top of page
CRC logo (2).png

Cyber based influence campaigns November 2nd – 8th 2026 Report

Writer: CRC
CRC
44 minutes ago
27 min read
Cover Image- Text: Weekly Media Update: Information Operations


[Introduction]


Cyber-based hostile influence campaigns are aimed at influencing target audiences by promoting information and/or disinformation over the internet, sometimes combined with cyber-attacks which enhance their effect (hence force Cyfluence, as opposed to cyber-attacks that aim to steal information, extort money, etc.) Such hostile influence campaigns and operations can be considered an epistemological branch of Information Operations (IO) or Information Warfare (IW).

Typically, and as customary during the last decade, the information is spread throughout various internet platforms, which are the different elements of the hostile influence campaign, and as such, connectivity and repetitiveness of content between several elements are the main core characteristics of influence campaigns. 

Hostile influence campaigns, much like Cyber-attacks, have also become a tool for rival nations and corporations to damage reputation or achieve various business, political or ideological goals. Much like in the cyber security arena, PR professionals and government agencies are responding to negative publicity and disinformation shared over the news and social media. 

We use the term cyber based hostile influence campaigns, as we include in this definition also cyber-attacks aimed at influencing (such as hack and leak during election time), while we exclude of this term other types of more traditional kinds of influence such as diplomatic, economic, military etc.

During November 2nd to 8th 2026, we observed, collected and analyzed endpoints of information related to cyber based hostile influence campaigns (including Cyfluence attacks). The following report is a summary of what we regard as the main events. Some of the mentioned campaigns have to do with social media and news outlets solemnly, while others leverage cyber-attack capabilities.



[Contents]





Facebook 

X 

Tiktok 

Russia 

China

Cyflunce Attack





[ Report Highlights]


• The Insider reports that Russia's Matryoshka bot network spread fake content designed to resemble France 24, Euronews, and the UN, claiming Ukraine runs secret prisons.

• Osavul analysis reported by The Independent shows Russian state-affiliated media output about the UK rose around 15 percent in September, to around 40,365 stories.

• X suspended about two dozen accounts tied to Russia's Storm-1516 just before Election Day, but dozens of others with more than 2.4 million followers combined remain active.

• Il Sole 24 Ore reports that NoName057(16) exposed the private details of Antonio Tajani and two Italian investigators and offered payment for information on eighteen targets.

• Poland's NASK reported over 2,000 accounts, many of them automated bots, flagged for spreading false narratives after the Kraków massacre, as disinformation mentions exceeded 200 million views.

• Taiwan's police have opened 184 suspected election disinformation cases and nine suspected cases of external forces colluding with criminal groups before the November 28th elections.

• A WIRED investigation found more than 400 connected domains and apps, often posing as everyday services, that under certain conditions load tools for generating explicit deepfakes.

• A Guardian investigation found Facebook took no action on more than 50 reported posts and comments in Crunchy Moms, a group of more than 490,000 members.

[ Report Summary]

• A Guardian investigation found Facebook took no action on more than 50 reported posts and comments in Crunchy Moms, a group of more than 490,000 members sharing false vaccine claims.

• X suspended about two dozen accounts tied to Russia's Storm-1516 just before Election Day, but dozens of others with more than 2.4 million followers combined remain active.

• Democracy Reporting International found 66 TikTok accounts impersonating Sri Lankan parties and candidates, and 51 were removed after reports to TikTok and the election commission.

• The Insider reports that Russia's Matryoshka bot network spread fake content designed to resemble France 24, Euronews, and the UN, claiming Ukraine runs secret prisons.

• Osavul analysis reported by The Independent shows Russian state-affiliated media output about the UK rose around 15 percent in September, portraying Britain as ungovernable and defenceless.

• Poland's NASK reported over 2,000 accounts flagged for spreading false narratives after the Kraków massacre, many of them automated bots and some with apparent Russian links.

• A Carnegie commentary argues Montenegro's swift deportation of Rybar creator Mikhail Zvinchuk shows Moscow protects its propagandists, while Europe still hasn't figured out what to do with them.

• A Novosti Donbassa report published by JAMnews finds Russian media portrayed the joint Oleshky evacuation as an act of Moscow's concern while seeking to discredit Ukraine.

• StopFake says Russian propagandists distorted Ukraine's language ombudsman's words into a false claim that medics may refuse Russian-speaking patients, a claim Maria Zakharova also used.

• Austrian police files seen by The Telegraph show Jan Marsalek claimed he helped topple Chancellor Sebastian Kurz, with no independent evidence he organised the phone seizure he cited.

• RSF's Aleksandra Bielakowska says China uses embassy pressure, sponsored trips, and formal agreements to shape Thai media narratives, while journalist Pravit Rojanaphruk warns such pressure could encourage self-censorship.

• Taiwan's police have opened 184 suspected election disinformation cases and nine suspected cases of external forces colluding with criminal groups before the November 28th elections.

• Middle East Eye, citing Haaretz, reports that 1,653 X accounts posing as Iranians appeared to coordinate Hebrew posts urging Israelis to vote for Netanyahu, though their operators remain unidentified.

• Il Sole 24 Ore reports that NoName057(16) exposed the private details of Antonio Tajani and two Italian investigators and offered payment for information on eighteen targets.

• The Justice Department charged three men accused of using AI deepfakes of executives and lawyers to defraud companies of at least $129 million.

• A WIRED investigation found more than 400 connected domains and apps, often posing as everyday services, that under certain conditions load tools for generating explicit deepfakes.

• CSIS analysts argue that recent Brazilian and Israeli elections and Spain's campaign show deepfake bans and labels are hard to define and to enforce before content spreads.

• BOOM found AI-generated or AI-edited content in 162 of its 527 fact-checks from January to July 2026, with more than eight in ten of them political.

• NewsGuard debunked 12 false midterm claims from Election Day onward, half of them recycled voter fraud conspiracy theories, amid the Democrats' decisive November 3rd victory.

• DFRLab found a few accounts, mostly critical of Armenia's government, dominated diaspora Facebook groups before June's elections, alongside a seemingly inauthentic pro-Tsarukyan network.

• Al Jazeera reports Indian political consultancies run covert shadow-account campaigns abroad, with India-based accounts posting videos backing Haley Stevens in Michigan's Senate primary.

• Pew found 62% of U.S. adults have at least some trust in information from national news organizations, up six points, while trust in social media was virtually unchanged.

• University of Sydney researchers found Reddit users increasingly dismiss opposing political views as AI-generated, a trend that can undermine trust in online election information.

• CheckFirst rebuilt its Pravda network dataset to more than 15 million articles across 88 sites and 47 languages, offering open statistics and a full archive for analysts.

• Montenegro's and Albania's defense ministers want NATO to send experts to help counter growing Russian disinformation as both countries pursue EU membership.

• Taiwan is working to amend its Anti-Infiltration Act, and the Justice Ministry says the amendment would create transnational repression offenses, allow asset confiscation, and add internet mechanisms.

[State Actors]



Facebook

Facebook Took No Action on Reported Crunchy Moms Health Misinformation

An article published by The Guardian states that dangerous medical misinformation is flowing freely on Facebook in groups like Crunchy Moms, now more than 490,000 members strong, and that Facebook took no action on more than 50 posts and comments a Guardian journalist reported from her own account, including claims that vaccines caused autism, that measles is not deadly, and that black salve can treat cancer. The Guardian reported 55 posts, comments, and replies and one video reel in May, July, and September, received no response to any of its reports, and found nearly all of the reported content still up when Meta was approached for comment.


The Guardian adds that the company appears to have helped spread such ideas by promoting Crunchy Moms into users' feeds, even when they do not seek it out, and that Meta's AI summarized one measles thread by noting that commenters "claim the vaccine is unnecessary or even harmful". Meta told the Guardian it had removed AI summaries of discussions in September, but the Guardian took screenshots of more than 10 such summaries in October. Separately, after the Guardian provided Meta with examples of content found on the group, Meta said it was reviewing those links and would take action on posts that violate its policies.


Source: The Guardian. ‘Crunchy Moms’ on Facebook: How Anti-Vaccine Groups Spread Misinformation. [online] Published 6 November 2026. Available at: https://www.theguardian.com/technology/2026/nov/06/crunchy-moms-facebook-vaccines 


X

X Suspends Storm-1516 Accounts as Dozens More Remain Active

An article published by Straight Arrow states that X suspended about two dozen accounts tied to a Russian propaganda syndicate just ahead of Election Day, an apparent effort to thwart a disinformation campaign that targeted at least three Democrats in contentious Senate races: James Talarico in Texas, Sherrod Brown in Ohio, and Troy Jackson in Maine. French researcher David Colon documented 20 accounts associated with Storm-1516 that X suspended on Friday. Yet, dozens of others, which have collectively amassed more than 2.4 million followers, remain active, and Colon said most of those are "from real people”.


Disinformation researchers attribute this to inconsistent enforcement and to the difficulty of containing false narratives once they spread, with Colon saying Storm-1516 recruits influencers by offering "a few hundred bucks for each publication”, while the Gnida Project said X could "ban anyone posting their content for money". X's global government affairs team said in mid-October that it had suspended more than 13,000 accounts involved in suspected foreign influence operations, and X's head of safety, Michael O'Herlihy, did not respond to Straight Arrow's messages.


Source: San. X Cracks Down on Russia-Backed Election Lies, but Paid Amplifiers Are Still Reaching Millions. [online] Available at: https://san.com/cc/x-cracks-down-on-russia-backed-election-lies-but-paid-amplifiers-are-still-reaching-millions/ 


Tiktok

51 TikTok Accounts Impersonating Sri Lankan Parties Removed After Reports

An article published by The Morning states that 66 TikTok accounts impersonated political parties and candidates during Sri Lanka's recent election cycles, according to research by Democracy Reporting International (DRI) presented at a forum on electoral disinformation in Colombo on October 30th. Of the 66 accounts, 45.5% had been active during the 2024 Presidential Election, 21.2% remained active until the 2025 Local Government Elections, and 51 of the accounts were removed following reports made to TikTok and the Election Commission of Sri Lanka (ECSL).


The research, which examined three recently concluded elections, also found that women politicians faced increased technology-facilitated gender-based violence, and it examined inaccurate electoral information spread through chatbots and political advertisements published during the silence period. ECSL Member A M Faaiz said the commission, with the support of DRI and Factum, was formulating a strategic action plan on disinformation and harmful content, stressing: "Our purpose is to protect the voters, not to police opinion".


Source: The Morning. 66 TikTok Accounts Impersonated Political Parties, Candidates. [online] Published 3 November 2026. Available at: https://www.themorning.lk/articles/vIp6SZCdAsPw0h0uwmwN


Russia

Matryoshka Bots Spread Fake Stories of Ukrainian 'Secret Prisons'

An article published by The Insider states that the Russian "Matryoshka" bot network has launched a social media campaign promoting claims that Ukraine operates "secret prisons" where military personnel and foreigners are tortured, with researchers from the Antibot4Navalny project providing information on more than 10 fake videos and posts. The content, built around a November 2nd incident in Petropavlivska Borshchahivka outside Kyiv, was designed to resemble outlets and organizations including France 24, Euronews, TVP World, Human Rights Watch, and the United Nations, and falsely claimed, among other things, that Azov fighters kidnapped Europeans for ransom and that a mass grave of 64 bodies was found at a supposed secret prison.


Several videos also claimed that protests were being planned in France to demand an end to aid for Ukraine, and the posts encouraged viewers to share the videos with relatives and friends, while images imitating the front pages of La Croix and Libération claimed to present evidence of "crimes committed by Volodymyr Zelensky", and The Jerusalem Report was falsely portrayed as reporting a "revival of Nazism" in Ukraine. The Insider explains that Matryoshka creates fake profiles posing as ordinary people, independent media outlets, or think tanks and launches identical content simultaneously across platforms, and that the newsroom withheld direct links to avoid helping spread the false material.


Source: The Insider. Russia’s Matryoshka Bots Launch Disinfo Campaign Claiming Ukraine Runs “Secret Prisons” to Torture Soldiers and Hold Kidnapped Foreigners. [online] Published 4 November 2026. Available at: https://theins.press/en/news/299171


Russian State-Affiliated Media Intensifying UK Disinformation

An article published by The Independent states that, in the past six months, Russian state-affiliated media have pushed hundreds of thousands of stories on social media portraying Britain as ungovernable, defenceless, and a legitimate Russian target, with analysis by risk intelligence firm Osavul showing such output rose by around 15 percent in September, when it produced around 40,365 stories about the UK, and stayed at similar levels in October. False claims cited include that the UK bombed the city of Voronezh with Storm Shadow missiles, that British police were threatening to arrest people for using air conditioners, and that Andy Burnham was "powerless to stop the UK's collapse".


Osavul found 1,019 messages from 172 accounts it classifies as "high risk for information manipulation" around Sir Keir Starmer's resignation, and said a report of Iran-linked hackers shutting down a small power plant in July was reframed as British energy vulnerability, calling it "the clearest case of a true event being reframed to produce fear of state weakness", Chatham House's Keir Giles said the UK has come to the forefront as Russia's primary adversary because the United States "is no longer in that role", while a government spokesperson said the new national information centre would strengthen the UK's ability to "detect, attribute and disrupt hostile information attacks".


Source: The Independent. Russia Ramps Up Disinformation War on UK with Propaganda Claiming Britain Is ‘Ungovernable and Defenceless’. [online] Published 2 November 2026. Available at: https://www.independent.co.uk/news/uk/home-news/russia-uk-putin-burnham-ukraine-war-b3077284.html


Bots and False Narratives Flooded Poland After Kraków Shooting

An article published by European Interest states that Poland's NASK Disinformation Analysis Centre reported over 2,000 accounts spreading false narratives on social media after the massacre in Kraków that were flagged for moderation, many of them automated bots posting in Polish, English, French, and Dutch, with some linked to Russia through Cyrillic characters or direct references to the Russian Federation. Disinformation mentions peaked around 6:00 PM on Saturday, November 7th, at over 200 million views, and the narrative that the Polish government orchestrated the attack with EU involvement potentially reached up to 200 million views.


Other narratives claimed the government staged the attack to justify cancelling the Independence March (5.6 million views), that the shooter was a soldier (nearly 18 million views), or that Ukraine organised the attack, a claim that faded once security services confirmed the attacker's nationality. European Interest argues that far-right figures in Poland and elsewhere in Europe amplified misleading narratives about the attacker, while Digital Affairs Minister Krzysztof Gawkowski warned that images from the scene altered using artificial intelligence were also appearing online.


Source: European Interest. Poland Under Disinformation Attack After Kraków’s Massacre. [online] Published 8 November 2026. Available at: https://www.europeaninterest.eu/poland-under-disinformation-attack-after-krakows-massacre/


Rybar Creator's Quick Deportation Shows Europe's Weak Response to Propagandists

An analysis published by the Carnegie Endowment for International Peace, a Carnegie Politika commentary by Ivan Filippov and Ksenia Luchenko, states that Montenegrin authorities detained prominent Kremlin propagandist Mikhail Zvinchuk, creator of the pro-war media project Rybar, together with his wife and camera crew on the morning of October 9th and deported them to Russia that evening, although he is subject to Western sanctions. The authors describe Rybar, with 1.5 million subscribers and a network of about 200 channels in twenty-eight languages, as a professional propaganda project, and note that the British Foreign Office asserts it is partially coordinated by the Russian presidential administration, receives funding from Rostec, and works with Russian intelligence agencies.


The authors suggest Zvinchuk may have counted on assistance from local pro-Serbian political and religious groups tied to Russia's influence network in the Balkans, noting that he said his detention stemmed from a request to film at a monastery in Cetinje and that in an October 19th video he repeated almost verbatim an SVR claim about autocephaly for the "Montenegrin Orthodox Church”. They argue forces within the Serbian Orthodox Church, Moscow's main ally in the Orthodox world, might back Russian propagandists against EU integration, and conclude that "Moscow values and protects its propagandists, while Europe still hasn't figured out what to do with them".


Source: Carnegie Endowment for International Peace. Deportation of Russian Propagandist Reveals Battle Over Church Influence in the Balkans. [online] Published 4 November 2026. Available at: https://carnegieendowment.org/russia-eurasia/politika/2026/10/russia-europe-military-blogger-detained


Russian Media Recast Oleshky Evacuation as Moscow's Humanitarian Story

An article published by JAMnews states that, for Russian state media and Z-bloggers, the evacuation of around 800 civilians from occupied Oleshky, a rare joint operation under international mediation, became an opportunity to launch a new information campaign, as Russian media portrayed it as an act of concern by Moscow, sought to discredit Ukraine, and tried to intimidate those considering returning to territory under Kyiv's control. According to the report by Novosti Donbassa, four narratives stood out: Russia cast as a humanitarian intermediary, residents' alleged unwillingness to return to Ukraine, attempts to frighten men with the prospect of forced mobilisation, and efforts to shift responsibility for threats to civilians onto Ukraine.


In one example, Z-blogger Sergei Kolyasnikov's claim that evacuated men were detained by Ukrainian recruitment centres and sent to the front did not match the known evacuation route, as evacuees heading to Ukraine had, according to published reports, been flown to Gomel in Belarus, while Rodion Miroshnik's accusation that Ukraine breached the ceasefire contradicted statements by ombudsmen Dmytro Lubinets and Yana Lantratova that both sides had fulfilled their commitments. The author warns that such disinformation could lead residents of occupied territories to refuse evacuation even when a safe route is available, and could complicate future humanitarian missions.


Source: JAMnews. The Evacuation from Oleshky: How Russia Turned a Humanitarian Mission into a Propaganda Story. [online] Available at: https://jam-news.net/the-evacuation-from-oleshky-how-russia-turned-a-humanitarian-mission-into-a-propaganda-story/


Russian Media Twist Ombudsman's Words Into Medical Refusal Claim

An article published by StopFake states that Russian propagandists once again distorted the words of Ukraine's language ombudsman, Olena Ivanovska, with Russian media claiming that Ukraine had allowed medics not to help Russian-speaking patients and that Ivanovska had "justified Ukrainian doctors who refuse to serve Russian-speaking patients”, a supposed quote that Russian Foreign Ministry spokesperson Maria Zakharova also used for yet another accusation of Nazism against Ukraine. In her full remarks to Ukrainian Radio, Ivanovska said medics had told her they were not ready to provide services to Russian-speaking patients, called this "a question of morality”, and cited the language law's provision that a service provider may use another language only of its own free will.


StopFake notes that no provision of Ukrainian law allows a patient to be refused treatment because of language, since Article 30 of the law on the Ukrainian language as the state language governs the language of consumer service and its Article 33 allows medical care, at the patient's request, in another language acceptable to both parties, while Article 139 of the Criminal Code makes a medic's failure to help a patient without good reason a crime. The ombudsman reported no confirmed cases of care being refused over language, Russian publications cite no such examples either, and former health minister Zoriana Skaletska said a doctor's "moral convictions are not grounds for refusing medical care”.


Source: StopFake. Manipulation: In Ukraine, Medical Workers Have Been Allowed to Refuse Treatment to Russian-Speaking Patients. [online] Available at: https://www.stopfake.org/uk/manipulyatsiya-v-ukrayini-dozvolili-medikam-ne-dopomagati-rosijskomovnim-hvorim/


Austrian Police Files Show Marsalek Claimed Role in Kurz's Fall

An article published by The Telegraph states that, according to documents it obtained, Jan Marsalek, the fugitive former Wirecard executive, said he had been involved in an operation that had "successfully toppled" Austrian Chancellor Sebastian Kurz, who stepped down amid allegations of corruption in 2021. In messages sent on October 22nd, 2021 to spy ringleader Orlin Roussev, since jailed in Britain for espionage, by the man authorities have identified as Marsalek using the alias "Rupert Ticz”, he said "we've successfully toppled" the former chancellor "by confiscating the mobile phone" of the man "who's managing their secret campaign financing”, and then shared a link to an article about the phone seized from Kurz associate Thomas Schmid.


The Telegraph stresses that the documents contain no independent evidence that Marsalek actually organised the seizure of Schmid's phone, which took place in November 2019, and that his message came 13 days after Kurz's October 9th, 2021 resignation, when details of the case had already appeared in the local press. The messages sit in Austrian police files investigating "support for a foreign intelligence service – interference in Austrian politics”, whose investigators wrote that "Marsalek stated unequivocally that 'they' had 'toppled' the chancellor in a successful operation”, while RUSI's Ed Arnold said Marsalek may be "overplaying his hand”.


Source: The Telegraph. Russian Spymaster Claimed He Could Topple Austrian Chancellor. [online] Published 7 November 2026. Available at: https://www.telegraph.co.uk/world-news/2026/11/07/russia-spymaster-claimed-topple-austrian-chancellor/


China

RSF Documents Beijing's Pressure and Propaganda in Thai Media

A report published by Reporters Without Borders (RSF) states that the Chinese regime has expanded its presence in Thailand's media sector through strategic partnerships with Thai outlets and journalists and has attempted to silence stories it does not like by intimidating them, with RSF Asia-Pacific advocacy manager Aleksandra Bielakowska saying the regime has employed influence techniques including diplomatic pressure through embassies, media investments, sponsored trips for journalists, and formal agreements to shape media narratives. According to a person familiar with the case, after Thai PBS aired a November 2023 interview with Jaushieh Joseph Wu, then Taiwan's foreign minister, the Chinese Embassy arranged a meeting with the broadcaster's executives and the full interview was removed from its online platforms about a week later.


Some of the Thai journalists RSF spoke with, most under condition of anonymity, expressed concern that Beijing's tightening grip on their media landscape may be turning Thailand into "a Chinese vassal state”, and journalist Pravit Rojanaphruk said such pressure from China could encourage self-censorship within Thai newsrooms. RSF says Chinese state-controlled outlets such as Xinhua, China Radio International, and CGTN have significantly expanded Thai-language content and secured content-sharing agreements, with at least twelve Thai-language platforms reaching such agreements with Xinhua by the end of 2019, and CFR's Joshua Kurlantzick told RSF that dependence on Chinese state content is likely to grow unless the economics of Thai journalism fundamentally change.


Source: Reporters Without Borders (RSF). Beyond Censorship: China’s Growing Influence on Thailand’s Media. [online] Available at: https://rsf.org/en/beyond-censorship-china-s-growing-influence-thailand-s-media


Taiwan Police Probe 184 Suspected Disinformation Cases Before Elections

An article published by the Taipei Times states that Taiwan's National Police Agency (NPA) has launched investigations into nine cases suspected to involve external forces colluding with criminal groups and private detective firms, with prosecutors bringing charges in four, and has opened investigations into 184 suspected cases of disinformation ahead of the November 28th elections, 112 of which were referred to judicial authorities. The NPA said external forces have expanded their election-interference tactics to include manipulating election betting, sponsoring trips to China for Taiwanese, channeling campaign donations through Taiwanese businesspeople, and using temple and religious activities to influence voters.


Candidates who discover "deepfake" audio, video, or images of themselves can apply, for a fee, to the Criminal Investigation Bureau for forensic examination until the day before the election. President William Lai separately warned that numerous suspicious accounts registered with overseas phone numbers but listing Taiwan as their location had appeared on social media within a short period with consistent activity patterns, and that some campaign websites had been targeted by cyberattacks designed to overwhelm them with high volumes of traffic, with similar attacks reported in Taipei, Kaohsiung, and Hsinchu.


Source: Taipei Times. Legislator May Chin, Aides Indicted for Building CCP Network. [online] Published 6 November 2026. Available at: https://www.taipeitimes.com/News/front/archives/2026/11/05/2003867183Top Of Page


Cyfluence Attack

NoName057(16) Doxxes Tajani and Investigators Offers Bounties

An article published by Il Sole 24 Ore states that the pro-Russian hacker collective NoName057(16) is offering money for information on eighteen targets across Europe listed on a Tor page called "Tribunale" (Tribunal) as citizens hostile to the Russian Federation, including Rome prosecutor Francesco Lo Voi and Postal Police chief Ivano Gabrielli, who lead the offices investigating the group, and Foreign Minister Antonio Tajani. NoName is at the same time disseminating the data it has already obtained, and the private details of all three, including phone numbers, emails, and Telegram contacts still in use, are already exposed on the dark web, while the list also names Aviano mayor Paolo Tassan-Zanin, Eurojust president Michael Schmid, Europol cybercrime centre director Edvardas Šileris, and three German investigative journalists.


The paper says the profiling becomes a means of pressure on the people listed and can fuel new cyber actions, noting that NoName, which it describes as linked to Russia's GRU, hit the Farnesina's website with DDoS attacks on October 8th, the same day Maria Zakharova called Tajani's warnings of Russian interference «malsane» ("unhealthy"). Tajani said he would not be intimidated, called Italy's stance on Ukraine the political reason he was targeted, and asked the G7 meeting in Paris to put the "hybrid war" at the centre of debate, while the paper stresses that Russian coordination of recent incidents remains a hypothesis that Moscow denies.


Source: Il Sole 24 Ore. Hacker Russi, Soldi per Informazioni su Tajani, Lo Voi e Gabrielli: Dati Privati Già sul Dark Web. [online] Published 7 November 2026. Available at: https://www.ilsole24ore.com/art/hacker-russi-soldi-informazioni-tajani-voi-e-gabrielli-dati-privati-gia-darkweb-AJJzMe7B


[AI Related Articles]


DOJ Charges Trio in AI Deepfake Fraud of at Least $129M

An article published by CyberScoop states that, according to the Justice Department, Jacob Soall, Sharon Hazan, and Guy Sheetrit allegedly used AI to impersonate the voices and images of company CEOs and lawyers at major international law firms, defrauding companies of at least $129 million by tricking employees into transferring large payments to criminal-controlled accounts. The trio is accused of targeting thousands of victims between July 2024 and February 2026, including a U.K.-based financial tech company that lost almost $11.6 million and a Rhode Island-based bank that transferred nearly $2.7 million.


According to an unsealed indictment, the scheme typically began with an email from an e-signature company in which the impersonated CEO described a "confidential financial transaction”, after which, officials said, the crew allegedly directed employees to attorneys it also impersonated, while prosecutors said the wire transfers went to accounts in countries including Spain, Greece, the United Arab Emirates, and China before being converted to cryptocurrency. The three men, arrested in Spain and the United Kingdom, face seven counts carrying a maximum of 104 years in prison, while Sheetrit's attorneys said he "has no connection to this matter”.


Source: CyberScoop. Authorities Accuse Trio of Using AI Deepfakes to Defraud $129M from Businesses. [online] Published 8 November 2026. Available at: https://cyberscoop.com/ai-deepfakes-impersonate-ceo-lawyer-defraud-companies/


Hidden Deepfake Network Spans More Than 400 Domains and Apps

An article published by WIRED states that a network of more than 400 connected domains and apps, often claiming to be everyday services such as pet portraits, language tuition, or AI workout coaches, stealthily loads a web interface for generating explicit AI sexual images and videos from uploaded photos when accessed under certain conditions. Researchers discovered the network after investigating links from thousands of explicit deepfake video ads on Meta's Facebook and Instagram, which led to the apps in Apple and Google's app stores, and the apps and domains appear to be run by Chinese developers and a Hong Kong-registered entity called KeLing Technology Limited.


AI Forensics researcher Paul Bouchaud found the apps contact a server on download to decide whether to show benign or explicit content, with one trigger appearing to be downloading after clicking an associated Meta ad, and 27 such apps were live on Google's Play Store in September with more than 350,000 downloads combined. After WIRED's inquiries, Apple removed 19 apps, Google had removed most of the apps before being contacted, and Meta said it had acted against 11,600 ad accounts and blocked 209 apps from advertising, yet similar ads and apps continued to be published.


Source: WIRED. Hundreds of Mundane AI Apps Are Hiding Abusive Deepfake Features. [online] Available at: https://www.wired.com/story/hundreds-of-mundane-ai-apps-are-hiding-abusive-deepfake-features/


CSIS Says Deepfake Rules Struggle to Keep Pace With Elections

An analysis published by the Center for Strategic and International Studies (CSIS) states that AI-generated content is becoming a fixture of election campaigns, and that Brazil's electoral court, in a 5–2 vote, narrowed its 2024 deepfake ban to content with "a degree of realism or verisimilitude" that qualifies as "electoral propaganda”, finding that an AI avatar of Jair Bolsonaro endorsing his son Flávio at a closed party convention did not breach it. The authors cite estimates that 1 in 8 election-related social media posts in Israel were altered by AI and that about $137 million has been spent on over 220 U.S. midterm videos using AI-generated content, about 70 percent of them without disclosure.


Citing critics of expansive labeling requirements, the authors note that Israel's rule depends on whether content could be perceived as real rather than whether it was meant to deceive, "meaning a labeled deception complies”, and they add that a faint AI label on a Spanish People's Party video "may help fend off potential legal challenges”, while that video drew over 2 million views in less than a day, before legal complaints were filed. With no federal U.S. law specifically addressing deepfakes, a patchwork of state rules, and online deepfakes estimated to have grown from 500,000 to 8 million between 2023 and 2025, the authors conclude that effectiveness depends on enforcement before Election Day.


Source: Center for Strategic and International Studies (CSIS). Deepfakes Are Dominating Global Elections, and Regulation Is Playing Catch-Up. [online] Published 2 November 2026. Available at: https://www.csis.org/analysis/deepfakes-are-dominating-global-elections-and-regulation-playing-catch


BOOM Finds AI Fakes Turned Overwhelmingly Political in 2026

A report published by BOOM states that AI-generated or AI-edited content featured in 162 of the 527 fact-checks it published between January 2nd and July 31st, 2026, or 30.7%, up from 20.5% in 2025 and 8.35% in 2024, and that 133 of the 162 AI-led claims (82.1%) were political, whereas its 2025 report flagged 78 "AI slop" fact-checks. Synthetic AI video was the largest category, at 42 of 162, and deepfakes and voice clones that "put words in a real person's mouth" together made up 69 of 162 (42.6%).


The US-Israel-Iran war produced 81 fact-checks, with AI in 38 of them and the first, on February 27th, already an AI fake, while of the 66 fact-checks on the West Bengal Assembly election, 42 involved old footage and only 8 involved AI, with 17 using footage from Bangladesh. BOOM also found at least six AI-generated women in sexualised outfits whose faces were superimposed onto real footage and passed off as Cockroach Janta Party protesters, with the most viral video passing 24 million views.


Source: BOOM. BOOM Report: January–July 2026 — Iran War, West Bengal Election, AI Fact-Checks. [online] Available at: https://www.boomlive.in/boom-research/boom-report-january-july-2026-iran-war-west-bengal-election-ai-fact-checks-32471


[General Reports]


Half of NewsGuard's Latest Midterm Debunks Involve Recycled Fraud Theories

An analysis published by NewsGuard's Reality Check states that, while President Donald Trump and other figures on the right seem willing to accept the Democrats' decisive midterms victory on November 3rd, baseless voter fraud claims still gained significant traction online, with NewsGuard analysts identifying and debunking 12 false midterm claims since the start of Election Day, among the 52 that have gone viral this election cycle. Half of those debunked on November 3rd and 4th involved well-worn and long-debunked voter fraud conspiracy theories. Among the Election Day claims, Laura Loomer said voting machine issues in Westchester County, New York, showed "Democrats are already trying to steal the election”, although the New York State Board of Elections attributed the problem to an update to the county's election programming.


Other claims included Lara Logan's repost of a post saying a Michigan poll worker had detected a Wi-Fi signal that "appears to be connected to a foreign Wi-Fi device inside a tabulator”, although Michigan's Bureau of Elections says tabulators are not connected to the internet while votes are tabulated, and "ballot dump" claims about Abdul El-Sayed's Senate win, although NewsGuard found the vote ratio in the screenshots cited consistent with results from deep-blue Michigan counties. None of the X posts cited had been flagged by Community Notes by the afternoon of November 4th, and 25 of the 52 midterm claims NewsGuard debunked this cycle dealt with supposed election fraud.


Source: NewsGuard Reality Check. Even in a Landslide, Voter Fraud Claims Persist. [online] Available at: https://www.newsguardrealitycheck.com/p/even-in-landslide-voter-fraud-claims


DFRLab Finds Few Accounts Dominated Armenian Diaspora Election Talk

A report published by the Digital Forensic Research Lab (DFRLab) states that, in 204,552 posts collected from 83 public Armenian diaspora Facebook groups between March 1st and June 18th, a relatively small number of accounts produced a large share of posts, with 20 of 6,586 active accounts, fewer than 0.4 percent, publishing almost 20 percent of all posts before the June 7th parliamentary elections. Most of the accounts and messages it documented were critical of the Armenian government, and the heaviest posters mostly amplified anti-government and pro-opposition sources, led by former President Robert Kocharyan's Facebook page with 877 shares.


The DFRLab also found a network of seemingly inauthentic accounts, in clusters of eleven and six, promoting opposition leader Gagik Tsarukyan and his party, with ten accounts posting fifteen identical copies of the slogan "On 7 June I choose N7" into six diaspora groups within about half an hour on May 4th. Because most diaspora members could not vote from abroad, the researchers say such messaging could serve other purposes, such as influencing relatives inside Armenia, mobilizing the diaspora to travel home to vote, and increasing divisions between the diaspora and the government.


Source: Digital Forensic Research Lab (DFRLab). How Political Messaging Spread in Armenian Diaspora Facebook Groups Before the 2026 Elections. [online] Published 4 November 2026. Available at: https://dfrlab.org/2026/11/04/how-political-messaging-spread-in-armenian-diaspora-facebook-groups-before-the-2026-elections/


Indian Consultancies Export Covert Election Manipulation to US Midterms

An article published by Al Jazeera states that India's political consultancies, which grow by covertly managing elections, are now exporting their "dirty tricks" to manipulate global elections like the US midterms, where researchers have found Indian social media bots and accounts shadow-posting videos backing specific campaigns. Antibot4Navalny told Al Jazeera it found at least 28 X accounts sharing videos supporting Haley Stevens's campaign in Michigan's Democratic Senate primary, garnering more than seven million views, and an Al Jazeera review found at least 15 of them posting from India, while nearly a dozen Indian political consultants said there are no limits, guardrails, or red lines in such shadow campaigns.


New Delhi consultant Tushar Giri told Al Jazeera, "We are manipulating elections; there is no other way to say it”, and content creator Rajan Kumar said he was paid about $7 a day, with Al Jazeera reporting that posts he created were shared on shadow accounts backing William Ruto's 2022 presidential bid in Kenya, although he said he never worked directly with Ruto's representatives. Indian consultants told Al Jazeera that platform community standards are routinely violated, and Al Jazeera reports that premium VPNs are the go-to tools for such consultancies when they face restrictions and that several rely on hawala networks to move funds, while author Amogh Dhar Sharma says the physical distance involved gives everyone "plausible deniability" if operations are revealed.


Source: Al Jazeera. Shadowy Indian Election Consultants Add US Midterms to Global Footprint. [online] Published 2 November 2026. Available at: https://www.aljazeera.com/features/2026/11/2/shadowy-indian-election-consultants-add-us-midterms-to-global-footprint/


Pew Finds News Trust Climbing as Social Media Trust Holds Steady

An analysis published by Pew Research Center states that Americans are more likely than a year ago to trust information from national and local news organizations, with 62% of U.S. adults saying in a September 2026 survey that they have a lot of or some trust in information from national news organizations, up 6 percentage points since September 2025, and 75% saying the same of local news outlets, up 5 points. By contrast, 38% say they have at least some trust in information from social media sites, virtually unchanged from 37% in 2025.


Trust in national news rose among both Republicans, from 44% to 50%, and Democrats, from 69% to 73%, while trust in social media is comparable across the parties at 37% and 40%. Age gaps persist for social media, which about half of adults aged 18 to 29 trust at least somewhat compared with 25% of those 65 and older, while Republicans of all ages are now more similar in their trust in national news than they were a year ago.


Source: Pew Research Center. Americans’ Trust in Information from News Organizations Has Risen in the Past Year. [online] Published 2 November 2026. Available at: https://www.pewresearch.org/short-reads/2026/11/02/americans-trust-in-information-from-news-organizations-has-risen-in-the-past-year/ 


'That's AI' Accusations Can Erode Trust in Online Political Debate

An article published by The University of Sydney states that research led by Dr Timothy Koskie, which analysed 220,373 posts and comments from Reddit's five largest news and political communities before the 2024 US presidential election, found that people are increasingly suggesting online posts and comments are AI-generated to discredit perspectives they disagree with. The study, published in Communication Research and Practice, found that such accusations were almost exclusively attached to contrasting political viewpoints and that perceptions of AI use in election-related content can undermine trust in political information online and erode confidence in elections.


Koskie said references to bots and algorithms were frequently used to discredit information when users challenged claims, and that "when someone was labelled a bot, conversations lost momentum”, while users also voiced distrust of platform algorithms and their possible role in shaping electoral outcomes. He warned that legitimate concerns about AI risk being "weaponised to undermine democratic communication that is not AI-generated” and said social media platforms have a responsibility to promote trustworthy and transparent information environments.


Source: The University of Sydney. Distrust of AI Is Changing Engagement with Online Political News. [online] Published 3 November 2026. Available at: https://www.sydney.edu.au/news-opinion/news/2026/11/03/distrust-of-ai-is-changing-engagement-with-online-political-news.html


[Appendix - Frameworks to Counter Disinformation]


CheckFirst Dataset Tracks 15 Million Pravda Network Articles

An article published by CheckFirst states that it rebuilt its collection of the pro-Kremlin Pravda network from the ground up and that, as of October 28th, 2026, its dataset holds 15,046,455 articles collected since June 2023 across 88 websites and 47 languages, including 6.8 million in 2025 and 5.2 million already in 2026, with around 18,000 new articles a day over the last month. The network produces no original content but republishes in bulk posts from Russian state media, pro-Kremlin Telegram channels, and official websites, with Telegram channels and Russian state media, starting with TASS and RIA Novosti, the most republished sources.


CheckFirst publishes free aggregated statistics on portal-kombat.com and as open files on GitHub updated at least twice a day, and offers the full archive, modelled as STIX 2.1 objects with daily updates, through an OpenCTI connector available as an annual subscription. It notes that the network kept publishing after VIGINUM exposed it in February 2024 and the Council of the EU sanctioned the linked firm TigerWeb in July 2025, and that the DFRLab has traced around 40,000 English-language Pravda articles into Common Crawl, one of the main sources of AI training data.


Source: CheckFirst. Introducing Our New Pravda Network Dataset: 15 Million Articles in 47 Languages. [online] Available at: https://checkfirst.network/introducing-our-new-pravda-network-dataset-15-million-articles-in-47-languages/


Montenegro and Albania Seek NATO Help Against Russian Disinformation

An article published by POLITICO Europe states that Montenegrin Defense Minister Dragan Krapović and his Albanian counterpart, Ermal Nufi, want NATO to send experts to help them counter growing Russian disinformation, saying they face social media campaigns aimed at destabilizing the Balkan nations, with Krapović saying, "Russia is continuously conducting … information campaigns”. NATO allies first agreed to set up hybrid response teams in 2018, and former NATO assistant secretary-general Antonio Missiroli said a team typically consists of around a dozen experts loaned by member governments.


The debate is politically charged in Albania, where Prime Minister Edi Rama has blamed Russia and Iran for stirring up anti-corruption protests, a claim SCiDEV co-founder Blerjana Bino said no evidence supports, and both Russia and Iran deny involvement. Three NATO diplomats said allies would be open to considering a team but cautioned Albania against using any response for domestic political reasons, and a NATO poll seen by POLITICO found 95% of Albanians but only 52% of Montenegrins support remaining in the alliance.


Source: POLITICO. Montenegro and Albania Face Russian Disinformation Over NATO Support. [online] Available at: https://www.politico.eu/article/montenegro-albania-nato-support-russia-disinformation/


Taiwan Moves to Amend Anti-Infiltration Act Against Transnational Repression

An article published by Taiwan News states that Justice Minister Cheng Ming-chien told a legislative meeting, per CNA, that the government is working to amend the Anti-Infiltration Act and that existing laws are not strong enough to deter and prevent transnational repression. According to the Ministry of Justice, the amendment would create new offenses specific to transnational repression, allow authorities to confiscate assets tied to such operations, and establish internet-related mechanisms to stem the effects of repression, while the act, which took effect in 2020, already punishes five types of offenses, including spreading disinformation to manipulate elections at the instruction of, or with financial support from, the Chinese Communist Party.


The Cabinet and DPP lawmakers have proposed close to 30 versions of amendments to the act, PTS reported, and Mainland Affairs Council Deputy Minister Liang Wen-chieh said the Chinese Communist Party has targeted 131 Taiwanese since 2005, adding that the government plans to set up a hotline for reporting suspected cases. Comedian Huang Yi-hao, the victim of an alleged Chinese-directed car attack for which five men were indicted in October, urged the main political parties to work together on reform.


Source: Taiwan News. Taiwan moves to toughen law against Chinese transnational repression. [online] Available at: https://www.taiwannews.com.tw/news/6472452


[CRC Glossary]


The nature and sophistication of the modern Information Environment is projected to continue to escalate in complexity. However, across academic publications, legal frameworks, policy debates, and public communications, the same concepts are often described in different ways, making collaboration, cooperation, and effective action more difficult.


To ensure clarity and establish a consistent frame of reference, the CRC is maintaining a standard glossary to reduce ambiguity and promote terminological interoperability. Its scope encompasses foundational concepts, as well as emerging terms relating to Hostile Influence and Cyfluence.


As a collaborative project maintained with input from the community of experts, the CRC Glossary is intended to reflect professional consensus. We encourage you to engage with this initiative and welcome contributions via the CRC website.










 
 
bottom of page