Search

𝗣𝗮𝗸𝗶𝘀𝘁𝗮𝗻–𝗜𝗻𝗱𝗶𝗮 — 𝗧𝗵𝗲 𝟱,𝟬𝟬𝟬-𝗮𝗰𝗰𝗼𝘂𝗻𝘁 𝗰𝗹𝗮𝗶𝗺 𝗯𝗲𝗵𝗶𝗻𝗱 𝗮 𝗿𝗲𝗮𝗹 𝘄𝗮𝘃𝗲 𝗼𝗳 𝗽𝗿𝗼𝘁𝗲𝘀𝘁 𝗱𝗶𝘀𝗶𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 A burst of false reports surrounding India's protests over the Special Intensive Revision of electoral rolls provides a clear example of how genuine political unrest can become a target for cross-border information manipulation. What remains considerably less certain is the scale and command structure of the campaign. Indian intelligence officials have alleged that more than 5,000 social-media accounts were created in Pakistan within roughly two weeks to exploit protests against the electoral-roll revision and the Election Commission. According to reporting based on Intelligence Bureau sources, the accounts were intended to circulate claims of police violence, casualties and government repression, while encouraging those narratives to travel beyond Delhi into other parts of India. Several of the individual fabrications are independently verifiable. One account using the identity “Anushi Tiwari Indian” and the handle @indiantiwari01 circulated old footage with claims that Delhi Police had opened fire on demonstrators. Different posts attributed multiple deaths to the supposed firing and claimed that opposition leader Rahul Gandhi had been shot or injured. Fact-checkers established that footage used to support such claims came from earlier events, including the 2024 farmers' protests, rather than the demonstrations then taking place in Delhi. Delhi Police publicly identified the account and said it had a history of distributing doctored material, old footage and fabricated narratives. Police subsequently registered four cases concerning alleged misinformation around the protests, while officials said hundreds of posts had been removed. India Today later reported that the Delhi Police Cyber Cell had traced the account's IP address to Pakistan and that the account was subsequently withheld in India. Earlier investigations had also documented the same persona circulating misleading material about Indian political and security events. That evidence establishes a meaningful Pakistan-linked component to the disinformation environment. It does not, however, independently establish a 5,000-account ISI network. The larger allegation comes primarily from Indian intelligence reporting. The Statesman, citing an IANS report and an Intelligence Bureau official, said accounts were being operated from several locations including Bhimber, Rawalakot, Sialkot and Peshawar rather than primarily from Rawalpindi and Islamabad. Officials alleged that operators were supplied with narratives to circulate and instructed to tag users outside India to increase their reach. The same reporting connected the activity to “Operation Ground Wire”, described by Indian sources as an effort to recruit Indian nationals to generate material that could then appear to originate domestically. The concept predates the October protests. A September investigation by CNN-News18 alleged that a platform called Bharat Bytes News had been used to recruit young Indian contributors for politically sensitive assignments, with material subsequently handled from Pakistan. There is an important evidential gap. No public list of the alleged 5,000 accounts has been released. There is no published network graph, platform transparency report, forensic infrastructure analysis or dataset allowing independent researchers to reproduce the Intelligence Bureau's assessment. Nor has public evidence demonstrated that all the accounts described in media reports belong to a single centrally controlled network rather than several clusters, individual propagandists and opportunistic accounts exploiting the same political crisis. The attribution to Pakistan's Inter-Services Intelligence is therefore an intelligence claim rather than an independently demonstrated technical attribution. Reporting by Indian outlets repeatedly cites intelligence and police sources, but the underlying evidence has not been released publicly. At the time of this review, no equivalent technical report from Meta, X, Google or another major platform had been identified that confirmed the existence of a 5,000-account ISI-controlled operation. This distinction matters particularly in the India–Pakistan information environment. Both states routinely accuse the other of covert influence and disinformation. Pakistan itself has alleged Indian-backed social-media operations targeting Pakistani institutions, and Islamabad has previously rejected Indian security allegations as politically motivated. That does not invalidate evidence surrounding particular Pakistan-based accounts, but it raises the evidential threshold required for attributing thousands of accounts to a state intelligence service. There is another reason for caution. The information environment around the Indian protests contains misinformation from more than one political direction. Independent fact-checkers have identified AI-generated protest scenes, old videos recaptioned as current events and fabricated images supporting competing narratives. In an earlier case involving the Cockroach Janta Party protests, BOOM and Alt News found that Delhi Police themselves had incorrectly dismissed authentic footage as fake. Government attribution should therefore be treated as evidence to investigate, not as a substitute for forensic verification. No confirmed individual mastermind can presently be named for the October 5,000-account operation. “Anushi Tiwari Indian” is a documented online persona, not a verified real-world identity. Earlier reporting on the broader Ground Wire allegation named individuals said to be Pakistani handlers, including a person identified as Abdullah Shad and a Pakistani military officer described as Lieutenant Colonel Zia. Those identities have not been independently established through publicly available judicial records, financial evidence or a technical attribution report, and there is insufficient evidence to identify either man as responsible for the current 5,000-account campaign. The most defensible conclusion is narrower but still significant. A cluster of false narratives exploiting India's election-related protests existed; several prominent examples have been independently debunked; and at least one central amplifier has been reported by police investigators as Pakistan-based. The much larger claim — that more than 5,000 newly created accounts form a coordinated ISI operation — remains plausible but unproven on the public evidence currently available. For an information operation, that gap between what can be demonstrated and what intelligence authorities say they know is itself part of the story. 𝗦𝗢𝗨𝗥𝗖𝗘𝗦 1. The Statesman — “Pakistan creates 5,000 fake social media accounts amid anti-SIR protests: IB official”, 14 October 2026. This is the principal published source for the 5,000-account figure, alleged geographic distribution and Operation Ground Wire connection. The Statesman https://www.thestatesman.com/india/pakistan-creates-5000-fake-social-media-accounts-amid-anti-sir-protests-ib-official-1503650989.html 2. India Today — “ISI-linked accounts post fake Rahul injury video, deaths amid Delhi protests”, 13 October 2026. Documents the fake Rahul Gandhi injury story, false casualty reports and attribution supplied by security sources. India Today https://www.indiatoday.in/india/story/anti-cec-protests-isi-linked-pakistan-accounts-spread-false-rahul-gandhi-injury-claim-fake-deaths-amid-delhi-protests-3016235-2026-10-13 3. India Today / PTI — Delhi Police investigation, four FIRs and approximately 500 posts removed, 13 October 2026. India Today https://www.indiatoday.in/cities/delhi/story/delhi-police-files-four-firs-removes-500-posts-over-protest-misinformation-3016760-2026-10-13 4. The New Indian Express — Delhi Police warning concerning @indiantiwari01, 12 October 2026. Includes the police's public identification of the account and its description of previous fabricated narratives. The New Indian Express https://www.newindianexpress.com/cities/delhi/2026/Oct/12/delhi-police-warns-of-action-over-fake-claim-of-firing-at-rahul-gandhi-rally-300-posts-taken-down 5. India Today — “Pakistani Fake News Account Banned on X Over Fabricated Videos on Delhi Protests and Rahul Gandhi”, 15 October 2026. Reports the Cyber Cell finding that the account's IP address traced to Pakistan. India Today https://www.indiatoday.in/india/video/pakistani-fake-news-account-banned-on-x-over-fabricated-videos-on-delhi-protests-and-rahul-gandhi-ytvd-3017879-2026-10-15 6. The Quint / WebQoof — independent verification of old footage falsely presented as Delhi Police firing on protesters. The investigated post from @indiantiwari01 had accumulated more than 35,000 views when checked. TheQuint https://www.thequint.com/news/webqoof/old-video-farmers-protest-falsely-linked-to-cjp-delhi-police-firing-fact-check 7. BOOM — “Old Farmers Protest Video Falsely Shared As Fatalities From October 10 Protest”, 10 October 2026. Independent visual verification of another falsely contextualised protest video. BOOM https://www.boomlive.in/fact-check/old-farmers-protest-video-falsely-shared-as-fatalities-from-october-10-protest-32352 8. Newschecker — independent fact-check of the false Delhi Police firing and casualty story, 13 October 2026. Newschecker https://www.newschecker.in/fact-check/old-video-shared-as-delhi-police-firing-at-rahul-gandhi-led-march-against-cec 9. DFRAC — earlier investigation of the “Anushi Tiwari Indian” persona during the September BRICS information environment. This establishes that the account's misleading activity preceded the October protests. DFRAC_ORG https://dfrac.org/en/2026/09/16/brics-summit-disinformation-fake-and-misleading-claims-flood-social-media/ 10. ETGovernment — Maj Gen Rajan Kochhar (Retd), analysis of the earlier Ground Wire allegations, September 2026. Importantly, the article itself stresses that claims concerning named operators, payment mechanisms and Bharat Bytes require independent verification. ETGovernment.com https://government.economictimes.indiatimes.com/amp/blog/the-evolution-of-proxy-warfare-how-narrative-manipulation-is-transforming-india-pakistan-conflict/134347274 11. BOOM — AI-generated imagery falsely connected to the election-related protests, 12 October 2026. Demonstrates that the broader information disorder was not confined to the specifically Pakistan-attributed examples. BOOM https://www.boomlive.in/fact-check/ai-visuals-falsely-shared-as-real-fuel-misinformation-amid-cec-protests-32353 12. Alt News — investigation showing that Delhi Police had incorrectly labelled genuine July protest footage as fake. Relevant to the need for independent verification of official fact-checking claims. Alt News https://www.altnews.in/hindi/baton-with-nails-videos-indeed-from-july-20-protests-delhi-police-pibs-fact-check-incorrect/ 𝗞𝗘𝗬𝗪𝗢𝗥𝗗𝗦 #Disinformed #Disinformation #Propaganda #InfluenceOperations #India #Pakistan #ISI #ElectionSecurity #ElectionIntegrity #SIR #SpecialIntensiveRevision #DelhiProtests #RahulGandhi #GyaneshKumar #SocialMedia #FakeAccounts #FakeNews #InformationWarfare #CognitiveWarfare #HybridWarfare #OSINT #DigitalPropaganda #ForeignInfluence #InformationOperations #FactChecking #CyberSecurity #OperationGroundWire #PakistanIndia #PoliticalDisinformation #InformationIntegrity

𝗜𝗿𝗮𝗻’𝘀 𝗳𝗮𝗸𝗲 𝗜𝘀𝗿𝗮𝗲𝗹𝗶𝘀 – 𝗵𝗼𝘄 𝗮 𝗳𝗼𝗿𝗲𝗶𝗴𝗻 𝗶𝗻𝗳𝗹𝘂𝗲𝗻𝗰𝗲 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝗲𝗻𝘁𝗲𝗿𝗲𝗱 𝗜𝘀𝗿𝗮𝗲𝗹’𝘀 𝗲𝗹𝗲𝗰𝘁𝗶𝗼𝗻 𝗱𝗲𝗯𝗮𝘁𝗲 Ahead of Israel’s 27 October election, hundreds of social-media accounts have been presenting themselves as ordinary Israelis while injecting political messages into genuine domestic conversations. They appear as women, reservists, secular voters, religious activists and frustrated citizens. Some attack Benjamin Netanyahu, others have previously promoted narratives associated with the Israeli right, while many focus less on parties than on a broader message: Israel is divided, its institutions cannot be trusted and its political system is approaching crisis. A detailed investigation by the OSINT company Golden Owl has mapped this activity as a substantial Iran-linked influence network. Its October analysis identified at least 694 accounts, with 445 attributed at high or medium-high confidence to the operation. Between 11 August and 11 October, the network generated at least 4.7 million views and more than 160,000 interactions. The researchers found no evidence that these accounts were simply a group of independent Iranian commentators expressing political opinions. Their assessment rests instead on coordinated behaviour, false identities, account histories, copied content, language patterns and platform metadata linking significant parts of the infrastructure to Iran. 𝗙𝗿𝗼𝗺 𝟯𝟱 𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝘀 𝘁𝗼 𝗵𝘂𝗻𝗱𝗿𝗲𝗱𝘀 𝗼𝗳 𝗳𝗮𝗸𝗲 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 The investigation developed in two stages. Golden Owl’s first report, published in September, identified an operational core of 35 accounts: 32 personas presenting themselves as Israelis and three Hebrew-language media-style channels. During the 30-day period measured in that study, active accounts generated 947,322 impressions and more than 9,000 interactions. The October investigation expanded the dataset dramatically. Researchers analysed more than 560,000 data points, including tens of thousands of accounts, relationships between them and more than a quarter of a million posts. The wider network showed repeated patterns of identical texts, synchronised activity and accounts created in batches. The numbers therefore describe not a sudden explosion from 35 to hundreds of accounts, but the gradual exposure of a much larger infrastructure surrounding the original core. 𝗧𝗵𝗲 𝗳𝗮𝗸𝗲 𝗜𝘀𝗿𝗮𝗲𝗹𝗶𝘀 Some of the strongest evidence comes from the histories of individual personas. One account had spent years posting exclusively in Persian under the handle “mardeankabooti” before reappearing in August 2026 as an apparently Israeli user called “Alon Strauss”, complete with an Israeli flag and Hebrew political messaging. Other personas presented themselves as Israeli professionals, activists or ordinary citizens while X transparency information showed connections through the Iranian version of the Android application or locations inconsistent with their claimed identities. The account “Yaara Shalev” presented itself as an Israeli woman concerned with democracy and peace. Investigators found that photographs used to construct the identity were inconsistent, including borrowed and apparently AI-generated imagery. A small Hebrew-language channel called KigVoice, previously identified in Israeli government reporting as part of an Iranian influence environment, repeatedly published material that later appeared on the much more visible Yaara account. In one sample, 14 of 40 KigVoice posts subsequently resurfaced as captions or opening lines in Yaara’s content. Another persona, “Miriam Kozak”, had built an audience of more than 18,000 followers and had already been exposed as fictitious by Israeli researchers in 2024. Its political messaging changed substantially over time, moving between narratives associated with different sides of Israeli politics. That inconsistency is important: the apparent purpose was not necessarily to build a stable ideological following, but to enter whichever political argument offered the greatest opportunity to intensify division. 𝗔𝗜, 𝗰𝗼𝗽𝗶𝗲𝗱 𝗺𝗲𝘀𝘀𝗮𝗴𝗲𝘀 𝗮𝗻𝗱 𝗜𝗿𝗮𝗻𝗶𝗮𝗻 𝗳𝗶𝗻𝗴𝗲𝗿𝗽𝗿𝗶𝗻𝘁𝘀 The Iran attribution is based on more than political content. Researchers identified accounts using the Iranian version of the X Android application, repeated connections to previously identified Iranian influence assets, copied posts appearing across supposedly independent personas within minutes, and Hebrew containing unusual grammatical errors or Persian and Arabic keyboard artefacts. Generative AI also appears to have become part of the production process. Some accounts inadvertently published fragments resembling chatbot instructions, while other posts displayed patterns consistent with machine-generated Hebrew. AI-generated videos and synthetic profile imagery further reduced the cost of maintaining large numbers of apparently distinct personalities. However, none of these indicators was treated as proof on its own. Golden Owl explicitly excluded accounts where the evidence was insufficient and notes that VPNs, travel and platform location labels can create misleading signals. The attribution rests on multiple independent indicators converging across the network. 𝗧𝗵𝗲 𝗴𝗼𝗮𝗹 𝗶𝘀 𝗻𝗼𝘁 𝗻𝗲𝗰𝗲𝘀𝘀𝗮𝗿𝗶𝗹𝘆 𝘁𝗼 𝗲𝗹𝗲𝗰𝘁 𝗼𝗻𝗲 𝗽𝗮𝗿𝘁𝘆 The network repeatedly exploited issues that genuinely divide Israeli society: responsibility for the 7 October attacks, the war, the hostages, ultra-Orthodox military exemptions, economic pressure, emigration and confidence in state institutions. It also circulated misleading information about the election itself, including false voting dates, claims that voting had been postponed and posts suggesting online voting mechanisms that do not exist in Israel’s parliamentary election system. The pattern suggests a strategy broader than conventional electoral campaigning. Rather than consistently promoting one political faction, the network appears designed to weaken confidence in the government, military, democratic institutions and the electoral process itself. An influence operation does not need to persuade Israelis to support a particular candidate if it can convince different groups that defeat would prove fraud, betrayal or systemic failure. 𝗥𝗲𝗮𝗹 𝗜𝘀𝗿𝗮𝗲𝗹𝗶𝘀 𝗮𝘀 𝘂𝗻𝘄𝗶𝘁𝘁𝗶𝗻𝗴 𝗮𝗺𝗽𝗹𝗶𝗳𝗶𝗲𝗿𝘀 One of the network’s most effective characteristics is that it does not depend solely on its own followers. Fake personas enter comment sections and political discussions involving real Israeli journalists, politicians and ordinary users. Authentic Israelis then repost or interact with the material, sometimes carrying it far beyond the original account. Golden Owl does not classify those genuine users as participants in the operation. In most cases they appear to be unwitting amplifiers. But once a message passes from a fabricated Iranian-operated persona to an authentic Israeli account, its foreign origin becomes much harder for the next person to recognise. 𝗧𝗵𝗲 𝟰𝟬,𝟬𝟬𝟬-𝗯𝗼𝘁 𝗳𝗶𝗴𝘂𝗿𝗲 𝗯𝗲𝗹𝗼𝗻𝗴𝘀 𝘁𝗼 𝗮 𝗱𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝘁 𝗽𝗲𝗿𝗶𝗼𝗱 A much larger figure has also appeared in recent reporting. In the first two days after the October 2023 Hamas attack, social-media intelligence company Cyabra identified more than 40,000 fake profiles participating in online discussions across major platforms. Their content generated hundreds of thousands of interactions and had a potential reach estimated at 531 million profiles. Those numbers are important historical context, but they should not be merged with the current Golden Owl investigation. There is no public evidence demonstrating that all of those 2023 accounts and the 2026 Iran-linked election network belonged to one continuous command structure. The 531 million figure is also an estimate of potential exposure, not proof that 531 million people saw or believed the content. 𝗪𝗵𝗼 𝗶𝘀 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗯𝗲𝗵𝗶𝗻𝗱 𝘁𝗵𝗲 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻? No confirmed individual operators have been publicly identified. Names such as Yaara Shalev, Miriam Kozak and Alon Strauss are personas, not verified identities of the people controlling the accounts. Golden Owl says its evidence supports an association with the Islamic Republic of Iran and with previously documented Iranian influence infrastructure, but it does not establish which Iranian institution, intelligence service, military organisation or contractor directs the network. That distinction is essential. Public OSINT supports attribution at the Iran-linked operational level. It does not currently justify naming individual Iranian officials as the people commanding this specific campaign. 𝗧𝗵𝗲 𝗱𝗲𝗲𝗽𝗳𝗮𝗸𝗲 𝗶𝘀 𝗻𝗼 𝗹𝗼𝗻𝗴𝗲𝗿 𝗼𝗻𝗹𝘆 𝘁𝗵𝗲 𝘃𝗶𝗱𝗲𝗼 The Israeli case illustrates a broader change in influence operations. The synthetic asset does not have to be a spectacular deepfake of a politician. It can be an apparently ordinary citizen who comments on politics, argues with neighbours, describes personal experiences and gradually becomes part of an authentic community. That can be more difficult to recognise because the propaganda does not arrive looking foreign. It arrives looking local. And when hundreds of fabricated citizens enter the same national conversation, they can manufacture the impression that political anger, despair or distrust is more spontaneous and more widely shared than it really is. 𝗦𝗼𝘂𝗿𝗰𝗲𝘀 Golden Owl — Exposing the Iranian Regime’s Influence Machinery Against Israeli Society https://web-dev-production-7a35.up.railway.app/resources/research/Exposing-the-Iranian-Regime-Influence-Machinery-Against-Israeli-Society Golden Owl Golden Owl — The Other Face of War: Iranian Regime–Linked Manipulation of Israel’s 2026 Election Debate https://web-dev-production-7a35.up.railway.app/resources/research/Iranian-Regime-Linked-Manipulation-of-Israel-2026-Election-Debate Golden Owl The Jerusalem Post — Iran-linked social-media accounts posing as Israelis to target election https://www.jpost.com/israel-election-2026/article-909863 The Jerusalem Post Ynet — Fake Israelis, real influence: Iran-linked network infiltrates Israel’s election debate https://www.ynetnews.com/tech-and-digital/article/syp119nqqzg ynetglobal Calcalist — Iranian influence network exposed ahead of Israel’s election https://www.calcalist.co.il/calcalistech/article/s1q0ifijzl calcalist Vesty / Ynet — Iranian fake-account network and October update https://www.vesty.co.il/main/article/rkwokjssgg vesty Israel Ministry for Diaspora Affairs — Iran’s active Hebrew-language influence campaign https://www.gov.il/BlobFolder/reports/israel-and-us-strikes-in-iran-daily-status_2_3_26/en/mashlat_Roaring_Lion_israel-and-us-strikes-in-iran-daily-status_2_3_26.pdf Government of Israel Israel Central Elections Committee — official 2026 election timetable https://www.gov.il/en/pages/time--table-26 Government of Israel Channel NewsAsia — historical Cyabra analysis of more than 40,000 fake profiles after 7 October 2023 https://www.channelnewsasia.com/singapore/how-fake-news-israel-hamas-stokes-outrage-hatred-and-potential-violence-southeast-asian-tiktok-5603221 𝗞𝗲𝘆𝘄𝗼𝗿𝗱𝘀 #DISINFORMED #Episode20 #Iran #Israel #IsraelElection2026 #IranianInfluence #IranianDisinformation #ElectionInterference #ForeignInterference #FIMI #Disinformation #InformationWarfare #InfluenceOperations #FakeAccounts #FakePersonas #SyntheticIdentity #ArtificialIntelligence #AI #AIPropaganda #SocialMediaManipulation #Astroturfing #NarrativeManipulation #PoliticalDisinformation #ElectionDisinformation #X #Twitter #Bots #BotNetwork #KigVoice #YaaraShalev #MiriamKozak #DigitalInfluence #InformationManipulation #ElectionIntegrity #GoldenOwl #OSINT #MediaManipulation #WRLD

Brazil’s synthetic voters – when AI manufactures public opinion They look like ordinary street interviews. A reporter approaches a passer-by in a Brazilian square and asks a simple question: who will you vote for? A young voter explains why Luiz Inácio Lula da Silva deserves another term. An elderly woman says Brazil needs Flávio Bolsonaro because he represents political renewal and greater security. The locations look plausible, the microphones are visible and the answers sound much like the brief political opinions heard in television vox pops around the world. None of the people are real. Ahead of Brazil’s presidential election on 4 October, fact-checking organisation Aos Fatos identified at least 50 TikTok videos in which artificial intelligence was used to manufacture voters, reporters and apparently spontaneous political interviews. Together, the videos had accumulated around 7.4 million views by mid-August. Some promoted Lula, others Flávio Bolsonaro, while another group used synthetic characters to ridicule or stereotype supporters of one side. Aos Fatos found no apparent evidence linking the accounts producing the videos to either presidential campaign. The opinion poll that never took place The format is important. These were not conventional deepfakes in which a recognisable politician is made to say something he never said. Instead, the creators reproduced the visual language of the vox pop – the short street interview used by broadcasters and social-media creators to illustrate what ordinary people supposedly think. In pro-Lula videos, synthetic voters described themselves as beneficiaries of social programmes or credited the president with improving their lives. In videos supporting Flávio Bolsonaro, artificial interviewees associated him with political renewal, public security and fighting corruption. Other clips were openly hostile: AI-generated characters presented as poor or living in parts of Brazil’s north-east were shown in dirty clothes or run-down surroundings, declaring support for Lula because they supposedly preferred welfare payments to work. The deception is therefore subtler than fabricating a candidate’s statement. It manufactures something that political communication normally treats as evidence of public sentiment. A real vox pop may be unscientific, but the people interviewed at least exist. These videos created the appearance that identifiable social groups – young people, pensioners, welfare recipients or residents of particular regions – were spontaneously expressing political preferences when no such encounters had taken place. An electoral-law specialist interviewed by Aos Fatos described the technique as the fabrication of a “social fact that never occurred”. That captures the central innovation: AI is being used not merely to falsify political speech, but to manufacture the impression of grassroots opinion. Fifty videos, but not one proven network The available evidence does not support describing the 50 posts as a centrally controlled influence operation. Aos Fatos located them through TikTok searches and recommendations produced by the platform itself, then examined the accounts responsible for publication. Most had relatively small individual audiences, although their combined reach was substantial. The first examples identified by the investigation appeared as early as March 2026. Activity increased in June and was concentrated particularly in July and the first half of August as Brazil’s election calendar intensified. Some accounts specialised in AI-generated videos generally, including fabricated podcast-style material. Others were explicitly political or supportive of a candidate, but Aos Fatos found no apparent links between those profiles and the official Lula or Bolsonaro campaigns. That distinction is essential. The evidence demonstrates a common technique and a shared political environment, not a single command structure. Some creators may have been motivated by ideology, others by engagement or monetisation. Publicly available evidence does not establish who commissioned the individual videos or whether any coordination existed between the accounts. This decentralised model also creates a different enforcement problem from a traditional bot network. There may be no headquarters to expose and no infrastructure whose removal disables the entire operation. The format itself can be copied by anyone with access to inexpensive generative-video tools. When the algorithm mixes real and synthetic citizens Aos Fatos documented another important feature of the phenomenon: TikTok’s recommendation system placed AI-generated interviews alongside genuine street interviews. For a user scrolling quickly through the platform, the transition between an authentic citizen and an entirely fabricated one could therefore be almost invisible. In 18 per cent of the 50 videos analysed, there was no indication that the people shown had been generated using AI. After Aos Fatos provided TikTok with the videos, the company said it had removed all of them for violating its rules on edited and AI-generated media. TikTok said its policies require creators to identify synthetic content and prohibit manipulated media capable of misleading users about matters of public importance or impersonating genuine journalistic material. The issue extends beyond one platform. Factchequeado’s review of Brazil’s 2026 election campaign found that synthetic endorsements and other deepfakes had become one of the most visible forms of AI-assisted electoral misinformation, alongside fabricated candidate statements and invented scenes. Brazil already had rules for synthetic politics Brazil entered the campaign with unusually detailed electoral rules governing artificial intelligence. The Superior Electoral Court, the TSE, requires electoral propaganda using synthetic multimedia to disclose clearly that AI was used. More importantly for the fake-voter videos, its rules prohibit synthetic audio or video used to favour or harm a candidacy when it creates or alters the image or voice of a living, deceased or fictitious person. The difficulty is attribution and enforcement. When a synthetic video is published by an official campaign, responsibility can be relatively straightforward to investigate. When it comes from an apparently independent account with no demonstrated relationship to a candidate, lawyers interviewed by Aos Fatos said responsibility is more likely to fall on the individual creator, while imposing electoral sanctions on a campaign would require evidence of a connection. For the final 72 hours before the election and the 24 hours following it, the TSE has imposed additional restrictions on newly published or republished synthetic material involving candidates or public figures, reflecting the particular difficulty of correcting fabricated content immediately before voting. From deepfake politicians to synthetic electorates The Brazilian case illustrates a broader change in political manipulation. The first generation of electoral deepfakes concentrated on famous people: make a politician appear to say something damaging, or fabricate an endorsement from a celebrity. Synthetic vox pops reverse the perspective. The politician can remain completely authentic; it is the electorate around the politician that is fabricated. That changes the psychological proposition of the message. Instead of saying the candidate believes this, the video suggests people like you believe this. Age, clothing, accent, neighbourhood and social class can all be generated to construct an artificial constituency around almost any political claim. There is no evidence that the 50 Brazilian videos identified by Aos Fatos constitute a single centrally directed campaign, nor evidence that they changed voting intentions. What they demonstrate is a technique whose barrier to entry has become extremely low. AI no longer needs to forge the politician. #DISINFORMED #Episode14 #Brazil #BrazilElection2026 #Elections #ElectionDisinformation #ArtificialIntelligence #AI #GenerativeAI #SyntheticVoters #SyntheticMedia #AIAvatars #AIGeneratedVideo #VoxPop #FakeInterviews #Astroturfing #AIPropaganda #PoliticalDisinformation #InfluenceOperations #InformationWarfare #SocialMediaManipulation #TikTok #PublicOpinion #ManufacturedConsent #SyntheticPublicOpinion #DigitalInfluence #Deepfakes #ElectionIntegrity #TSE #AosFatos #FactChecking #OSINT #MediaManipulation #WRLD (translated)

Russia’s influence operation arrives ahead of the US midterms With weeks remaining before America's November midterm elections, a familiar type of content has begun appearing online. Videos resembling reports from CNN, the BBC and The New York Times accuse candidates of corruption, antisemitism and misconduct. Hollywood actors appear to denounce Democrats. Other clips claim that warnings about Russian interference are themselves a Democratic disinformation campaign. The reports are fabricated. Graphika, which tracks online influence operations, says it has identified a coordinated campaign targeting candidates in competitive US Senate races. It assesses with high confidence that the material was produced by Operation Overload, also known as Matryoshka – a long-running Russia-aligned influence operation previously active against elections and political debates in Europe and the United States. The activity coincides with a broader warning from American intelligence officials. Classified assessments reported by The New York Times conclude that the Kremlin has authorised another digital influence campaign ahead of the 2026 midterms, aimed primarily at exploiting existing divisions and undermining confidence in American democracy. There is an important distinction. US officials have not reported evidence that Russia is attempting to manipulate voting machines or alter the counting of votes. The operation is about influencing the information environment surrounding the election. Fake scandals for competitive Senate races Graphika traced a concentrated wave of activity between 10 and 14 September. Likely inauthentic or repurposed accounts distributed videos accusing Democratic politicians of corruption, antisemitism and other misconduct. The targets included Senator Jon Ossoff in Georgia, Representative Chris Pappas in New Hampshire and Texas state representative James Talarico, as well as Senate candidates Sherrod Brown in Ohio, Roy Cooper in North Carolina, Mary Peltola in Alaska, Abdul El-Sayed in Michigan, Joshua Turek in Iowa and Troy Jackson in Maine. The selection was not random. These were politicians involved in Senate contests where the result could matter to control of the chamber. The campaign did not rely on a single political narrative. Instead, it attached different accusations to different candidates – corruption, social issues, antisemitism or personal misconduct – while maintaining a consistent production and distribution model. That model is characteristic of Matryoshka: create apparently independent pieces of evidence, disguise them as journalism and distribute them through networks of disposable accounts. Hollywood celebrities who never said what the videos claimed One of the campaign's more distinctive techniques involved genuine footage of American actors. Videos featuring celebrities including Sarah Jessica Parker and Julia Roberts were altered with captions and other material to suggest they were promoting the slogan #AllDemocratsAreCriminals. The technique continued in subsequent material. Fact-checkers identified fabricated New York Times-branded videos using footage of Alyssa Milano, Sean Astin, Rachael Harris, Leonardo DiCaprio, Eric Braeden, Annie Potts and Patrick Fabian. Some of the original footage came from Cameo, where actors record personalised video messages. Their authentic images were retained while fabricated audio, captions or surrounding material changed the meaning entirely. Lead Stories compared several of the clips with the originals and found that the supposed political statements did not appear in the genuine recordings. Eric Braeden's representative separately confirmed that the claim he had joined the anti-Democratic campaign was false. The advantage of the technique is straightforward. Generative AI does not need to create a convincing celebrity from nothing. The operator can begin with authentic footage of a recognisable person and manipulate only the elements necessary to manufacture a political statement. Stealing the authority of real newsrooms Celebrity impersonation was only one layer. The operation repeatedly borrowed the visual identity of established media organisations. Graphika identified material impersonating or falsely citing the BBC, CNN and Politico, alongside references to France's VIGINUM foreign-interference agency and journalist Brandy Zadrozny. Other material reproduced New York Times-style branding. Some fabricated reports made an unusual claim: that Democrats themselves were organising disinformation or “false-flag operations” and then blaming Russia. This creates a defensive layer around the influence operation. Instead of merely distributing false political allegations, the campaign also attempts to discredit future reporting about the manipulation itself. If successful, evidence exposing foreign interference can be reframed as part of the conspiracy. Graphika says it assesses with high confidence that Operation Overload produced these videos. The technique is well established. Earlier investigations by CheckFirst and Reset Tech documented hundreds of falsified pieces of content produced by Operation Overload, often impersonating journalists, institutions and major media brands. AI-generated or manipulated material has increasingly become part of that production system. What US intelligence says Russia is trying to achieve The broader strategic picture comes from American intelligence assessments reported on 18 September. According to US officials familiar with classified findings, the Kremlin has authorised a covert digital influence campaign aimed at Americans during the 2026 election season. Its apparent objective is to seed or amplify domestic divisions and weaken confidence in the political process. Some officials described the principal aim as creating disorder rather than helping a single political party. The publicly identified Matryoshka material examined so far, however, has targeted Democratic candidates. Those two findings should not be treated as contradictory. An operation can exploit partisan divisions while serving the broader objective of making the electoral system appear corrupt, chaotic or illegitimate. US officials also reportedly assess the current Russian campaign as less extensive or coordinated than some previous election operations. Moscow is considered less focused on congressional elections than presidential contests and remains heavily occupied by its war against Ukraine. Russia has denied previous US accusations of election interference. An operation with limited reach – so far There is another reason for caution: producing large quantities of disinformation is not the same as successfully influencing voters. Matryoshka has repeatedly demonstrated an ability to manufacture content at industrial speed, but much of its material receives little genuine engagement. Researchers monitoring the network have previously warned against confusing automated distribution and platform view counts with authentic audience penetration. There are exceptions. A fabricated New York Times-style video featuring Jamie Lee Curtis had accumulated nearly 200,000 views on X by the end of 17 September, according to reporting by The New York Times. Other pieces attracted considerably less attention. There is currently no public evidence demonstrating that the campaign has changed voting intentions or will affect election results. What the September activity demonstrates is something narrower but important: a Russia-aligned influence infrastructure previously used against European elections has now turned significant attention towards the American midterms. The basic method has changed little – impersonate trusted media, manufacture scandals and use networks of inauthentic accounts to distribute them. What has changed is the production technology. Authentic celebrity footage, synthetic voices, manipulated video and rapidly generated fake journalism allow the same operation to produce more tailored material for more candidates at lower cost. The objective does not require Americans to believe every fabrication. Creating uncertainty over which videos, news reports and public statements are authentic can itself degrade trust in the information environment surrounding an election. Sources - Graphika — Russia-Aligned Influence Operation Targets US Midterm Candidates, German State Elections https://www.graphika.com/insights/russia-aligned-influence-operation-targets-us-midterm-candidates-german-state-elections - The New York Times — Russia Aims to Inject Chaos Into Elections, U.S. Intelligence Finds https://www.nytimes.com/2026/09/18/us/politics/russia-election-disinformation-us-intelligence.html - Kathimerini / The New York Times — Russia Aims to Inject Chaos Into Elections https://www.ekathimerini.com/nytimes/1315792/russia-aims-to-inject-chaos-into-elections-us-intelligence-finds/ - CheckFirst — Operation Overload: An AI-fuelled escalation of the Kremlin-linked propaganda effort https://checkfirst.network/operation-overload-an-ai-fuelled-escalation-of-the-kremlin-linked-propaganda-effort/ - CheckFirst — Operation Overload targeting the US election https://checkfirst.network/operation-overload-a-growing-disinformation-threat-now-targeting-the-u-s-presidential-election/ - Lead Stories — Fake NYT videos: Alyssa Milano, Rachael Harris and Sean Astin https://leadstories.com/hoax-alert/2026/09/fact-check-fake-new-york-times-videos-of-alyssa-milano-rachael-harris-sean-astin-falsely-claim-they-support-all-democrats-are-criminals.html - Lead Stories — Fake NYT videos: Leonardo DiCaprio, Eric Braeden and other celebrities https://leadstories.com/hoax-alert/2026/09/fact-check-fake-new-york-times-videos-of-leonardo-dicaprio-eric-braeden-other-celebs-falsely-claim-they-support-all-democrats-are-criminals.html - Brennan Center for Justice — AI Is Changing Foreign Election Influence https://www.brennancenter.org/our-work/analysis-opinion/ai-changing-foreign-election-influence - ODNI — previous US intelligence assessment of foreign election information operations https://www.dni.gov/files/ODNI/documents/assessments/NICM-Declassified-Foreign-Threats-to-US-Elections-After-Voting-Ends-in-2024.pdf - FBI / ODNI / CISA — previous joint assessment of Russian election influence operations https://www.fbi.gov/news/press-releases/joint-odni-fbi-and-cisa-statement-110424 #DISINFORMED #Episode9 #Russia #UnitedStates #USMidterms #Midterms2026 #USElections #ElectionInterference #ForeignInterference #RussianInfluence #RussianDisinformation #OperationOverload #Matryoshka #Disinformation #InformationWarfare #InfluenceOperations #FIMI #ArtificialIntelligence #AI #AIPropaganda #Deepfakes #SyntheticMedia #MediaImpersonation #FakeMedia #FakeNews #PoliticalDisinformation #CelebrityDeepfakes #SocialMediaManipulation #DigitalInfluence #ElectionSecurity #CognitiveWarfare #Graphika #OSINT #Democracy #WRLD

Storm-1516 – Russia’s information war arrives early in France’s 2027 election France will not elect its next president until April 2027, but the information operations surrounding the campaign have already begun. In late July and August 2026, fabricated stories targeted several prominent figures associated with the presidential race, including Raphaël Glucksmann, Gabriel Attal and former prime minister Édouard Philippe. The methods included fake news websites copying established French media, impersonated journalists, AI-generated voices and manipulated video. French authorities identified the Russian operation known as Storm-1516 behind several of these campaigns. Other attacks were linked to Matryoshka, another Russia-aligned influence network. The timing is significant. Storm-1516 began targeting the French presidential environment roughly nine months before the first round, scheduled for 18 April 2027. Rather than a single disinformation campaign, the activity demonstrates how Russian influence networks can establish narratives and infrastructure long before an election reaches its decisive phase. A fake scandal targeting Raphaël Glucksmann One of the clearest examples appeared at the end of July. A website impersonating the French independent outlet Blast published a fabricated investigation claiming that journalist Léa Salamé had attempted to bribe media organisations in exchange for favourable coverage of her partner, Raphaël Glucksmann. The operation went beyond copying the appearance of a legitimate news site. The identities of real journalists were appropriated and a manipulated video used an AI-generated imitation of the voice of Edwy Plenel, founder of Mediapart, supposedly confirming the allegations. The accusation was false. On 4 August, Glucksmann said France's General Secretariat for Defence and National Security, the SGDSN, had informed him that he had been targeted by Storm-1516. Two days later, the Paris prosecutor's office opened an investigation into suspected Russian interference. The importance of the operation was not the quality of one particular deepfake but the construction of several mutually reinforcing elements: a fake media organisation, impersonated journalists, synthetic audio and social-media accounts distributing the material. Together they created the impression that the allegation had been independently corroborated. Different candidates, overlapping Russian networks Édouard Philippe was also targeted by fabricated stories claiming that he suffered from dementia and was medically incapable of running for president. VIGINUM attributed the operation to Storm-1516. Gabriel Attal faced another wave of false content, including fabricated stories mimicking the identities of French outlets such as RFI, BFM TV, France 24, AFP, Le Parisien, Libération and Le Monde. Some claimed that Attal had symptoms of Parkinson's disease or links to drug trafficking. Attribution here is more complicated. French reporting connected at least part of the campaign against Attal to Matryoshka, rather than Storm-1516. A later digitally manipulated video, apparently associated with Storm-1516, used genuine LCI footage from an August debate but added a white earpiece to Attal, suggesting that someone had secretly been feeding him answers. NewsGuard compared the circulating clip with authentic LCI footage and found no earpiece in the original. The distinction is important. France is not facing a single Russian propaganda operation but several overlapping networks using similar techniques and narratives. Treating every manipulation as Storm-1516 would obscure how this ecosystem actually functions. The real weapon is media impersonation The most interesting feature of Storm-1516 is not artificial intelligence itself. It is the systematic appropriation of the credibility of established journalism. Instead of relying only on anonymous Telegram channels or social-media profiles, operators create material that looks as though it originated from organisations audiences already recognise. A fabricated investigation can resemble Blast, a manipulated television report can borrow LCI's visual identity, while fake journalists and social-media accounts provide additional layers of apparent confirmation. VIGINUM has documented this architecture extensively. Its 2025 investigation analysed 77 Storm-1516 information operations and described a mature Russian system using fabricated media, websites and distribution networks to promote anti-Ukrainian and anti-Western narratives. The European External Action Service found that the infrastructure continued to expand. According to its 2026 FIMI Threat Report, Storm-1516 almost doubled its output during 2025. Five networks created that year to target French, German, American, Moldovan and international audiences comprised 453 websites, including fictional news organisations and sites impersonating genuine media or political platforms. A typical operation therefore follows a recognisable pattern: a fabricated allegation is supported by synthetic or manipulated evidence, published through an apparently legitimate source and then distributed by networks of accounts that create the appearance of wider discussion. AI makes this process faster and cheaper, but the fundamental objective remains the same – to manufacture credibility. Why begin nine months before an election? VIGINUM concluded that Storm-1516 is capable both of reacting rapidly to current events and of conducting longer campaigns aimed at discrediting Western institutions and public figures, particularly around elections and other major political events. This provides important context for France. Storm-1516 activity around the presidential race became visible in July 2026, approximately nine months before voting begins. There is no public evidence of a predetermined Russian “nine-month plan”, and the timing should not be presented as such. Early activity nevertheless provides operational advantages: narratives can be tested, websites and accounts established, audience reactions measured and the responses of journalists, authorities and fact-checkers observed. The first operations may therefore also provide information about which themes and techniques are most effective before the campaign enters its decisive months. This remains an analytical interpretation rather than a demonstrated statement of the operators' intentions. Russian operation, but what about the GRU? Attribution requires similar precision. VIGINUM explicitly describes Storm-1516 as a Russian information operation, and French authorities have attributed individual campaigns to it with high confidence. Connections with Russian military intelligence have also been reported. Glucksmann said the SGDSN informed him that the network targeting him was controlled by Russia's GRU, while French media have repeatedly described Storm-1516 as linked to Russian military intelligence. However, VIGINUM's publicly available technical documentation describes Storm-1516 primarily as a Russian information modus operandi, rather than identifying it as a formally established GRU unit. It is therefore well supported to describe Storm-1516 as a Russian influence operation with reported links to military intelligence. Saying simply that Storm-1516 is a GRU unit would go beyond what France's published technical evidence currently establishes. An early warning for the French election There is also no evidence that the operations have so far had a significant effect on French voters. Some of the fabricated material generated only limited engagement, and measuring the real impact of foreign information operations remains extremely difficult. Even a video attracting hundreds of thousands of views does not establish how many viewers believed it or whether it changed political attitudes. The significance of Storm-1516 lies instead in the infrastructure already being deployed. Months before the election, Russian influence networks have been able to test fake newsrooms, synthetic voices, manipulated television footage, candidate-specific narratives and systems for distributing them. The French case illustrates a broader evolution in election interference. The objective is no longer simply to place false claims on social media. Modern operations can manufacture an entire chain of apparent evidence in which a fake journalist cites a fake investigation, synthetic audio appears to confirm it and networks of accounts give the impression that an authentic controversy is unfolding. France still has months to go before its presidential election. The information environment surrounding it is already being contested. Sources: VIGINUM / SGDSN — Storm-1516 analysis https://www.sgdsn.gouv.fr/publications/analyse-du-mode-operatoire-informationnel-russe-storm-1516 VIGINUM / SGDSN — Full Storm-1516 technical report https://www.sgdsn.gouv.fr/files/files/Publications/20250507_TLP-CLEAR_NP_SGDSN_VIGINUM_Technical%20report_Storm-1516.pdf VIGINUM / SGDSN — Storm-1516 operation targeting Emmanuel Macron https://www.sgdsn.gouv.fr/publications/storm-1516-detection-dune-operation-dingerence-numerique-etrangere-ciblant-emmanuel EEAS — 4th Report on FIMI Threats https://www.eeas.europa.eu/sites/default/files/2026/documents/EEAS%204th%20Threat%20Report_web.pdf Le Monde — Russian interference targeting Philippe, Glucksmann and Attal https://www.lemonde.fr/politique/article/2026/08/07/presidentielle-2027-glucksmann-attal-philippe-les-ingerences-russes-s-invitent-dans-la-campagne_6740451_823448.html Le Monde — Storm-1516 and Matryoshka analysis https://www.lemonde.fr/pixels/article/2026/08/06/ingerences-russes-pourquoi-il-ne-faut-pas-nourrir-le-troll_6739956_4408996.html NewsGuard Risk Briefing — Russian activity targeting the French election https://newsguardriskbriefing.substack.com/p/russia-targets-french-elections-iran Euronews — Operation targeting Raphaël Glucksmann https://fr.euronews.com/my-europe/2026/08/04/presidentielle-de-2027-raphael-glucksmann-vise-par-une-operation-de-destabilisation-russe Télérama / AFP — Glucksmann deepfake investigation https://www.telerama.fr/debats-reportages/presidentielle-2027-raphael-glucksmann-vise-par-un-deepfake-d-origine-russe-7032318.php Le Parisien — Operation targeting Gabriel Attal https://www.leparisien.fr/elections/presidentielle/presidentielle-2027-gabriel-attal-a-son-tour-vise-par-une-ingerence-en-provenance-de-russie-05-08-2026-I3Z67Z7ZUBDUVBXUNDARI5KGPA.php Euronews — Paris prosecutor investigations into suspected Russian interference https://fr.euronews.com/my-europe/2026/08/18/soupcons-dingerence-russe-visant-attal-et-philippe-le-parquet-de-paris-ouvre-dune-enquete Keywords: #DISINFORMED #Episode6 #Storm1516 #France #FrenchElection2027 #Disinformation #InformationWarfare #InfluenceOperations #ForeignInterference #FIMI #RussianInfluence #RussianDisinformation #Propaganda #Deepfakes #ArtificialIntelligence #AI #SyntheticMedia #FakeNews #MediaImpersonation #FakeMedia #DigitalManipulation #ElectionInterference #PoliticalDisinformation #Matryoshka #VIGINUM #OSINT #CyberInfluence #DigitalInfluence #MediaManipulation #EuropeanSecurity #Democracy #WRLD