engine Claude was not simply asked to draft occasional articles. The operators built a structured production pipeline around it. Prompts required fixed JSON outputs, formatted HTML, precise character limits and internal links, allowing articles to move directly into an automated publishing workflow. The system could generate entirely new material or take reporting produced by legitimate journalists and rewrite it to fit a desired political perspective. Anthropic identified three recurring techniques. The same source article could be rewritten in opposite ideological directions for different audiences; a political interpretation could be added to a story that originally contained none; and material could be moved from one country to another after its original context had been removed. The articles were also structured to improve the apparent authority of the sites in search engines, helping the network imitate ordinary digital publishing practices rather than simply broadcasting propaganda. This is where generative AI changes the economics of an influence operation. A conventional network of dozens of supposedly local publications would normally require writers, translators, editors and social-media staff. Here, much of that production could be standardised and automated while human operators concentrated on political direction, customer requirements and distribution. The DRC–Rwanda conflict as a test case The clearest concentration of activity involved the Democratic Republic of Congo. Anthropic identified 318 articles concerning the DRC across the fake-news network. The material generally supported positions aligned with the Congolese government, particularly on regional mineral agreements and tensions with Rwanda. Early in the network’s growth, many of the fake social-media personas following and amplifying its accounts also presented themselves as Congolese. Investigators observed one especially revealing episode on 11 September 2025, when multiple sites published almost identical articles about the DRC–Rwanda conflict within approximately three minutes of one another. The wording and political tone were adjusted for different regional audiences, while associated X accounts distributed the links in a coordinated pattern. Anthropic said the activity contained signals suggesting that one or more customers had interests connected to the DRC–Rwanda conflict. It did not, however, identify those customers and explicitly stated that it found no evidence that any government had directed the operation. That distinction is essential. The content may have benefited a political actor without demonstrating that the actor commissioned or controlled it. Influence without ideology Commercialisation is what distinguishes GTG-54002 from many state-linked information operations. A government propaganda network usually has an identifiable strategic direction. A commercial influence provider does not need one. Its infrastructure can support one position in one country and the opposite position somewhere else, provided different customers are willing to pay. That makes attribution more difficult. Analysts cannot necessarily infer the operator from the ideology of the content because ideology may simply be part of the service package. The enduring asset is the infrastructure: domains, publishing systems, fake journalists, social-media accounts and automated amplification. Anthropic says the operation was disrupted before it achieved significant genuine reach. It classified GTG-54002 as Category Two on the Brookings Breakout Scale: material circulated across the network’s own sites and associated social accounts but showed no evidence of substantial penetration into authentic communities. Most of the 8,913 articles generated little observable engagement from real users. That limited impact is important. The case should not be presented as a successful global manipulation campaign. It is better understood as evidence that the infrastructure required to run such campaigns has become cheaper, faster and increasingly commoditised. The deeper shift is that a fake media ecosystem no longer has to be built around a single political cause. It can be built once, automated and then repurposed for the next customer. Disinformation, in this model, is no longer only a political instrument as it turend into the service. Sources: Anthropic — Countering misuse of AI: September 2026 https://www.anthropic.com/threat-intelligence-report-september-2026 Business Standard — AI scaling fake newsrooms, surveillance and online scams https://www.business-standard.com/technology/tech-news/anthropic-report-ai-fake-newsrooms-dating-surveillance-scams-126091100730_1.html Mimikama — KI baut 70 erfundene Nachrichtenportale https://www.mimikama.org/ki-netzwerk-erfundene-nachrichtenportale-echo-berlin/ Poliscoop Media — Anthropic exposes DRC propaganda network https://www.poliscoopmedia.com/articles/anthropic-exposes-drc-propaganda-network-20260911 The British Daily — example of a fabricated outlet identified in the network https://www.british-daily.com/contact Commonwealth Post — example of a fabricated outlet identified in the network https://commonwealth-post.com/category/science MalPulse — infrastructure references for network domains https://www.malpulse.com/infra-pivots/usom-pivots/list/?page=1105 Keywords: #DISINFORMED #Episode13 #DisinformationAsAService #InfluenceAsAService #FakeNewsrooms #FakeMedia #SyntheticMedia #ArtificialIntelligence #AI #GenerativeAI #ClaudeAI #Anthropic #Disinformation #InfluenceOperations #InformationWarfare #FIMI #CommercialInfluence #PoliticalManipulation #NarrativeManipulation #NarrativeLaundering #SourceLaundering #MediaImpersonation #FakeJournalists #SyntheticPersonas #Astroturfing #SocialMediaManipulation #CoordinatedInauthenticBehaviour #CIB #DigitalInfluence #AutomatedPropaganda #ContentAutomation #AIPropaganda #LKMCompany #NaijaPulse #AxumVoices #JamboJournal #EchoBerlin #TheBritishDaily #FiftyStates #CommonwealthPost #DRC #Rwanda #OSINT #WRLD

IRAN: MEK/NCRI – when AI impersonated a real activist in live conversations For years, synthetic media has largely meant fabricated images, cloned voices and manipulated video. A case uncovered by Anthropic in September 2026 suggests a more consequential development: artificial intelligence being used not merely to imitate how a person looks or sounds, but to behave as that person in an ongoing conversation. Anthropic says it dismantled a distributed influence operation targeting Iranians inside the country and abroad that it linked to the People’s Mojahedin Organization of Iran, or PMOI/MEK, and its political front, the National Council of Resistance of Iran. The operators used a shared AI-agent platform to support impersonation, audience profiling, coordinated social-media activity, synthetic personas and the laundering of organisational content through apparently independent accounts. At least four people involved in the operation worked for official NCRI media outlets, according to Anthropic. The company also found references to committee approval processes and MEK leadership, but said it could not independently determine the precise level of central control. Cloning a person from 8,400 Telegram posts The most striking part of the operation involved a real activist whose Telegram identity was copied. According to Anthropic, the operators instructed Claude in Persian that it was now that person, then provided approximately 8,400 of the activist’s Telegram posts so the system could learn and reproduce his writing style. The AI-assisted account was subsequently used to conduct live political conversations with the activist’s existing contacts. Anthropic says that, to its knowledge, the people receiving those messages did not know they were interacting with an account being operated with AI assistance. This is materially different from a conventional chatbot or a static deepfake. The system was not simply producing a forged statement attributed to someone else. It was using a large archive of that person’s authentic language as behavioural training material, then applying the resulting imitation interactively. In practical terms, the deception moved from synthetic content to synthetic identity. Anthropic did not publish the identity of the impersonated activist, nor details of his contacts, and the public report does not establish what specific information the conversations produced. What it does establish is that the impersonation was operational rather than experimental: the cloned account was used in real exchanges with real people. From social-media monitoring to psychographic dossiers The impersonation sat inside a much broader targeting system. Anthropic says the network scraped more than 500 social-media channels and categorised individuals by location, age, profession, political orientation and arrest history. It then analysed approximately 51,944 archived messages from conversations to construct detailed psychographic dossiers on dozens of people inside Iran. The system was therefore not limited to broadcasting propaganda. It was also designed to understand specific audiences and individuals. Profiles could be used to decide what kind of message was most likely to resonate with a particular person, which political identity they appeared closest to and how they should be approached. Anthropic describes this as a structured targeting funnel rather than ad hoc social-media activity. That distinction is important in the Iranian context. Political activists, dissidents and opposition contacts inside Iran can face arrest and severe punishment. The report does not show that the dossiers directly led to arrests or other harm, but collecting and organising information such as arrest history and political affiliation adds a surveillance dimension to what would otherwise be described as an influence operation. A shared AI system for an influence network Anthropic found that the actors used a shared Claude-based platform named “Viktor”, with separate workspaces and persistent memory. Those memory files contained approved sources, prohibited words, account-management instructions and methods intended to reduce the risk of detection. One operator loaded MEK founding doctrine into the system as what the report called “strategic base data”, allowing others to reuse it across their work. This persistent-memory structure meant the AI did not have to be briefed from scratch for every task. Once doctrine, stylistic rules and operational constraints had been stored, the system could repeatedly produce material consistent with the network’s objectives. Anthropic says the same general playbook appeared across different workspaces despite the operators not sharing obvious account infrastructure. The network also used automated pipelines to coordinate Instagram posting schedules and tailor messages to different audiences. Some accounts initially avoided mentioning the Mojahedin at all, allowing material aligned with MEK/NCRI narratives to appear as neutral or independent political commentary. Content was distributed through the organisation’s own media ecosystem as well as accounts presented as ordinary news or activist profiles. Anthropic assessed the campaign as Category Two on its Breakout Scale: active on multiple platforms with distribution through NCRI-linked media properties and amplifier accounts, but without evidence of broad authentic penetration. Synthetic citizens and disguised organisational media The same infrastructure generated AI avatars presented as ordinary Iranians, complete with Persian audio, to promote Maryam Rajavi’s political programme. Anthropic says the synthetic nature of these personas was intentionally concealed. Operators also rewrote and redistributed content originating from MEK-affiliated media while stripping identifying features or presenting it through apparently independent accounts. The network’s political messaging targeted the Iranian government but also rival opposition currents, including monarchists and supporters of the Pahlavi camp. Anthropic documented fabricated video material attacking a member of the Pahlavi family and the use of the slogan “Neither Shah Nor Sheikh”, consistent with the NCRI’s broader competition with other opposition movements. That rivalry provides relevant context. Reuters describes the MEK as one of Iran’s principal organised opposition movements in exile and the dominant force behind the NCRI, led by Maryam Rajavi. Its relationship with other opposition currents is often contentious, while the extent of its support inside Iran remains uncertain. What can be attributed – and what cannot Anthropic’s attribution is unusually specific but still needs to be stated carefully. The company says its investigation linked the operation to MEK/NCRI and established that at least four participants worked for official NCRI media organisations. It also found a common operational playbook, committee review structures and repeated references to MEK leadership. On that basis, Anthropic said central tasking was likely. It nevertheless stopped short of saying it had proven that NCRI’s senior leadership directly ordered or managed every component of the operation. That caveat matters. The strongest public evidence supports describing GTG-84006 as a MEK/NCRI-aligned influence operation involving personnel from official NCRI media, rather than asserting that every action was directly commanded by the organisation’s top leadership. The broader significance of the case lies elsewhere. Earlier generations of synthetic media attempted to fabricate evidence: a photograph, a voice recording or a video. Here, AI was used to maintain an identity over time, remember doctrine, analyse targets and speak directly to real people while appearing to be someone they already trusted. The deepfake was no longer merely an artefact. It had become a participant in the conversation. Sources Anthropic — Countering misuse of AI: September 2026 https://www.anthropic.com/threat-intelligence-report-september-2026 AI Misuse Case Library — GTG-84006 activist impersonation case https://www.misuseofai.com/en/cases/gtg-84006-activist-impersonation/ Reuters — Who makes up Iran’s fragmented opposition? https://www.reuters.com/business/media-telecom/who-makes-up-irans-fragmented-opposition-2025-06-18/ Reuters — Iran’s divided opposition senses its moment https://www.reuters.com/world/middle-east/irans-divided-opposition-senses-its-moment-activists-remain-wary-protests-2025-06-19/ Reuters — NCRI and Maryam Rajavi https://www.reuters.com/world/middle-east/dissident-leader-abroad-urges-iranians-bring-down-khamenei-2025-06-24/ Keywords #DISINFORMED #Episode12 #Iran #MEK #PMOI #NCRI #IranianOpposition #Disinformation #InfluenceOperations #InformationWarfare #ArtificialIntelligence #AI #GenerativeAI #ClaudeAI #Anthropic #AIDeception #AIImpersonation #IdentityImpersonation #SyntheticIdentity #InteractiveDeepfake #DigitalImpersonation #PersonaCloning #BehaviouralCloning #Telegram #PsychographicProfiling #TargetProfiling #AudienceTargeting #SocialMediaManipulation #Astroturfing #SyntheticPersonas #NarrativeLaundering #CoordinatedInfluence #PoliticalInfluence #DigitalInfluence #OppositionPolitics #IranPolitics #OSINT #WRLD