_edited.png)
.png)
Cyber based influence campaigns 01st - 07th June 2026 Report
- CRC
- 15 hours ago
- 24 min read
[Introduction]
Cyber-based hostile influence campaigns are aimed at influencing target audiences by promoting information and/or disinformation over the internet, sometimes combined with cyber-attacks which enhance their effect (hence force Cyfluence, as opposed to cyber-attacks that aim to steal information, extort money, etc.) Such hostile influence campaigns and operations can be considered an epistemological branch of Information Operations (IO) or Information Warfare (IW).
Typically, and as customary during the last decade, the information is spread throughout various internet platforms, which are the different elements of the hostile influence campaign, and as such, connectivity and repetitiveness of content between several elements are the main core characteristics of influence campaigns.
Hostile influence campaigns, much like Cyber-attacks, have also become a tool for rival nations and corporations to damage reputation or achieve various business, political or ideological goals. Much like in the cyber security arena, PR professionals and government agencies are responding to negative publicity and disinformation shared over the news and social media.
We use the term cyber based hostile influence campaigns, as we include in this definition also cyber-attacks aimed at influencing (such as hack and leak during election time), while we exclude of this term other types of more traditional kinds of influence such as diplomatic, economic, military etc.
During the 01st to the 07th of June 2026, we observed, collected and analyzed endpoints of information related to cyber based hostile influence campaigns (including Cyfluence attacks). The following report is a summary of what we regard as the main events. Some of the mentioned campaigns have to do with social media and news outlets solemnly, while others leverage cyber-attack capabilities.
[Contents]
[State Actors]
Russia
The War in Ukraine
China
Iran
[AI Related Articles]
[General Reports]
[Appendix - Frameworks to Counter Disinformation]
[ Report Highlights]
According to an article by DFR Lab, following drone incursions into Latvia and Estonia in March 2026 and another incident in Latvia in May, pro-Russia media and officials promoted claims that the Baltic states had opened their airspace to support Ukrainian drone attacks against Russia.
A three-part investigation by Sekoia reconstructed the cyberespionage group Gamaredon’s 2026 infection chain and clarified its malware ecosystem through a unified taxonomy.
According to NewsGuard’s Reality Check, pro-China social media accounts have circulated claims that American AI company Anthropic has begun allowing users in China to access its Claude chatbot.
According to a report by Insikt Group, Iran’s Ministry of Intelligence has likely expanded its use of the Handala brand beyond cyber activities to include physical threat actors and influence operations targeting U.S. and Israeli interests.
Research by CIR, assisted by other research, found a growing volume of online content portraying London as unsafe, lawless, and in decline.
A survey of campaign professionals found that AI has become a routine part of political operations, with 87% using it daily or several times a week.
A NewsGuard assessment found that Google’s text-to-video model, Gemini Omni, was able to generate realistic videos illustrating several false claims that have circulated online.
Song Xiaoyu's article, published in Scientific Reports, proposes a behavioral game-theoretic model that shows that effective disinformation governance requires penalties severe enough to cross a psychological loss-aversion threshold that shifts platforms from passive to active content moderation.
[ Report Summary]
A NewsGuard investigation identified Turkish freelance journalist Okay Deprem as a significant source of false narratives circulated ahead of Armenia’s June 2026 parliamentary elections.
According to an article by DFR Lab, following drone incursions into Latvia and Estonia in March 2026 and another incident in Latvia in May, pro-Russia media and officials promoted claims that the Baltic states had opened their airspace to support Ukrainian drone attacks against Russia.
A Bellingcat investigation examined the relationship between Viory, an Abu Dhabi-based video news agency that promotes itself as a “video news agency of the Global South,” and Ruptly, a video agency connected to Russian state media outlet RT.
A three-part investigation by Sekoia reconstructed the cyberespionage group Gamaredon’s 2026 infection chain and clarified its malware ecosystem through a unified taxonomy.
The House Committee on Energy and Commerce’s letter has raised concerns about evidence suggesting that foreign influence campaigns may be attempting to slow U.S. artificial intelligence development and the infrastructure needed to support it.
According to NewsGuard’s Reality Check, pro-China social media accounts have circulated claims that American AI company Anthropic has begun allowing users in China to access its Claude chatbot.
According to a report by Insikt Group, Iran’s Ministry of Intelligence has likely expanded its use of the Handala brand beyond cyber activities to include physical threat actors and influence operations targeting U.S. and Israeli interests.
As stated in a Check Point publication, the 2026 U.S. midterm election cycle will likely see increased cyber-related activity targeting the election ecosystem, including campaigns, media organizations, and government services.
As published in a NewsGuard Reality Check, “Uncensored AI” is a chatbot that promotes itself as a source of “unfiltered” and “objective” information, positioning itself as an alternative to mainstream AI models.
Research by CIR, assisted by other research, found a growing volume of online content portraying London as unsafe, lawless, and in decline.
A survey of campaign professionals found that AI has become a routine part of political operations, with 87% using it daily or several times a week.
A NewsGuard assessment found that Google’s text-to-video model, Gemini Omni, was able to generate realistic videos illustrating several false claims that have circulated online.
As revealed by CyberNews, an AI-generated image shared on a Thai police Facebook page falsely depicted officers dressed as drag queens during a drug raid, leading to widespread media coverage of what appeared to be a real undercover operation.
Song Xiaoyu's article, published in Scientific Reports, proposes a behavioral game-theoretic model that shows that effective disinformation governance requires penalties severe enough to cross a psychological loss-aversion threshold that shifts platforms from passive to active content moderation.
According to Recoded Future’s paper, the 2026 FIFA World Cup is expected to face a complex threat environment across the United States, Mexico, and Canada.
The new Defence Strategic Communications journal of the NATO Strategic Communications Centre of Excellence argued that societies need new, credible narratives to address political, economic, and technological transformation.
Meta published that despite a permanent court injunction, NSO Group continued spear phishing operations against journalists, officials, and civil society actors via WhatsApp, prompting Meta to seek a federal contempt order and publish threat indicators.
As published by the Global Government Forum, Gartner predicted that by 2028, 40% of government organizations will establish dedicated “TrustOps” functions to address growing risks from deepfakes and other forms of disinformation.
A webinar organized by the International Federation of Journalists (IFJ) focused on helping journalists identify and respond to misleading climate-related claims.
Check First introduced “Tutki”, a training platform developed to provide realistic OSINT and online investigation exercises based on real-world cases and information environments.
[State Actors]
Russia
Turkish Propaganda Amplifies Russian Misinformation About the Armenian Elections
A NewsGuard investigation identified Turkish freelance journalist Okay Deprem as a significant source of false narratives circulated ahead of Armenia’s June 2026 parliamentary elections. According to the report, 17 of the 43 claims promoted by the pro-Kremlin influence operation Storm-1516 originated with Deprem. These allegations targeted Prime Minister Nikol Pashinyan and included claims about constitutional changes, personal scandals, and concessions to Türkiye and Azerbaijan. Rather than relying on fake websites, many of these stories were first published in established Turkish media outlets, allowing them to appear more credible before spreading across social media and regional news networks.
Armenia has become a major focus of Russian influence efforts as Pashinyan continues to pursue closer ties with the European Union and the West. Researchers found that Storm-1516 directed more narratives at Armenia over the past year than at Ukraine, reflecting Moscow’s concern over Armenia’s geopolitical trajectory. Analysts described the campaign as more sophisticated than previous efforts, combining political messaging with personal attacks designed to influence undecided voters ahead of the election. Several examples highlighted in the investigation involve claims that were later denied or contradicted by available evidence, including allegations concerning Pashinyan’s wife and reports of government approval for an LGBTQ parade. Such stories moved from Turkish media outlets to pro-Kremlin social media accounts and regional news platforms, amplifying their reach.
Source: NewsGuard. How a Turkish Propagandist Powers a Russian Campaign Targeting Armenia’s Elections. [online] Published 4 June 2026. Available at: https://www.newsguardtech.com/special-reports/how-a-turkish-propagandist-powers-a-russian-campaign-targeting-armenias-elections/ (newsguardtech.com)
Russian Information Campaigns Ahead of Armenia’s Elections
According to a report by The Jamestown Foundation, ahead of Armenia’s 07th June parliamentary elections, Russia has pursued a broad campaign to weaken support for Prime Minister Nikol Pashinyan and his Civil Contract party. According to the article, Moscow’s strategy focuses less on securing victory for a single opposition candidate and more on strengthening multiple opposition forces to prevent Civil Contract from achieving a dominant parliamentary position. The elections are widely viewed as a choice between maintaining Armenia’s current pro-Western course and preserving closer ties with Russia.
A central element of this effort has been an extensive information campaign. Reports cited in the article state that pro-Kremlin media channels and the “Matryoshka” network have circulated hundreds of videos and messages targeting Pashinyan, including claims about his health, his policies, and Armenia’s relations with Russia. Many of these narratives portray Pashinyan as endangering Armenia’s stability, risking conflict with Russia, or undermining the country’s national identity, while presenting opposition figures as better suited to maintain relations with Moscow. These messaging efforts have been accompanied by economic pressure. Russia has warned Armenia about the costs of deeper integration with the European Union, threatened higher gas prices, and imposed restrictions on several Armenian exports.
Adding to this subject, a joint investigation by DFRLab and CivilNet examined the activities of the Russian NGO Evrazia in Armenia ahead of the June 2026 parliamentary elections. Evrazia, which has been sanctioned by the United States, European Union, and United Kingdom, is replicating methods previously observed in Moldova. Through humanitarian aid programs, educational initiatives, church-related campaigns, and online platforms, the organization has sought to build networks of influence and mobilize public support around political and social issues. Researchers also highlighted Evrazia’s cooperation with figures linked to the pro-Russian Strong Armenia party.
Source: Jamestown Foundation. Moscow Nervous About Armenian Parliamentary Elections. [online] Published 5 June 2026. Available at: https://jamestown.org/moscow-nervous-about-armenian-parliamentary-elections/ (jamestown.org).
False Narratives Surrounding the Baltic Drone Incursions
According to an article by DFR Lab, following drone incursions into Latvia and Estonia in March 2026 and another incident in Latvia in May (for further information, see W21 May Cyfluence Report), pro-Russia media and officials promoted claims that the Baltic states had opened their airspace to support Ukrainian drone attacks against Russia. These allegations originated in Kremlin-linked media and were later amplified by Russian state television, senior officials, and pro-Kremlin online networks. Baltic governments repeatedly rejected the accusations, stating that their territories and airspace had not been used for attacks on Russia.
The article also documented several false stories that emerged after the 07th May drone incident in Latvia, including claims that a drone had struck a passenger train, hit an apartment building, and caused multiple deaths. Researchers found that these reports were based on unrelated events or unsupported allegations but were widely circulated through Telegram channels, social media accounts, and pro-Kremlin information networks. An analysis of international coverage found that Russia-linked sources generated substantial attention to the drone incidents, particularly in Spanish, Portuguese, French, and Italian-language information spaces. While the narrative gained limited traction among mainstream audiences in NATO countries, it reached wider audiences in parts of Latin America and Africa through a network of media outlets, social media accounts, and republished content.
Source: DFRLab. Russian Narratives about Baltic Drone Incursions Miss Europe, Land in Global South. [online] Published 4 June 2026. Available at: https://dfrlab.org/2026/06/04/russian-narratives-about-baltic-drone-incursions-miss-europe-land-in-global-south/ (dfrlab.org).
Abu Dhabi-Based Video News Agency Links to RT
A Bellingcat investigation examined the relationship between Viory, an Abu Dhabi-based video news agency that promotes itself as a “video news agency of the Global South”, and Ruptly, a video agency connected to Russian state media outlet RT. Viory has rapidly expanded its international presence through partnerships with media organizations, universities, and government institutions across Africa, Asia, and the Middle East. However, the investigation identifies multiple technical connections between Viory and Ruptly, despite both organizations denying any formal relationship. These links include shared IP addresses, the use of a security certificate associated with Ruptly on a Viory-related website, and Ruptly domains sending technical performance data to Viory-controlled infrastructure.
In the broader context of international media influence, Analysts cited in the report note that Viory provides news content and training to media organizations across the Global South and that its coverage often features prominent reporting on Russia, China, and Russia–China cooperation. RT has been sanctioned by the European Union for spreading pro-Kremlin narratives and supporting Russia’s war against Ukraine, and while Viory maintains that it is an independent media company, technical evidence raises questions about its relationship with Ruptly and the transparency of its operations.
Source: Bellingcat. Tracing Digital Links Between Viory and Ruptly. [online] Published 4 June 2026. Available at: https://www.bellingcat.com/news/2026/06/04/viory-ruptly-rt-russia-uae-propaganda-video-news/ (bellingcat.com).
The War in Ukraine
FSB’s “Matryoshka” Cyberespionage Campaign Against Ukraine
Gamaredon, a cyberespionage group operated by Russia’s FSB, continues to conduct long-term intrusion operations against Ukrainian government, military, and critical infrastructure networks. A three-part investigation by Sekoia reconstructed the group’s 2026 infection chain and clarified its malware ecosystem. The first part of the investigation examined Gamaredon, an FSB-linked cyberespionage group targeting Ukrainian government and critical infrastructure networks, focusing on its malware ecosystem, phishing operations, USB-based propagation, and long-term persistence techniques. In the second part and the third parts, researchers analyzed GammaLoad, a multi-layered in-memory loader used to deploy malware while avoiding detection, and GammaSteel, a data-collection tool that monitors drives, USB devices, and active files to gather intelligence from compromised systems.
Combined with fileless execution, extensive use of NTFS Alternate Data Streams, registry-based payload staging, and encrypted storage mechanisms, these capabilities demonstrate a significant evolution in Gamaredon’s tradecraft and provide the group with a resilient platform for long-term espionage against Ukrainian targets.
Sources:
Sekoia.io. FSB’s Matryoshka #1/3 – Gamaredon’s Gifts That Keeps Unpacking – GammaPhish and GammaWorm. [online] Published 1 June 2026. Available at: https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/ (blog.sekoia.io).
Sekoia.io. FSB’s Matryoshka #2/3 – Gamaredon’s Gifts That Keeps Unpacking – GammaLoad. [online] Published 2 June 2026. Available at: https://blog.sekoia.io/fsbs-matryoshka-2-3-gamaredons-gifts-that-keeps-unpacking-gammaload/ (blog.sekoia.io).
Sekoia.io. FSB’s Matryoshka #3/3 – Gamaredon’s Gifts That Keeps Unpacking – GammaSteel. [online] Published 3 June 2026. Available at: https://blog.sekoia.io/fsbs-matryoshka-3-3-gamaredons-gifts-that-keeps-unpacking-gammasteel/ (blog.sekoia.io).
China
Congressional Concerns Over Foreign Influence on U.S. AI Development
The House Committee on Energy and Commerce’s letter has raised concerns about evidence suggesting that foreign influence campaigns may be attempting to slow U.S. artificial intelligence development and the infrastructure needed to support it. Reports from the Bitcoin Policy Institute and Power the Future show that international actors, particularly from China, are working through state media organizations, nonprofit networks, and other channels to shape public opinion and policy discussions related to AI and data center expansion.
According to the reports referenced in the letter, these efforts are accompanied by funding networks that support activist campaigns opposing data center projects and related energy infrastructure. Some groups have sought to delay or block projects through litigation, regulatory challenges, and campaigns targeting the financial mechanisms used to fund infrastructure development. The letter also raises concerns about limited transparency regarding the sources of funding behind some of these activities. Maintaining U.S. leadership in the AI sector requires continued investment in data centers and supporting infrastructure. Therefore, the committee has requested a briefing from the Trump Administration on how it is investigating alleged foreign influence efforts and what steps are being taken to address activities that could hinder the growth of the U.S. AI ecosystem.
Source: U.S. House Committee on Energy and Commerce. Letter to PCAST and FBI on Foreign Influence and AI Data Centers. [online PDF] Published 4 June 2026. Available at: https://d1dth6e84htgma.cloudfront.net/2026_06_04_Letter_to_PCAST_and_FBI_on_Foreign_Influence_AI_Data_Centers_99f6aa6cda.pdf (cloudfront.net).
Misinformation About Anthropic’s Access in China
According to NewsGuard’s Reality Check, pro-China social media accounts have circulated claims that American AI company Anthropic has begun allowing users in China to access its Claude chatbot, portraying the alleged move as evidence that U.S. technology firms cannot ignore the Chinese market despite national security concerns. The narrative was supported by a widely shared screenshot that appeared to show Claude accepting Chinese phone numbers during account registration.
However, the claim is false. Anthropic confirmed that China is not a supported region and that users in China cannot access its products or create Claude accounts using Chinese phone numbers. NewsGuard found no evidence that the company had changed its policy, and multiple China-based users reported being unable to register with Chinese numbers. The authenticity of the viral screenshot could not be verified and may have been manipulated or artificially generated. Anthropic continues to restrict access in China and has previously acted against Chinese state-linked accounts accused of misusing its services. Other major U.S. AI companies, including OpenAI and Google, also do not operate in China for similar national security reasons.
Source: NewsGuard Reality Check. Anthropic’s Fictional Entry into the … [online] Published 5 June 2026. Available at: https://www.newsguardrealitycheck.com/p/anthropics-fictional-entry-into-the (newsguardrealitycheck.com).
Iran
Handala Brand Threat Expands to Support MOIS Operations
According to a report by Insikt Group, Iran’s Ministry of Intelligence (MOIS) has likely expanded its use of the Handala brand beyond cyber activities to include physical threat actors and influence operations targeting U.S. and Israeli interests. The report identified a newly emerged persona, the Handala Popular Resistance Front (HPRF), along with three influence-operation networks that appear to be linked to MOIS through coordinated online activity, cross-promotion, and shared messaging. These entities support a common objective of recruiting individuals for espionage, sabotage, and other operations directed at U.S. and Israeli personnel and assets.
Combining cyber, physical, and influence activities under a single recognizable brand increases the reach and effectiveness of MOIS’s external operations. Handala-linked actors are believed to use online platforms to solicit recruits, amplify operational claims, and promote their capabilities. Looking ahead, Insikt Group assessed that coordination among these different personas may enable more sophisticated operations by integrating cyber intrusions, intelligence gathering, and physical activities into a single campaign. MOIS and other Iranian intelligence and military entities will likely continue conducting cyber, influence, espionage, and physical operations against U.S. and Israeli targets regardless of developments in the Iran War.
Source: Recorded Future, Insikt Group. TA-IR-2026-0602. [online PDF] Published 2 June 2026. Available at: https://assets.recordedfuture.com/insikt-report-pdfs/2026/TA-IR-2026-0602.pdf
[AI Related Articles]
2026 U.S. Midterm Election Threat Outlook
As stated in a Check Point publication, the 2026 U.S. midterm election cycle will likely see increased cyber-related activity targeting the election ecosystem, including campaigns, media organizations, and government services. Rather than focusing primarily on voting systems, threat actors are expected to target trusted accounts, public-facing platforms, and information channels that play a key role in shaping public trust and communications. A major concern is the growing use of phishing, impersonation, and coordinated misinformation campaigns. Election-themed websites, fraudulent donation pages, AI-generated content, and more misleading online narratives are expected to be used to influence public perception. These tactics are relatively inexpensive and can generate significant political and psychological effects without directly compromising election infrastructure.
In the foreign influence field, Russia, Iran, and China were identified as the principal state-linked actors associated with risks of foreign interference. Overall, the most significant threat to the 2026 election environment is the cumulative impact of disruption and manipulation across the channels that voters, campaigns, media outlets, and public institutions rely on for accurate information.
Source: Check Point Research. 2026 U.S. Midterm Election Threat Outlook. [online PDF] Published June 2026. Available at: https://checkpoint.cyberint.com/hubfs/2026%20U.S.%20Midterm%20Election%20Threat%20Outlook.pdf (checkpoint.cyberint.com).
Uncensored AI Accelerates the Spread of Conspiracy Theories
As published in a NewsGuard Reality Check, “Uncensored AI” is a chatbot that promotes itself as a source of unfiltered and objective information, positioning itself as an alternative to mainstream AI models. Although its user base is relatively small, its responses have been widely shared by prominent conservative social media influencers, giving visibility to claims about topics such as the 2020 U.S. election, assassination attempts against President Trump, and the killing of commentator Charlie Kirk.
According to NewsGuard, several influencers cited Uncensored AI as an authoritative source when sharing claims that contradict established findings and official investigations. Examples include assertions that the 2020 election was rigged, that Trump assassination attempts were staged, and that Israeli intelligence was involved in Kirk’s murder. These claims lack supporting evidence and conflict with conclusions reached by law enforcement, courts, and other official investigations.
NewsGuard also tested the chatbot on several well-known conspiracy theories and found that it endorsed claims that the 1969 moon landing was faked, that the 11th of September attacks involved Mossad and elements of the U.S. government, and that COVID-19 vaccines caused millions of deaths. Chatbot-generated responses can be presented as independent analysis, potentially increasing the perceived credibility of claims when they are amplified by influential online accounts.
Sources: NewsGuard Reality Check. Uncensored AI Chatbot Pushes Conspiracy Theories. [online] Published 5 June 2026. Available at: https://www.newsguardrealitycheck.com/p/uncensored-ai-chatbot-pushes-conspiracy (newsguardrealitycheck.com). (euronews.com)
Online Disinformation About London
Research by CIR, assisted by other research, found a growing volume of online content portraying London as unsafe, lawless, and in decline. Across platforms including X, Facebook, Instagram, YouTube, and TikTok, posts frequently use misleading, exaggerated, or decontextualized information to link crime, social disorder, and cultural change to immigrant and minority communities. The study identified five recurring themes: London as unsafe, anti-immigration narratives, Islamophobia, “Great Replacement” conspiracy theories, and nostalgia for a perceived better past.
One of the findings was the widespread use of AI-generated content to reinforce these narratives. Examples included fabricated scenarios depicting immigrants receiving special treatment, fictional futures in which London is “taken over” by specific ethnic groups, and staged “street interviews” that present misleading claims about migrants and asylum seekers. By mimicking authentic footage or citizen journalism, this content makes false narratives appear more credible to online audiences. These narratives are often amplified through comment sections, where users repeat claims about demographic change, crime, and cultural decline, sometimes alongside extremist rhetoric or calls for action. The narratives even extend beyond UK audiences and are increasingly reaching international users. Misleading content about London is frequently intertwined with anti-immigration, anti-Muslim, and conspiracy-based themes, contributing to social polarization and reinforcing perceptions of conflict between different communities.
Sources: InfoRes (Centre for Information Resilience). London Has Fallen: How Online Disinformation Distorts Perceptions of Safety in the Capital. [online] Published 5 June 2026. Available at: https://www.info-res.org/cir/articles/london-has-fallen-how-online-disinformation-distorts-perceptions-of-safety-in-the-capital/ (info-res.org).
AI Use in Political Campaigns
A survey of campaign professionals found that AI has become a routine part of political operations, with 87% using it daily or several times a week. The most common applications are internal functions such as research, news monitoring, and drafting content rather than direct voter engagement. At the same time, 75% of respondents identified inaccurate or misleading AI outputs as their biggest concern, reflecting broader worries about the reliability of AI-generated information in political contexts.
Results showed growing attention to how AI systems handle political information and civic questions. AI companies are taking steps to improve the quality of election-related responses and direct users to authoritative sources, but concerns remain about transparency, source selection, and the accuracy of information provided to voters. The survey also found a gap between voter expectations and campaign practices regarding AI transparency. While most voters consider disclosure of AI-generated content important, only a small share of campaigns consistently disclose such use, and one-third of campaign professionals report having no formal AI policy. According to the author, more public disclosure is needed regarding how AI companies make decisions about political content and what measures they use to address errors and misinformation. Additionally, campaigns should develop clear governance and disclosure frameworks as AI becomes more deeply integrated into political research, communications, voter outreach, and campaign operations.
Sources: Anchor Change. What Campaign Professionals Told Us About AI-Generated Content. [online] Published 5 June 2026. Available at: https://anchorchange.substack.com/p/what-campaign-professionals-told (anchorchange.substack.com). (anchorchange.com).
Gemini Omni Generates Videos Advancing False Online Claims
A NewsGuard assessment found that Google’s text-to-video model, Gemini Omni, was able to generate realistic videos illustrating several false claims that have circulated online. In seven out of ten tested prompts, the model produced videos depicting inaccurate narratives related to topics such as the Iran war, migration, international shipping, and geopolitical events. The examples included videos portraying a false claim that Somalia had blocked Israeli ships from passing through the Bab el-Mandeb Strait, a fabricated story about migrants receiving free PlayStations in the UK, and so on. The model also generated videos connected to inaccurate narratives about military events and major companies.
At the same time, the report found that some safeguards were effective. Gemini Omni consistently refused requests involving false health-related claims and generally declined to generate videos depicting specific public figures. While the model has stronger protections than some earlier AI image and video generators, the findings suggested that realistic AI-generated videos can still be used to create persuasive visual content around inaccurate claims, particularly on political, geopolitical, and social issues.
Sources: NewsGuard Reality Check. Google’s New AI Video Model Churns Out Misinformation. [online] Published 6 June 2026. Available at: https://www.newsguardrealitycheck.com/p/googles-new-ai-video-model-churns (newsguardrealitycheck.com).
AI-Generated Police “Drag Queen Raid” Story Misleads Global Media
As revealed by CyberNews, an AI-generated image shared on a Thai police Facebook page falsely depicted officers dressed as drag queens during a drug raid, leading to widespread media coverage of what appeared to be a real undercover operation. The viral post showed five men and one woman in costumes surrounding a detained suspect and was picked up by major outlets, including The Sun, The Telegraph, The Mirror, and The New York Post, before being revealed as fake.
Thai police later confirmed that the image was AI-generated and not an authentic depiction of the arrest, although the underlying drug arrest itself was real. The post originated from a local police station administrator who reportedly intended it as a humorous way to make police work seem more approachable. However, because it came from an official source, it was widely accepted as genuine and quickly spread across international media. Experts noted that the image contained inconsistencies that could have raised suspicion, but its official origin helped it appear credible at first glance, demonstrating how authority can amplify the impact of synthetic media.
Sources: Cybernews. Thai Police Use AI-Generated “Drag Raid” Photo in Anti-Drug Campaign Hoax. [online] Published 6 June 2026. Available at: https://cybernews.com/ai-news/thai-police-ai-drag-raid-photo-hoax/ (cybernews.com).
[General Reports]
2026 FIFA World Cup Threat Outlook
According to Recoded Future’s paper, the 2026 FIFA World Cup is expected to face a complex threat environment across the United States, Mexico, and Canada. Physical security remains the primary concern due to the scale of the event and the concentration of large crowds. Cybercriminal activity is also expected to increase as the tournament approaches. The report also assessed that Russian, Chinese, and Iranian state-sponsored groups may use the tournament as an intelligence-gathering opportunity.
World Cup-related influence activity observed so far has been largely overt and driven through state media and diplomatic messaging, focusing on issues such as host-country legitimacy, public safety, immigration, visa access, ticketing, and Iran’s participation. While covert activity has remained limited, it could increase in response to geopolitical developments or major news events during the tournament.
Source: Recorded Future, Insikt Group. CTA-2026-0604. [online PDF] Published 4 June 2026. Available at: https://assets.recordedfuture.com/insikt-report-pdfs/2026/CTA-2026-0604.pdf (recordedfuture.com).
NATO’s Defence Strategic Communications Journal
The new Defence Strategic Communications journal of the NATO Strategic Communications Centre of Excellence reflected on growing concerns about the decline of the post-World War II liberal international order. It argued that societies need new, credible narratives to address political, economic, and technological transformation. Drawing on discussions from the Knowledge Economy Transition by 2045 dialogue at Cambridge, participants emphasized the importance of legitimacy, strategic communication, and long-term storytelling in shaping future political and economic systems. Effective narratives must be rooted in authentic ideas and practical solutions rather than slogans, particularly as societies confront challenges such as geopolitical competition, AI, climate change, and declining trust in institutions.
A significant place was given to the changing information environment. The foreword highlighted concerns about AI, algorithmic influence, microtargeting, and emerging neurotechnology's, arguing that these developments are reshaping how people form opinions, build consensus, and understand reality. It also noted the growing role of state-sponsored influence campaigns and information manipulation, particularly through the concept of Foreign Information Manipulation and Interference (FIMI), which emerged in response to systematic efforts by state actors to shape public perceptions and political discourse.
Strategic communication should help societies develop shared understanding and legitimacy during periods of disruption. Several contributions to the journal explored topics including foreign information manipulation, international cooperation against influence operations, hybrid threats, media objectivity, and the role of narratives in democratic resilience. The authors stress the need for stronger frameworks to understand how information, technology, and political power interact in an increasingly contested global environment.
Source: NATO Strategic Communications Centre of Excellence. Defence Strategic Communications | Volume 15, Spring 2025. [online] Published 4 June 2025. Available at: https://stratcomcoe.org/publications/defence-strategic-communications-volume-15-spring-2025/322 (stratcomcoe.org). (stratcomcoe.org)
Modeling the Strategic Logic of Disinformation Governance
Song Xiaoyu's article, published in Scientific Reports (2026), proposes a tripartite evolutionary game model to analyze strategic behavior in online disinformation governance. The three actors modeled are regulators, social media platforms, and self-media operators, the last referring to independent or semi-professional content producers who function as primary vectors for disinformation spread. The core methodological contribution is the integration of Prospect Theory into the game-theoretic framework, replacing the standard assumption of rational utility maximization with a behaviorally grounded model that accounts for loss aversion and diminishing sensitivity to outcomes. This allows the model to capture how subjective perception of risk and loss, rather than objective cost-benefit calculation, drives each actor's strategic choices in an environment characterized by high uncertainty, such as an unfolding public opinion crisis.
The paper maps the disinformation ecosystem as a dynamic equilibrium problem. Self-media operators choose between truthful, verified reporting and false or unverified reporting, with the latter driven by traffic incentives, urgency, and low verification costs. Platforms choose between active content moderation and passive response, with governance inertia explained not as irresponsibility but as rational risk-aversion under insufficient regulatory pressure. Regulators choose between proactive information disclosure and silence, with silence producing credibility erosion, and public distrust. The model's replicator dynamics equations demonstrate that the system converges to an ideal cooperative equilibrium, where all three actors adopt proactive strategies, only under specific parameter conditions: sufficiently high reward-penalty intensity, strong initial participation willingness, and a loss aversion coefficient exceeding a critical threshold of approximately 2.25. Below this threshold, platforms default to passive governance; above it, fear of reputational and legal consequences outweighs the costs of active moderation.
Numerical simulations conducted in MATLAB confirm several policy-relevant findings. First, initial willingness across actors significantly accelerates convergence toward cooperative governance, suggesting that norm-building and pre-crisis coordination have structural effects on disinformation resilience. Second, the relationship between loss aversion and platform behavior is non-monotonic: moderate loss aversion reinforces passivity, while high loss aversion triggers proactive moderation, a dynamic with direct implications for regulatory design, since sanctions must cross a perceptual threshold to alter platform behavior. Third, reward-penalty intensity must reach what the paper terms a "perceived tipping point" to achieve synchronized responses across all three actors. The model's limitations include reliance on theoretically assumed rather than empirically calibrated parameters and a simplified treatment of platform-regulator interaction that does not fully account for legal-obligation structures or dynamic content-moderation costs.
Source: Nature Portfolio. A Prospect-Theoretic Evolutionary Game Approach for Disinformation Governance in Social-Media Ecosystems. Scientific Reports. [online] Published 3 June 2026. Available at: https://www.nature.com/articles/s41598-026-53697-9 (nature.com).
NSO Group Breaks Court Order, Targets Journalists and Officials via WhatsApp
Meta published that WhatsApp's June 2026 update discloses that NSO Group, a commercial spyware firm placed on the US government's Entity List for activities contrary to national security, continued offensive cyber operations against WhatsApp users despite a permanent federal injunction barring it from doing so. The tactics employed included spear phishing via malicious links that redirected targets to external websites outside the WhatsApp environment, consistent with previously documented one-click phishing campaigns associated with NSO's Pegasus platform. NSO-linked actors also created fraudulent test accounts and groups on WhatsApp as part of their targeting infrastructure. WhatsApp is now seeking a federal contempt order against NSO and has published three malicious domains used in the operation as threat indicators.
NSO's CEO confirmed in court that the company actively seeks access vectors beyond WhatsApp, targeting browsers, operating systems, and other applications, with a reported target set that includes journalists, government officials, military personnel, and humanitarian organizations, a profile consistent with state-adjacent surveillance operations designed to suppress information flows and enable intelligence gathering against civil society. The article frames commercial spyware as a structural threat to secure communications infrastructure and argues that no single platform can counter it unilaterally. WhatsApp's response centers on a multi-stakeholder coalition of security researchers, digital rights organizations, and legal advocates, alongside financial support to the Spyware Accountability Initiative, positioning coordinated institutional action across legal, technical, and civil society domains as the necessary framework for defense.
Source: Meta. Fighting Spyware: An Update from WhatsApp. [online] Published 5 June 2026. Available at: https://about.fb.com/news/2026/06/fighting-spyware-an-update-from-whatsapp/ (about.fb.com).
[Appendix - Frameworks to Counter Disinformation]
Using TrustOps in Governments' Fight Against Deepfakes and Disinformation
According to a Global Government Forum publication, Gartner predicted that by 2028, 40% of government organizations will establish dedicated “TrustOps” functions to address growing risks posed by deepfakes, impersonation, social engineering, and other forms of disinformation. To counter these threats, Gartner recommended creating trust-focused governance structures, strengthening high-risk business processes, and implementing procedures to verify the content. The firm also highlighted technologies such as the C2PA standard, which can help authenticate the origin and integrity of digital content through cryptographic provenance data. These measures are intended to help governments move from reacting to false information toward proactively building trust in official communications.
Concerns about AI-generated disinformation are already influencing public policy and debates. In the UK, efforts are underway to develop frameworks to detect harmful deepfakes, while recent research in London identified a sharp increase in online narratives portraying the city as unsafe or in decline. The analysis found signs of coordinated activity, including repetitive posting and AI-generated content used to amplify misleading claims, with some activity linked to extremist groups and accounts aligned with foreign state interests.
Source: Global Government Forum. Growth of Government ‘TrustOps’ Predicted in Fight Against Deepfakes and Disinformation. [online] Published 5 June 2026. Available at: https://www.globalgovernmentforum.com/growth-of-government-trustops-predicted-in-fight-against-deepfakes-and-disinformation/ (globalgovernmentforum.com).
Tools for Addressing Climate Misinformation in Reporting
A webinar organized by the International Federation of Journalists (IFJ) focused on helping journalists identify and respond to misleading climate-related claims. Climate scientist Emmanuel Vincent of Science Feedback emphasized that media outlets are often targeted because they remain trusted sources of information. Using examples such as the claim that “global warming stopped for 18 years”, he demonstrated how the selective use of data can create misleading narratives that ignore broader scientific evidence and long-term trends.
The session highlighted practical resources journalists can use to verify climate-related information. Recommended sources included the IPCC, NASA, NOAA, Carbon Brief, and Climate Brink for scientific information, as well as fact-checking and research tools such as the International Fact-Checking Network (IFCN), InfluenceMap, DeSmog’s Climate Disinformation Database, Retraction Watch, and PubPeer. Vincent also stressed the importance of evaluating the credibility of sources, checking for conflicts of interest, and investigating the background of individuals making climate-related claims. Speakers also warned against “false balance” in reporting, arguing that presenting climate science and climate skepticism as equally supported positions can mislead audiences. Journalists were encouraged to challenge inaccurate claims with evidence and prepare thoroughly before interviews.
Source: International Federation of Journalists (IFJ). Climate: Tips and Tools to Help Journalists Counter Disinformation. [online] Published 5 June 2026. Available at: https://www.ifj.org/media-centre/news/detail/category/unesco-climate/article/climate-tips-and-tools-to-help-journalists-counter-disinformation (ifj.org).
Training Platform to Investigate Online Influence Campaigns
Check First introduced “Tutki”, a training platform developed to provide realistic OSINT and online investigation exercises based on real-world cases and information environments. The platform allows trainers to create custom scenarios or use templates inspired by actual influence campaigns, helping participants develop practical investigative skills. It supports multiple languages and has been used in contexts such as election-related information environments, including work with Armenian civil society organizations.
A key feature of Tutki is its simulation of social media platforms. Instead of relying on live content, which may be deleted, moderated, or contain harmful material, the platform recreates realistic online environments where participants can safely investigate posts, accounts, and networks. This approach improves consistency across training sessions and reduces exposure to graphic or disturbing content while preserving the experience of conducting authentic online investigations. Tutki also includes professional OSINT tools such as cross-platform search, timeline analysis, network visualization, and coordinated inauthentic behavior detection. In 2026, it was used in a training exercise for Radio France journalists involving a fictional foreign interference scenario linked to local elections. The platform is designed both for organizations seeking tailored training and for independent trainers who want to run their own investigation exercises.
Source: CheckFirst. Introducing Tutki: We Simulated Social Media to Teach How It Gets Weaponised. [online] Published 5 June 2026. Available at: https://checkfirst.network/introducing-tutki-we-simulated-social-media-to-teach-how-it-gets-weaponised/ (checkfirst.network). (checkfirst.network)
[CRC Glossary]
The nature and sophistication of the modern Information Environment is projected to continue to escalate in complexity. However, across academic publications, legal frameworks, policy debates, and public communications, the same concepts are often described in different ways, making collaboration, cooperation, and effective action more difficult.
To ensure clarity and establish a consistent frame of reference, the CRC is maintaining a standard glossary to reduce ambiguity and promote terminological interoperability. Its scope encompasses foundational concepts, as well as emerging terms relating to Hostile Influence and Cyfluence.
As a collaborative project maintained with input from the community of experts, the CRC Glossary is intended to reflect professional consensus. We encourage you to engage with this initiative and welcome contributions via the CRC website.
