_edited.png)
.png)
Cyber based influence campaigns 5th – 11th October 2026 Report
[Introduction]
Cyber-based hostile influence campaigns are aimed at influencing target audiences by promoting information and/or disinformation over the internet, sometimes combined with cyber-attacks which enhance their effect (hence force Cyfluence, as opposed to cyber-attacks that aim to steal information, extort money, etc.) Such hostile influence campaigns and operations can be considered an epistemological branch of Information Operations (IO) or Information Warfare (IW).
Typically, and as customary during the last decade, the information is spread throughout various internet platforms, which are the different elements of the hostile influence campaign, and as such, connectivity and repetitiveness of content between several elements are the main core characteristics of influence campaigns.
Hostile influence campaigns, much like Cyber-attacks, have also become a tool for rival nations and corporations to damage reputation or achieve various business, political or ideological goals. Much like in the cyber security arena, PR professionals and government agencies are responding to negative publicity and disinformation shared over the news and social media.
We use the term cyber based hostile influence campaigns, as we include in this definition also cyber-attacks aimed at influencing (such as hack and leak during election time), while we exclude of this term other types of more traditional kinds of influence such as diplomatic, economic, military etc.
During the 5th to 11th of October 2026, we observed, collected and analyzed endpoints of information related to cyber based hostile influence campaigns (including Cyfluence attacks). The following report is a summary of what we regard as the main events. Some of the mentioned campaigns have to do with social media and news outlets solemnly, while others leverage cyber-attack capabilities.
[Contents]
X
Tiktok
Russia
UK Prime Minister Confirms Russian Involvement in Brexit Vote
Matryoshka Bots Target Macron and Merz With Fake Media Clips
Self-Styled Israeli Think Tank Tied to Russian Influence Operation
Russian Disinformation Targets Baltic Elections Through Security Fears
Pro-Russian Hackers Hit Italian Foreign Ministry After Moscow Rebuke
China
Iran
[ Report Highlights]
OpenAI rated a Russia-origin operation that ran a front think tank in Latin America as Category 5, the first such operation it has disrupted.
UK Prime Minister Andy Burnham said he was told there was Russian involvement in the 2016 Brexit referendum, the Observer reported.
Montenegro detained Rybar founder Mikhail Zvinchuk on suspicion of spreading Russian influence and was reported to be expelling him.
Kremlin-linked Matryoshka bots used fake Bellingcat, RFI and ISW content to target Macron and Merz, The Insider reports.
France summoned Iran's ambassador over what it called a disinformation campaign by Iranian foreign ministry accounts on the French student protests.
Canada, Lithuania and the EEAS withdrew their logos from the #Disinfo2026 conference after a panel asked whether the US is a source of FIMI.
A Ukrainian NGO found 981 suspected AI-generated Russian propaganda songs on streaming platforms, with almost 87 million plays across 608 tracks.
[ Report Summary]
Brazil's electoral court gave Meta 48 hours to explain whether it reduced the reach of Lula's campaign posts, which Meta calls a false accusation.
MPF exposed a partly AI-driven network of about 1,200 X accounts, since shut down by X, which it assesses as a state actor bought from an East Asian company.
Following appeals from Ukraine's Center for Countering Disinformation, TikTok removed more than 1,000 posts linked to Russia's Alabuga drone-production zone.
Andy Burnham said he received 'the clear answer' that there was Kremlin involvement in the 2016 Brexit referendum, the Observer reported.
The Kremlin-linked Matryoshka network circulated videos falsely attributed to ISW, RFI, NewsGuard and Bellingcat to portray Macron as militaristic and weak and Merz as corrupt.
Montenegro detained Rybar founder Mikhail Zvinchuk, reportedly on suspicion of spreading Russian influence, with local media saying he would be expelled on security grounds.
An investigace.cz investigation details how the International Burke Institute, which OpenAI and Meta link to a Russian operation, listed experts without consent and placed sponsored content.
A Refute report finds Russia-linked campaigns around Estonian and Latvian elections attached fabricated claims to real security debates rather than targeting candidates.
An EU-supported monitoring report finds pro-Russian channels spread false claims this summer about EU protection for Ukrainians, Polish relations and European militarisation.
EUvsDisinfo reports that Lavrov revived Bucha denial narratives at the UN General Assembly, while pro-Kremlin outlets pushed child-trafficking and 'Nazi Ukraine' claims.
Ukraine's SBU says Russian intelligence creates fake sites and channels mimicking Ukrainian agencies, officials, and media to spread disinformation and harvest personal data.
A researcher tells RSF that Chinese state-coordinated media in training data produces more pro-PRC outputs from Western chatbots, especially when queried in Chinese.
A China Brief analysis argues that the PRC's planned 5.5-acre London embassy could consolidate united front, influence and intelligence operations under diplomatic immunity.
France summoned Iran's ambassador over what it called a disinformation campaign by official Iranian foreign ministry accounts targeting the French student protests.
Golden Owl documents a coordinated network of at least 694 X accounts before Israel's 27 October election, attributing 445 with high or medium-high confidence to Iran.
NewsGuard counted 64,500 X posts in one week mentioning FlyDubai alongside 'staged', 'fake' or 'false flag', although no evidence supports such claims.
The pro-Kremlin 'No Name' collective attacked Italy's foreign ministry website hours after Moscow rebuked Tajani's warnings about election interference, without disrupting services.
OpenAI banned Russia-origin accounts behind 'Dark Clark', which appears to have run a Latin American front think tank and claimed fakes that apparently drew official denials.
Delhi Police arrested a 24-year-old self-described journalist accused of using AI tools to fabricate CCTV-style footage falsely implicating an ACP in sexual misconduct.
A state senator's complaint over an AI deepfake ad has created a precedent-setting case on whether the ad counts as satire under Colorado's deepfake disclaimer law.
Kyiv-based NGO Terrecon found 981 suspected AI-generated Russian propaganda tracks on major streaming platforms, with almost 87 million plays across 608 tracks.
NewsGuard identified seven midterm video ads in Iowa, Ohio and Alabama citing secretly partisan 'pink slime' news sites as if they were independent sources.
NewsGuard found four false claims using mislabelled videos to exaggerate France's student protests, while Russia's Matryoshka produced 20 fake reports that appear to have drawn little traffic.
Logos of the EEAS, Canada and Lithuania were taped over at the Vilnius #Disinfo2026 conference amid questions over a panel on whether the US is a FIMI source.
DW Fact Check found viral claims about a plague leak at an Irkutsk institute unproven, and posts linking a WHO update and old video to it misleading.
CFR's James Lindsay argues that Russia, China and Iran still pursue influence operations against the midterms while Washington has scaled back its counter-influence capacity.
A Foreign Affairs essay argues that Russia, China and Iran now combine state media, fake personas, influencers and AI in integrated 'full-spectrum propaganda'.
Denmark is introducing a copyright amendment banning the sharing of realistic deepfakes of people's faces and voices without consent, with satire exceptions.
The EU-funded FIMI-RESIST project will evaluate 20 existing European anti-disinformation tools against common benchmarks over 30 months with about EUR 3.5 million.
Google made its SynthID Detector available globally in English, letting anyone check whether media was made with AI from Google or partners such as OpenAI.
Sweden's first national psychological defence strategy sets 2030 objectives for countering FIMI, sustaining the will to defend and preparing media for crises.
[State Actors]
Brazil Court Orders Meta to Explain Alleged Curbs on Lula Posts
A France 24 article says the campaign of Brazilian President Luiz Inacio Lula da Silva accused Meta of election interference after the company allegedly restricted his content on its platforms ahead of the October 25 run-off against Senator Flavio Bolsonaro. The campaign said Meta 'prevented President Lula's profile from promoting Instagram feed posts', that one post 'experienced an interruption in view counts', and that before the first round the profiles of Lula and other leftist leaders 'suddenly disappeared from Instagram's search function'.
Brazil's Superior Electoral Court (TSE) gave Meta 48 hours to clarify whether it reduced the reach of the campaign's posts, ordering it to 'report, profile by profile, all the measures applied' to Lula's official accounts and to 'explain the anomalies in the metrics'. Meta's Brazil office called the charges 'simply false' and 'not supported by the facts'. At the same time, Meta told AFP in an email that many of the technical issues 'did not affect only Brazil or specific accounts'. Lula's campaign has also filed a complaint with the electoral court over the alleged blocks, as the leftist leader, who does not use a mobile phone, pushes a new social media campaign after the first round.
Source: France 24. Brazil’s Lula Accuses Social Media Giant Meta of Election Interference Amid Tight Campaign. [online] Published 11 October 2026. Available at: https://www.france24.com/en/americas/20261011-brazil-lula-accuses-social-media-giant-meta-election-interference-amid-tight-run-campaign
X
Partly AI-Driven 'Holiday' Bot Network on X Targeted Sweden
A report published by the Swedish Psychological Defence Agency (MPF) states that it identified a partly AI-driven bot network of about 1,200 accounts on X, working name 'Holiday', which was used in 2025 and 2026 for malign information influence against Sweden and several other countries, made over 50,000 posts, comments and shares, and acted in a clearly polarising way, with some accounts strongly positive and others strongly negative on the same political issues. The network started with about 200 accounts in spring 2025, including around 60 posing as Swedish users with AI-generated profile pictures, and after a pause in late 2025 returned larger, active around the clock, and took part in pile-ons against Swedish politicians and public figures, authorities, companies or media outlets.
MPF assesses that a state actor bought the network from a company in East Asia; it cites clear indications that the network was created by an East Asian provider, which sells inauthentic account populations, doxxing and smear campaigns via Telegram, and says it has evidence that a state actor ordered the network, but no definitive technical attribution has been made. Detection came after Sweden's central bank, the Riksbank, spotted suspicious accounts following an MPF exercise, and after MPF and the Post and Telecom Authority (PTS), Sweden's Digital Services Act coordinator, alerted X, the platform judged that the accounts broke its rules on coordinated inauthentic behaviour and shut them all down in summer 2026. MPF presents the case as an example of disinformation-as-a-service, noting that some of the accounts had earlier been used in campaigns against other audiences, including in the US, China and Taiwan.
Source: Swedish Psychological Defence Agency (MPF). Nätverket Holiday – ett exempel på hur AI används för otillbörlig informationspåverkan. [online] Published 31 August 2026. Available at: https://mpf.se/publikationer/publikationer/2026-08-31-natverket-holiday--ett-exempel-pa-hur-ai-anvands-for-otillborlig-informationspaverkan
Tiktok
TikTok Removes Over 1,000 Alabuga-Linked Posts
An article published by UNN states that, following appeals from Ukraine's Center for Countering Disinformation (CCD), TikTok removed more than 1,000 videos and photo posts linked to Russia's Alabuga special economic zone for violating the platform's rules. According to the CCD, measures were also taken against more than 40 accounts, six of which were blocked for violating rules concerning the exploitation of people.
The CCD said TikTok had improved its systems for automatically detecting such content to prevent deleted material from being re-uploaded, and that an investigation into a possible network of accounts is ongoing. UNN describes Alabuga as a special economic zone in Tatarstan where large-scale production of Shahed/'Geran' attack drones has been launched, and states that minors are involved in the production.
Source: Ukrainian National News (UNN). TikTok Removed More Than 1,000 Posts Linked to Russia’s Alabuga and Blocked Six Accounts. [online] Available at: https://unn.ua/en/news/tiktok-removed-more-than-1000-posts-linked-to-russias-alabuga-and-blocked-six-accounts
Russia
UK Prime Minister Confirms Russian Involvement in Brexit Vote
An article published by The Kyiv Independent states that UK Prime Minister Andy Burnham confirmed Kremlin involvement in the 2016 referendum on leaving the European Union, according to an Observer report of October 11th. Burnham said that when he became prime minister in July, he asked about Kremlin involvement and was given 'the clear answer that, yes, there was', making the comments on The Rest is Politics podcast in an episode set for release on October 12th.
The article notes this would be the first public acknowledgment by a British prime minister of Russia's role in the Brexit campaign, in which 52 percent voted to leave. Burnham framed the disclosure as a warning to other European democracies: 'These things are important now to put clearly on the record and, I believe, help voters in Germany and France understand that some of this politics is instigated via our enemies, namely Russia.' The comments came days after he met German Chancellor Friedrich Merz in Berlin, as the pro-Russian Alternative for Germany party enjoys record support and won elections in Saxony-Anhalt and Mecklenburg-West Pomerania in September.
Source: The Kyiv Independent. Russia Behind Britain’s Brexit Vote, UK Prime Minister Admits for First Time. [online] Available at: https://kyivindependent.com/russia-behind-britains-brexit-vote-uk-prime-minister-admits-for-first-time-2/
Matryoshka Bots Target Macron and Merz With Fake Media Clips
An article published by The Insider states that the Kremlin-linked Matryoshka bot network launched a new wave of disinformation against French President Emmanuel Macron and German Chancellor Friedrich Merz, in posts collected by the bot-monitoring project AntiBot4Navalny. After France's October 6th ballistic missile test, videos falsely attributed to ISW president Kimberly Kagan accused Macron of 'toxic masculinity', a fake RFI clip claimed he waves 'cardboard missiles', and a video falsely attributed to NewsGuard claimed the test footage was AI-generated, while fake Bellingcat content alleged that Merz pockets at least 25 percent of every aid tranche to Ukraine.
The campaign pushed contradictory messages, portraying Macron as both overly militaristic and dangerously weak, and tied the missile test to French student protests that were in fact driven by education problems. After Merz announced a 1 billion euro aid package, further fakes claimed his approval rating had fallen 23 percent and predicted that unrest would spread to Germany. AntiBot4Navalny argues that such posts may offer clues about the issues currently concerning the Kremlin, since bot networks can indicate which topics it wants amplified, and The Insider explains that Matryoshka layers identical content across multiple platforms and borrows Western media logos to appear credible.
Source: The Insider. Kremlin-Linked Matryoshka Bots Accuse France’s Macron of Militarism and Germany’s Merz of Profiting from Aid to Ukraine. [online] Published 8 October 2026. Available at: https://theins.press/en/news/298069
Montenegro Detains Founder of Pro-Kremlin Rybar Blog
An article published by The Guardian states that Mikhail Zvinchuk, founder of the pro-Kremlin Rybar war blog with reported ties to Russia's intelligence services, was detained with his wife and three other Russians in the resort town of Risan on suspicion of spreading Russian influence, according to local media. Prime Minister Milojko Spajić said the detention followed warnings that Montenegro would face attempts at destabilisation and hybrid warfare, and the outlet Vijesti reported that the detainees were to be expelled on national security grounds.
Rybar, founded in 2018 by a former Russian defence ministry press officer, has more than 1.5 million Telegram subscribers and promotes pro-Kremlin narratives beyond Ukraine, including in Africa and the Middle East, and has been accused of amplifying far-right narratives about migration in Ceuta. Britain sanctioned Zvinchuk and Rybar in December 2025, saying he received funding from Rostec and worked with members of Russia's intelligence services, and the US has accused him of attempting to interfere in the 2024 presidential election. Kremlin spokesperson Dmitry Peskov said Moscow would work to secure his release, while Dmitry Medvedev suggested detaining Europeans and Americans for prisoner exchanges.
Source: The Guardian. Russian Military Blogger Mikhail Zvinchuk, Founder of Rybar, Arrested in Montenegro. [online] Published 9 October 2026. Available at: https://www.theguardian.com/world/2026/oct/09/russian-military-blogger-mikhail-zvinchuk-rybar-arrested-montenegro
Self-Styled Israeli Think Tank Tied to Russian Influence Operation
An investigation published by VSquare states that the International Burke Institute (IBI), which presents itself as an independent Tel Aviv think tank, is part of a Russian influence operation according to OpenAI and Meta. IBI listed experts who never worked with it, including Masaryk University vice rector Radim Polčák and at least three current or former CFR experts, while OpenAI's researchers found 34 of 36 sampled articles on its site elsewhere online; Meta removed seven Facebook accounts, nine pages and eight Instagram accounts promoting it, which had spent roughly $6,400 on promotion.
The investigation shows how the operation sought credibility rather than reach: its 'Burke Sovereignty Index', which ranks Russia fourth and some of whose accompanying texts describe EU and NATO membership as limits on autonomy, was promoted in a near-identical article on at least 25 India-focused sites, showed signs of paid placement on look-alike Forbes and Rolling Stone sites, and was cited in a report by The Future Society. Leaked documents show the Moscow-based Social Design Agency planned an almost identical Israeli 'think tank' in December 2024, although investigace.cz found no evidence that SDA operates IBI and no technical overlap. Jessica Brandt notes the reach was modest, and OpenAI argues the operation's significance lies in the infrastructure it built.
Source: VSquare. International Burke Institute: The Academic Facade of a Russian Influence Operation. [online] Available at: https://vsquare.org/international-burke-institute-the-academic-facade-of-a-russian-influence-operation/
Russian Disinformation Targets Baltic Elections Through Security Fears
An article published by Euronews states that, according to a report by London-based threat intelligence company Refute, Russia-linked disinformation around Estonia's September presidential election and Latvia's October parliamentary vote focused less on candidates than on sowing confusion about security issues. In Latvia, a fabricated video styled as a Euronews report claimed a Ukrainian soldier killed three NATO servicemen during the Baltic Trust 26 exercise, reaching a combined audience of more than 1.85 million, while in Estonia a fake site imitating EUobserver linked President Alar Karis and Lithuanian President Gitanas Nausėda to Jeffrey Epstein's network.
Refute found the narratives were rebuilt for different audiences rather than simply reposted, identifying eight versions of one video, including Arabic- and Spanish-language edits and versions with AI-generated footage. Claims gained credibility by being anchored to real events, such as drones entering Baltic airspace, and were republished on multilingual websites that kept them citable after social media posts were labelled or removed. Refute co-founder Vlad Galu described the tactics as 'a step change' in how Russia targets information ecosystems in the Baltics and beyond.
Source: Euronews. Fake NATO Deaths, Epstein Claims and Drones: How Russia Targets Elections in the Baltics. [online] Published 6 October 2026. Available at: https://www.euronews.com/2026/10/06/fake-nato-deaths-epstein-claims-and-drones-how-russia-targets-elections-in-the-baltics
EU Monitoring Finds Summer Fakes Targeting EU-Ukraine Ties
A report published by the EEAS states that an EU Delegation-supported regional network of journalists, working with the DARE project, detected pro-Russian false claims across Ukrainian regions in June to August 2026 aimed at fuelling Euroscepticism. Telegram channels in regions including Kharkiv, Kyiv and Zaporizhzhia claimed the EU would end temporary protection for all Ukrainians liable for military service from 2027, distorting a July 15 Council decision that extended protection until March 4th, 2028, while adding conditions for new military-liable applicants.
The report finds a parallel wave of claims exploiting Ukraine-Poland tensions, including a fabricated decree by President Zelenskyy on an EU-funded UPA memorial in Volyn timed to the Volhynia Massacre remembrance day, and fakes weaponising European wildfires and heatwaves to blame sanctions or Ukraine. Other narratives in Odesa, Cherkasy, and occupied areas accused the EU of militarisation and preparing for war with Russia. The report argues that the mobilisation and refugee narratives are interconnected, accusing the EU of discriminating against Ukrainians and shaping mistrust and disappointment in the EU.
Source: European External Action Service (EEAS). Third Quarterly Monitoring Report on Pro-Russian Disinformation Targeting EU–Ukraine Relations (June). [online] Available at: https://www.eeas.europa.eu/delegations/ukraine/third-quarterly-monitoring-report-pro-russian-disinformation-targeting-eu-ukraine-relations-june_en
Kremlin Revives Bucha Denial at UN General Assembly
An analysis published by EUvsDisinfo states that Russian Foreign Minister Sergei Lavrov gave renewed prominence at the UN General Assembly to established Bucha narratives, from outright denial to conspiracy theories, while pro-Kremlin outlets such as Sputnik Georgia claimed the massacre was staged by Kyiv with NATO support. It also documents claims by The Other Ukraine that Ukraine runs a child-trafficking business, and a claim by Izvestia correspondent Dmitry Astrakhan that Ukraine's Academy of Sciences, damaged in a September 28 strike, conducted Nazi-related research.
EUvsDisinfo argues that these cases show the Kremlin recycling familiar themes rather than inventing new ones, flooding the information space with multiple, often contradictory explanations of the same event. It notes the irony of pro-Kremlin outlets dismissing the UN as 'slowly dying' while invoking its authority to demand a 'proper investigation', and describes the child-trafficking narrative as blame reversal that distracts from the ICC arrest warrants for Vladimir Putin and Maria Lvova-Belova over their alleged responsibility for the unlawful deportation of Ukrainian children.
Source: EUvsDisinfo. Bucha Denial at UNGA and Nazi Narratives Justifying Strikes on Ukraine. [online] Available at: https://euvsdisinfo.eu/bucha-denial-at-unga-and-nazi-narratives-justifying-strikes-on-ukraine/
Russia Impersonates Ukrainian Agencies and Media Online
An article published by Euronews states that, according to the Security Service of Ukraine (SBU), Russian intelligence services are creating fake websites, social media pages and messenger channels that copy the names, logos, photographs and branding of Ukrainian government agencies, security bodies, media outlets and senior officials. The SBU said it had recorded a key increase in such activity and had identified and blocked more than 50 resources copying its own branding, while earlier fakes impersonated President Volodymyr Zelenskyy, Olena Zelenska, Andriy Yermak and Vasyl Maliuk.
Euronews explains that the resources can serve several purposes at once, presenting false information as if it came from a legitimate Ukrainian source, which the SBU says aims to destabilise the country, and encouraging users to follow accounts, click links or share details. According to the SBU, Russian services may compromise the accounts of users who interact with the fake pages and use the data in recruitment operations or to gather confidential information, while Euronews adds that in some cases operators repurpose older Telegram channels, including cryptocurrency pages. Ukrainian authorities advise users to check account names, web addresses and verification badges and to rely on official sources.
Source: Euronews. Ukraine Warns of Fake Government and Media Sites Tied to Russian Intelligence. [online] Published 5 October 2026. Available at: https://www.euronews.com/2026/10/05/ukraine-warns-of-fake-government-and-media-sites-tied-to-russian-intelligence
Pro-Russian Hackers Hit Italian Foreign Ministry After Moscow Rebuke
An article published by Il Sole 24 Ore states that the pro-Kremlin collective 'No Name' launched a cyber-attack on the Italian Foreign Ministry's website, detected by the National Cybersecurity Agency, after Russia hit back at Foreign Minister Antonio Tajani's warnings about the risk of interference in Italy's upcoming parliamentary elections. The ministry said the attack 'has so far been effectively mitigated by the security systems, without causing any disruption to services'.
Il Sole 24 Ore describes the sequence as suspicious and sees a link between the diplomatic row and the attack: a few hours earlier, Russian Foreign Ministry spokesperson Maria Zakharova had called Tajani's warnings 'unhealthy' and 'disrespectful' towards Italians and accused him of playing the 'Russia card', referring to remarks he made on September 2nd at an informal meeting of EU foreign ministers in Wicklow, Ireland. The newspaper notes that the collective is at the center of numerous attacks on institutional websites but characterizes these as merely symbolic actions, while Tajani said the ministry has strengthened its capabilities for preventing, monitoring and responding to threats.
Source: Il Sole 24 Ore. Foreign Ministry Under Cyber Attack, Accusations from Moscow, Says Tajani. [online] Available at: https://en.ilsole24ore.com/art/foreign-ministry-under-cyber-attack-accusations-from-moscow-tajani-AJqknudB
China
Chinese State Media Narratives Seep Into Western Chatbots
An interview published by RSF states that University of Oregon sociologist Hannah Waight, who led a study co-published in Nature, found that state-coordinated media from China included in large language model training data is producing more pro-PRC outputs in models such as ChatGPT and Claude, especially when queried in Chinese rather than other languages. Waight describes this as a third mechanism of influence alongside regulation and ownership, in which web archives such as Common Crawl swept up the censored and propagandised Chinese internet that companies then used for training.
Waight stresses there is no evidence the effect is intentional, since much of the data was collected before these models existed, but warns that the pathway now changes authoritarian incentives, giving regimes another reason to coordinate their information environment. She says the effect likely extends to other regimes with heavy media control and high language exclusivity, such as Vietnam and Turkmenistan, and argues that the first remedy is transparency about training data, because these models 'launder information, cutting it off from its source'.
Source: Reporters Without Borders (RSF). Interview: How Chinese Propaganda Invades Western Chatbots. [online] Available at: https://rsf.org/en/interview-how-chinese-propaganda-invades-western-chatbots
Beijing's Planned London Embassy Seen as Hybrid Warfare Hub
An analysis published by the Jamestown Foundation states that the People's Republic of China's planned embassy at Royal Mint Court, whose approval survived a High Court challenge on July 31st, may serve as a hybrid warfare hub consolidating united front, influence, intelligence and diplomatic operations from seven buildings into one site of 5.5 acres. Analyst Sze-Fung Lee points to recent conduct, including embassy guards accused on July 3rd of brandishing electroshock weapons at protesters, and Ambassador Zheng Zeguang urging overseas Chinese association leaders to promote 'China's unification'.
Lee argues that housing United Front Work Department personnel and possible Ministry of State Security operatives under one roof would remove structural barriers to information flows, and that diplomatic immunity would shield activities from UK law enforcement: unlike a Chinese overseas police station housed in a restaurant, one operating inside the embassy compound could not be investigated and shut down. The analysis frames escalating 'wolf warrior' rhetoric and behaviour as part of a cognitive warfare toolkit, and says the site's symbolism as former Royal Mint, linked to Qing-era indemnity silver, itself exerts pressure on Beijing's targets in Britain.
Source: Jamestown Foundation. Beijing’s London Embassy as an Integrated Influence Platform. [online] Available at: https://jamestown.substack.com/p/beijings-london-embassy-as-an-integrated
Iran
Paris Accuses Tehran of Disinformation on Student Protests
An article published by France 24 states that the French foreign ministry summoned Iran's ambassador over what spokesperson Pascal Confavreux described as an Iranian 'disinformation campaign' targeting France's student protest movement. The ambassador was told that 'the misleading content disseminated online' by official accounts of the Iranian foreign ministry was 'absolutely unacceptable', and that 'these undignified provocations must cease'.
The summons came a day after Tehran summoned French Ambassador Pierre Cochard over the treatment of protesters, criticising France's 'violent treatment' of demonstrators and 'extensive and flagrant human rights violations', a move Paris called 'baseless'. France 24 frames the exchange as a possible tit-for-tat, noting that Iran has itself faced international condemnation for its crackdown on protests that peaked on January 8th - 9th, in which the rights group Iran Human Rights says it has identified 4,219 people killed.
Source: France 24. France Summons Iranian Ambassador over Disinformation on Student Protests. [online] Published 7 October 2026. Available at: https://www.france24.com/en/france/20261007-france-summons-iranian-ambassador-over-disinformation-on-student-protests
Golden Owl Maps Larger Iran-Linked Persona Network Before Israeli Vote
An investigation published by Golden Owl states that, extending its September investigation, it has documented a coordinated network of at least 694 X accounts ahead of the October 27th, 2026 Knesset election, built around Hebrew-language personas posing as Israelis, of which 445 are attributed to the Iranian-linked operation with high or medium-high confidence, and 623 were not part of the September network. Between August 11th and October 11th, 2026, 13,386 original posts and replies from 181 network accounts drew at least 4,726,529 views. Golden Owl describes a core apparatus of 326 Hebrew-language personas impersonating Israelis, and says the accounts operate from infrastructure X ties to Iran or from VPN exits in Germany, the Netherlands, the United States or Finland.
Golden Owl argues that the operation's target is public trust rather than a particular result: across 807 labelled accounts the dominant themes are the war as a tool of political survival, calls to vote Netanyahu out, Netanyahu as traitor and criminal, and Iran's strength against Israel's weakness, criticism it notes is legitimate in Israel but here is manufactured under Israeli names from a shared script. It stresses the limits of its findings: platform location labels are X's own inference and can be affected by VPNs; medium-confidence and watchlist accounts are 'leads, not attributions', and inclusion in the dataset is an analytical assessment, not an allegation that any identifiable person committed an offence or knowingly acted on behalf of a foreign state.
Source: Golden Owl. Exposing the Iranian Regime’s Influence Machinery Against Israeli Society. [online] Available at: https://goldenowl.ai/resources/research/Exposing-the-Iranian-Regime-Influence-Machinery-Against-Israeli-Society
[AI Related Articles]
OpenAI Disrupts First 'Category 5' Influence Operation
A report published by OpenAI states that it banned a cluster of Russia-origin ChatGPT accounts, nicknamed 'Dark Clark', which used AI mainly to draft internal reports on covert influence campaigns across Latin America that appeared aimed at undermining Ukraine and, in some cases, influencing politics, especially in Argentina and Bolivia. The operators appear to have controlled a 'Social Research Center' through a fake persona, 'Mia Clark', whose Latin American staff apparently did not know they worked for a Russian group, and claimed fakes such as an email, posing as Lima's education directorate, instructing schools to hold Ukraine-themed events referencing Stepan Bandera, which, matching Peruvian and Polish press stories suggest, fed into Ukraine-Poland tensions.
OpenAI rates the operation Category 5 on the six-point IO Breakout Scale, the first it has disrupted, because some open-source evidence suggests its fakes provoked fact checks, official denials and public comment by politicians, and calls it the most complex attempt to run a front identity it has disrupted in two and a half years. It cautions that the operators often claimed credit for activity they had nothing to do with, so their own impact reporting cannot be taken at face value. Across the 30 covert operations it has exposed in the last two and a half years, OpenAI finds that those landing content in real media outlets rather than relying on fake social media distribution tend to have the highest potential reach and impact, and argues that such false fronts remain vulnerable to public disclosure.
Source: OpenAI. Disrupting AI-Enabled False Front Operations. [online] Available at: https://openai.com/index/disrupting-ai-enabled-false-front-operations/
Delhi Police Arrest Man Over AI Video of Senior Officer
An article published by The Hindu states that Delhi Police arrested Nadeem Ahmed Ameen, a 24-year-old self-described 'independent journalist' from Palwal, Haryana, for allegedly creating and circulating a fabricated video presented as genuine CCTV footage that falsely portrayed Assistant Commissioner of Police Vivek Bhagat engaging in sexually inappropriate conduct with a woman. According to police, the accused used AI tools, created the video on October 3 and posted it on October 4 via the Instagram account @news_aaina0776, which investigators traced to him; a phone recovered after his arrest was found logged into the account.
The case sits on top of a real dispute: a day earlier, 17 protesters, including a woman journalist who had accused Bhagat of harassing and shoving her during an October 3 protest, were arrested after being booked for allegedly staging a demonstration demanding a case against him. Police say the accused told them he intended to defame the Delhi Police, provoke protesters and create unrest, and investigators are examining his funding and associations, whether there was a larger pre-planned conspiracy to spread 'instigation and anarchy', and other accounts spreading a narrative against the police and government.
Source: The Hindu. Delhi Police Arrests Independent Journalist over AI-Generated Video Showing ACP Vivek Bhagat Misbehaving with Woman Protestor. [online] Available at: https://www.thehindu.com/news/cities/Delhi/delhi-police-arrests-independent-journalist-over-ai-generated-video-showing-acp-vivek-bhagat-misbehaving-with-woman-protestor/article71550274.ece
Colorado Deepfake Ad Tests State Disclosure Law
An article published by CBS News Colorado states that an ad opposing Proposition NN shows an AI-generated deepfake of Democratic state Sen. Cathy Kipp, the measure's sponsor, as a store clerk who refuses to return customers' change, saying 'Our new policy allows us to keep customers' change to help educate children'. Kipp filed a campaign finance complaint arguing the ad violates a state law requiring specific disclaimers for deepfakes unless they are satire or parody, prompting what CBS calls a first-of-its-kind court case.
The dispute turns on where satire ends: attorney David Lane, representing the libertarian-leaning Independence Institute that paid for the ad, argues no reasonable viewer would believe it depicts a real event and has moved to dismiss, while the state elections division says satire and parody are 'grounded in humor' and that the ad is political advocacy, not comic relief. Lane frames the complaint as intimidation and plans to sue for attorney fees, while Kipp has said misuse of AI and false information should not become normalised in elections.
Source: CBS News Colorado. Deepfake Ad of Colorado State Senator Prompts Court Case. [online] Available at: https://www.cbsnews.com/colorado/news/deepfake-ad-colorado-state-senator-prompts-court-case/
Suspected AI-Made Russian War Songs Rack Up Millions of Plays
An article published by Cybernews states that Terrecon, a Kyiv-based intelligence NGO, identified 981 tracks on Deezer, Spotify, SoundCloud and YouTube showing signs of AI generation and Russian military propaganda, with the 608 tracks that had public play counts totalling almost 87 million plays. Twenty-five tracks exceeded 1 million plays; the most-played had over 4.7 million, and many were not marked as AI-generated, except on Deezer.
Terrecon found that 15 of 25 AI music creators it contacted agreed to produce a track for $11 to $330, and in a separate test its analysts used Udio and Suno to generate two Russian-language songs glorifying the war and calling for violence against Ukrainians; YouTube and SoundCloud neither flagged nor promptly removed the uploads, which stayed online for weeks. CEO Daria Verbytska argues that moderation lags because removing tracks costs platforms money and that music 'bypasses the rational filter', warning that what is tested against Ukraine 'will be used against any democracy holding elections tomorrow'.
Source: Cybernews. AI War Propaganda Spreads on SoundCloud and YouTube. [online] Available at: https://cybernews.com/security/ai-war-propaganda-soundcloud-youtube/
[General Reports]
Midterm Ads Cite Partisan 'Pink Slime' Sites as Independent News
An analysis published by NewsGuard's Reality Check states that it identified seven video ads for key races in Iowa, Ohio and Alabama ahead of the November 3rd midterms featuring on-screen citations of 'pink slime' websites, which present themselves as professional news outlets but are secretly backed by partisan groups. Examples include a Government that Works PAC ad citing Courier Newsroom's Iowa Starting Line, a WinSenate ad citing States Newsroom affiliate Ohio Capital Journal, and a Republican primary ad citing Yellowhammer News, co-owned by a consultant whose firm was paid $117,000 by the candidate's campaign, according to campaign spending records.
NewsGuard argues that the sites' innocuous, local-sounding names lend ads a false sense of objectivity, and that quoting a seemingly impartial report can suggest there are not two sides to a story, as in the anti-Husted ad. The practice spans both parties and is part of a wider pattern in which pink slime sites spend on Facebook and Instagram advertising and are cited by leading AI chatbots nearly half the time when asked about candidates and issues the sites have covered in the midterm campaign. Courier Newsroom, States Newsroom and Yellowhammer News did not respond to requests for comment.
Source: NewsGuard. Campaign Ads Cite Pink Slime News. [online] Available at: https://www.newsguardrealitycheck.com/p/campaign-ads-cite-pink-slime-news
Recycled Videos Distort Scale of French Student Protests
An analysis published by NewsGuard's Reality Check states that it identified four false claims relying on misrepresented videos to exaggerate the scale and violence of France's student protests, three of them using footage unrelated to the current movement. Africa-based accounts posing as US users shared April 2023 pension-protest footage of the Paris stock exchange being stormed and 2023 clips of firefighters and police supposedly siding with protesters, while anti-immigration users recirculated a December 2017 Gare du Nord protest video, originally published by RT, as 'African men' joining the protests.
The claims came from different actors: according to NewsGuard, the Africa-based accounts, previously focused on US content, appear to be chasing advertising revenue rather than a political goal, while a fourth claim of a police dog unleashed in Lille came from far-left activists and was denied by the national police. Russia also exploited the unrest, with its Matryoshka campaign publishing 20 fabricated news reports in two days, including fakes attributed to AFP, Deutsche Welle and Le Monde, although these appear to have drawn little online traffic.
Source: NewsGuard. In France, Real Protests Distorted. [online] Available at: https://www.newsguardrealitycheck.com/p/in-france-real-protests-distorted
Government Sponsors Back Away From #Disinfo2026 Conference
An article published by Tech Policy Press states that the logos of three government sponsors of the #Disinfo2026 conference in Vilnius, organised by EU DisinfoLab, were taped over just before it opened on October 7, as the conference programme included a panel on whether the United States has become a source of foreign information manipulation and interference (FIMI) in Europe. The EEAS said it removed its logo 'in view of the content of the program', and Global Affairs Canada said it revised its participation in several panel sessions after changes to their framing, while its officials continued to attend, while The Guardian reported that the Trump administration had urged countries to drop their sponsorship.
The episode reflects a wider US backlash against disinformation research, some of which the article says has moved from rhetoric into policy through programme cuts, funding losses and State Department visa restrictions on people it accuses of censorship. A State Department spokesperson said it 'should not be a surprise' that countries disaffiliated once the conference 'labeled the US a FIMI threat', whereas France, the only remaining government sponsor, reaffirmed its support, and the authors ask whether governments will continue to publicly support civil-society counter-disinformation work under growing political pressure.
Source: Tech Policy Press. Disinformation Conference in Europe Roiled by Transatlantic Politics. [online] Available at: https://www.techpolicy.press/disinformation-conference-in-europe-roiled-by-transatlantic-politics/
Unproven Lab-Leak Claims Fuel Russian Plague Fears
A fact-check published by DW states that after a laboratory worker at Russia's Irkutsk Antiplague Research Institute died of severe pneumonia, an X post claiming she broke a flask of plague and infected several hundred people drew over 320,000 views, but there is no independent evidence of a pathogen leak. Rospotrebnadzor said two commissions found 'no evidence of an accident involving pathogenic microorganisms', while DW rated as misleading posts suggesting a WHO plague fact sheet update on the day of her hospitalisation showed prior knowledge, and an old video, first posted on August 31 with claims it showed Kabardino-Balkaria, reshared as proof of spread.
The fact-check shows how a real but opaque incident creates space for speculation from several directions at once: the WHO update was part of a broader publication cycle and the timing appears coincidental, while the profile of one account presenting itself as reporting live from Irkutsk indicates it was created in May and is based in Australia. DW notes that such accounts can quickly emerge during breaking news, posing as local or specialist sources, and that while authorities introduced precautionary measures and tests are reportedly being carried out, there are no confirmed reports of a plague outbreak in Russia.
Source: Deutsche Welle (DW). Russia Lab Worker Death: Fact Check. [online] Available at: https://www.dw.com/en/russia-lab-worker-death-fact-check/a-79560752
US Scales Back Defences as Foreign Midterm Meddling Persists
An analysis published by the Council on Foreign Relations states that Russia, China and Iran are still pursuing influence operations ahead of the US midterms, less than four weeks away, and could be aided by artificial intelligence, while the second Trump administration has rolled back many measures its predecessors took against foreign influence and election interference. Drawing on a podcast with Jessica Brandt, former director of the Foreign Malign Influence Center, James M. Lindsay reports her view that the work of that centre, the FBI's Foreign Influence Task Force and CISA has 'been scaled back or stood down entirely'.
Lindsay separates influence operations, which range from state media and covert media campaigns to illegal campaign funding and 'perception hacking' that questions the legitimacy of elections, from interference aimed at disrupting voting or vote counts. He notes there is no evidence any foreign government has run a substantial interference operation, because decentralised US election administration complicates such efforts and, as Brandt put it, foreign governments know interference is 'a red line'. Influence operations are different: Brandt says adversaries see them as 'low cost' and 'believe it's working', although Lindsay notes that whether they have ever swayed an election is notoriously difficult to determine.
Source: Council on Foreign Relations (CFR). Are the U.S. Midterms Vulnerable to Foreign Meddling? [online] Available at: https://www.cfr.org/articles/are-the-u-s-midterms-vulnerable-to-foreign-meddling
Adversaries Shift to 'Full-Spectrum' AI-Enabled Propaganda
An essay published by Foreign Affairs states that sophisticated states such as China, Iran and Russia routinely combine overt messaging with covert influence, using state media, official accounts, paid influencers, fake personas, hacked accounts and bot armies as parts of one system the authors call 'full-spectrum propaganda', with states increasingly integrating AI into every level of their operations. It cites reporting on Russia's Social Design Agency, including a June 2025 fake Al Arabiya video about Zelensky that OCCRP and other outlets tied to the agency and that an internal report estimated could have logged as many as 86 million views, and the September 2025 pig heads left outside Paris-area mosques, which the leaked files reveal were planned and which the agency calls 'cognitive strikes'.
The authors argue that the integrated approach exploits how repetition and apparently independent sources confer credibility, and allows removed fake accounts to respawn or migrate to platforms with weaker enforcement, so platform-by-platform analysis is too limited. They warn that AI agents and efforts to shape chatbot answers will deepen the problem just as US capacity collapses: platforms have restricted researcher data access, Meta laid off members of its investigations team, and the Global Engagement Center, its successor hub, the Foreign Malign Influence Center and the FBI's Foreign Influence Task Force have all been closed or allowed to lapse.
Source: Foreign Affairs. The Triumph of Tech-Fueled Propaganda. [online] Available at: https://www.foreignaffairs.com/united-states/triumph-tech-fueled-propaganda
[Appendix - Frameworks to Counter Disinformation]
Danish Bill Would Outlaw Sharing Deepfakes Without Consent
An article published by Euronews states that Denmark is due to introduce a bill amending its copyright law to ban sharing realistic deepfakes of people's faces and voices without their consent, protecting ordinary people as well as artists. Culture Minister Zenia Stampe said one of the bill's main goals is 'to get the tech giants to take down manipulated content quickly', and the minister hopes the law will take effect at the start of 2027.
The bill keeps exceptions for satire, parody, caricature and criticism of power, but these would not cover misinformation posing specified serious dangers to others' rights, essential interests, life or property, placing a disinformation threshold inside a copyright framework. Euronews situates it among wider European measures: EU states must criminalise sexually explicit manipulated material under the violence-against-women directive by June 14th, 2027, from which Denmark is exempt, France already bans undisclosed AI depictions shared without consent, and England and Wales criminalised creating or requesting non-consensual intimate deepfakes in February.
Source: Euronews. Denmark Introduces a Bill Protecting People’s Faces and Voices from Deepfakes. [online] Published 8 October 2026. Available at: https://www.euronews.com/2026/10/08/denmark-introduces-a-bill-protecting-peoples-faces-and-voices-from-deepfakes
EU Project to Test Which Counter-Disinformation Tools Work
An announcement published by EurekAlert! states that Johannes Gutenberg University Mainz's XplaiNLP group, led by Professor Vera Schmitt, is coordinating FIMI-RESIST, a 30-month Horizon Europe project funded with approximately EUR 3.5 million. Ten partners from nine countries will assess 20 previously EU-funded tools for countering foreign information manipulation and interference using common criteria and shared benchmarks, to establish which work under real-world conditions.
The project responds to a gap the release identifies: the EU has funded many detection and mitigation tools but has lacked a common framework to compare their effectiveness, even as generative AI lowers the cost of synthetic content and AI systems themselves become targets. The consortium, which includes Deutsche Welle, VoxUkraine, Logically/INSIKT and the Cyfluence Research Center, will test tools with journalists, fact-checkers and security stakeholders, set up a help desk, a European hub and training, and aims to inform debate on the Digital Services Act, the AI Act and the European Media Freedom Act.
Source: EurekAlert!. Disinformation and influence operations: Which countermeasures actually work?. [online] Available at: https://www.eurekalert.org/news-releases/1146921
Google Opens SynthID AI-Content Detector to the Public
An announcement published by Google states that it is expanding access to its SynthID Detector, previously offered in an early version to media professionals, to everyone, with the tool available globally in English. Anyone can now check whether an image, video or audio file was made with AI from Google or its partners, including OpenAI, NVIDIA, Kakao and, soon, Apple.
SynthID, launched in 2023, embeds imperceptible watermarks in AI-generated images, video and audio, and Google says it has watermarked over 180 billion images and videos and 240,000 years of audio. The detector joins built-in verification features in Search, the Gemini app and Chrome, which Google says now regularly handle over 1 million requests daily, part of its effort to give users more context about the media they encounter so they can decide what to trust.
Source: Google. SynthID: Identifying AI-Generated Content. [online] Available at: https://blog.google/innovation-and-ai/models-and-research/google-deepmind/synth-id-ai-content/
Sweden Adopts First National Strategy for Psychological Defence
A strategy published by the Government Offices of Sweden states that the Ministry of Defence's National Strategy for Psychological Defence is the Government's first national strategic approach to the area, built on four pillars: countering foreign information manipulation and interference (FIMI), the will to defend, media preparedness and communication to the public, and international cooperation. It sets six objectives with a desired state for 2030, and on adoption the Government gave four agencies specific tasks, including directing the Psychological Defence Agency to deepen collaboration with relevant authorities, including the Armed Forces, the Civil Defence and Resilience Agency and the Security Service, to strengthen protection against FIMI, with particular attention to the increased use of AI in the information space.
Drawing on the national security strategy, the document lists FIMI alongside hybrid activities such as cyberattacks, economic coercion and sabotage, describes it as cognitive manipulation through which the effects of other hybrid activities can be magnified, and, citing the Total Defence 2025-2030 bill, notes that AI lets antagonistic actors mass-generate content and anchor narratives through repetition, while also having the potential to strengthen efforts to identify and counter such activity. It also tasks the Psychological Defence Agency with developing collaboration with the National Cyber Security Centre to identify the connection between cyberattacks and influence operations, cites the 2022 and 2023 information campaigns targeting Sweden, including one against social services, as showing that great pressure can be applied when foreign antagonistic actors join forces against a small country, and stresses that psychological defence is a whole-of-society responsibility extending ultimately to every citizen.
Source: Government Offices of Sweden. National Strategy for Psychological Defence. [online] Available at: https://www.government.se/contentassets/ac66be37ed9d4dcdb88984cc16325463/national-strategy-for-psychological-defence.pdf
[CRC Glossary]
The nature and sophistication of the modern Information Environment is projected to continue to escalate in complexity. However, across academic publications, legal frameworks, policy debates, and public communications, the same concepts are often described in different ways, making collaboration, cooperation, and effective action more difficult.
To ensure clarity and establish a consistent frame of reference, the CRC is maintaining a standard glossary to reduce ambiguity and promote terminological interoperability. Its scope encompasses foundational concepts, as well as emerging terms relating to Hostile Influence and Cyfluence.
As a collaborative project maintained with input from the community of experts, the CRC Glossary is intended to reflect professional consensus. We encourage you to engage with this initiative and welcome contributions via the CRC website.
