_edited.png)
.png)
Cyber based influence campaigns October 26th – November 1st 2026 Report
[Introduction]
Cyber-based hostile influence campaigns are aimed at influencing target audiences by promoting information and/or disinformation over the internet, sometimes combined with cyber-attacks which enhance their effect (hence force Cyfluence, as opposed to cyber-attacks that aim to steal information, extort money, etc.) Such hostile influence campaigns and operations can be considered an epistemological branch of Information Operations (IO) or Information Warfare (IW).
Typically, and as customary during the last decade, the information is spread throughout various internet platforms, which are the different elements of the hostile influence campaign, and as such, connectivity and repetitiveness of content between several elements are the main core characteristics of influence campaigns.
Hostile influence campaigns, much like Cyber-attacks, have also become a tool for rival nations and corporations to damage reputation or achieve various business, political or ideological goals. Much like in the cyber security arena, PR professionals and government agencies are responding to negative publicity and disinformation shared over the news and social media.
We use the term cyber based hostile influence campaigns, as we include in this definition also cyber-attacks aimed at influencing (such as hack and leak during election time), while we exclude of this term other types of more traditional kinds of influence such as diplomatic, economic, military etc.
During October 26th to November 1st 2026, we observed, collected and analyzed endpoints of information related to cyber based hostile influence campaigns (including Cyfluence attacks). The following report is a summary of what we regard as the main events. Some of the mentioned campaigns have to do with social media and news outlets solemnly, while others leverage cyber-attack capabilities.
[Contents]
Tiktok
Russia
Apparent Storm-1516 Video Fakes Assault Claims Against Sherrod Brown
Russian Fakes Target France's Pro-Ukraine Presidential Contenders
Fake Euromaidan Press Clone Pinned Russian Bus Bombing on Ukraine
Impostor Toronto Sun Site Fabricated Zelenskyy Nova Scotia Bunker Purchase
TASS-Founded Network Recasts Leipzig Sabotage Probe as Anti-Russian Politics
Kremlin Denies Political Prisoners While Accusing Ukraine of Holding Them
Russian Outlets Turned Kyiv Basement Complaint Into 'Secret Drone Production'
China
Cyflunce Attack
Google Terminates Thousands of YouTube Channels in Q3 Influence Takedowns
Apparently Misread Ballot Alert Fuels False Cook County Rigging Claim
Researchers Trace Racist Anti-Qatar Ad Campaign Likely to Israel
Fake Accounts Impersonate Armenia's Speaker, Ministers, and Yerevan Mayor
Survey Finds Only 32% Highly Confident in Media's Midterm Reporting
[ Report Highlights]
• NewsGuard said Russia's Storm-1516 appears to be behind a fake Cleveland 19 segment claiming four former staffers accused Ohio Senate candidate Sherrod Brown of sexual assault.
• Graphika identified three Spamouflage-linked activity sets on X in which accounts pose as US voters and question election integrity ahead of the midterms.
• France's Viginum has detected hundreds of disinformation operations targeting the 2027 presidential vote, as Moscow-linked campaigns smear pro-Ukraine candidates, the Kyiv Independent reports.
• Researchers documented at least 533 million recorded exposures of anti-Muslim and anti-Qatar ads in 30 countries over three years, assessing with moderate to high confidence an Israeli origin.
• Google's Q3 bulletin lists thousands of YouTube channels terminated in China- and Indonesia-linked influence campaigns, plus hundreds more linked to a Russian consulting firm.
• A NewsGuard sting found 21 of 60 TikTok influencers initially willing to post paid midterm messages without disclosure, despite TikTok's ban on paid political content.
• Forum AI found almost 40 percent of chatbot answers to election queries contained at least one factual error, as millions of US voters rely on AI tools.
• Ukraine's Air Force said the country's air raid alert system was hacked on November 1st, as people received false nuclear, chemical, and street-fighting warnings.
[ Report Summary]
• A La Spezia court ordered Meta to remove fake ads using financial adviser Salvatore Gaziano's name and image and to implement filters preventing such content from being republished.
• TikTok said a dedicated election taskforce, fact-checking partner Reuters, and media literacy partner Stop Fals! are part of its preparations for Gagauzia's November 15th election.
• NewsGuard found a fake Cleveland 19 segment claiming four former staffers accused Ohio Senate candidate Sherrod Brown of sexual assault, apparently produced by Russia's Storm-1516.
• The Kyiv Independent reports that Moscow-linked campaigns have spread false claims about Raphael Glucksmann, Gabriel Attal, and Edouard Philippe ahead of France's April 2027 presidential election.
• Euromaidan Press says a look-alike copy of its website, tied by Gnida Project and NewsGuard to Storm-1516, falsely blamed a Ukrainian drone for Russia's Kramatorsk bus strike.
• DisinfoWatch traced how a fake Toronto Sun article claiming Zelenskyy bought a Nova Scotia nuclear bunker spread on X, but could not establish who created it.
• Ukrinform says the TASS-founded Global Fact-Checking Network misrepresented a Telegraph and Welt am Sonntag investigation to cast doubt on Russia's suspected role in the Leipzig airport sabotage.
• EUvsDisinfo says the Kremlin denies holding political prisoners while accusing Ukraine of jailing people for pro-Russian views, even as Memorial recognises 1,825 political prisoners in Russia.
• StopFake found Lenta.ru, Ukraina.ru, and Argumenty i Fakty presented residents' unproven suspicion of drone production in a Kyiv apartment basement as an uncovered fact.
• Graphika identified three Spamouflage-linked activity sets on X in which accounts pose as US voters, post divisive political content, and amplify each other ahead of the midterms.
• Jamestown says Beijing is escalating political warfare against the Philippines through sanctions, territorial claims, and propaganda supporting a Marcos rival, though its efficacy appears limited.
• The Jerusalem Post, citing The Telegraph, reports that Iranian officials described plans to interfere in the US midterms, with one saying Tehran examined ways to recruit election insiders.
• An INSS and FakeReporter report names Iran, the Turkey-based Isnad network, and Russia's Doppelgänger as the most prominent foreign actors targeting Israeli social media before the election.
• Researchers Marc Owen Jones and Sohan Dsouza documented 533 million recorded exposures of anti-Muslim and anti-Qatar ads in 30 countries, assessing with moderate to high confidence an Israeli origin.
• Israeli watchdog FakeReporter found election-day disinformation drew more than 3 million cumulative views, including an AI-generated image of Arab voter crowds shared by Prime Minister Netanyahu.
• Ukraine's Air Force said the country's air raid alert system was hacked on November 1st, as people received false nuclear, chemical, and street-fighting warnings.
• Cybernews analysed 104 reported political deepfakes since early 2025, finding 49 portrayed Democrats negatively versus 28 for Republicans, while Trump posted 20 of the 104.
• AFP reports that studies found chatbots giving erroneous election answers, with Forum AI finding almost 40 percent contained at least one factual error ahead of the midterms.
• William Yeates, the first person charged under Australia's 2024 federal deepfake pornography laws, received a sentence of two years and three months but was released on a recognisance order.
• Agência Lupa found 920 of 1,941 election-related posts it checked during Brazil's first round were AI-generated, most unlabeled, despite electoral court rules banning deepfakes.
• Google's Q3 2026 Influence Operations Bulletin lists coordinated influence campaigns it terminated, including thousands of YouTube channels linked to China, Indonesia, and Russia.
• NewsGuard debunked viral claims that Cook County voting machines discouraged Republican judicial votes, finding they apparently stemmed from a misread notification about an undervoted contest.
• Posing as a political consultancy, NewsGuard found 21 of 60 TikTok influencers initially agreed to post paid midterm messages without disclosing payment, despite TikTok's paid political content ban.
• CNA Verify found nearly 400 posts falsely tying Singapore to Indonesia's stock market rout and a fictitious meeting, drawing nearly 12 million views, with some accounts showing signs of coordination.
• OC Media reports fake social media accounts impersonating Armenia's parliamentary speaker, Yerevan's mayor, and several ministers, which a CyberHub co-founder links to efforts to erode public trust.
• A Medill and Alliance for Trust in Media survey found only 32% of Americans have high confidence news organizations will accurately report midterm election results.
• Pakistan's Election Commission proposed code amendments banning deceptive deepfakes and AI-driven fake engagement in campaigns while requiring clear labels on AI-generated election material.
• The BBC World Service's Global Signals research, focused on Russian and Arabic, assessed over 100,000 posts from known disinformation accounts and found significant efforts to discredit the BBC.
• Andy Pryce argues Britain's planned National Centre for Information Defence should investigate who runs and funds hostile foreign information operations rather than policing domestic speech.
[State Actors]
La Spezia Court Orders Meta to Filter Deepfake Scam Ads
An article published by Il Sole 24 Ore states that the Court of La Spezia granted an urgent appeal, heard without the other party being present, lodged by financial adviser Salvatore Gaziano, and ordered Meta Platforms Ireland not only to remove the fake adverts but also to implement appropriate filtering measures to prevent such content from being republished in future. Judge Gabriele Romano ordered the immediate cessation on Facebook, Instagram, WhatsApp and any other channel of adverts, posts and pages that use Gaziano's name, image, cloned voice or biometric data without authorisation, the prompt removal of the advertisements, and the deactivation of the WhatsApp groups and telephone numbers being promoted.
Il Sole 24 Ore says the filtering obligation appears to be the most significant new development, noting that Gaziano, Banca Aidexa chairman Roberto Nicastro, and other figures targeted by deepfake adverts have faced inaction from the platforms, which often fail to respond or claim the video does not breach their rules. A hearing to confirm the order, issued on October 29th, will be held in La Spezia on December 10th.
Source: Il Sole 24 Ore. Meta Must Remove and Filter Out Fraudulent Deepfakes on Facebook and WhatsApp. [online] Available at: https://en.ilsole24ore.com/art/meta-must-remove-and-filter-out-fraudulent-deepfakes-on-facebook-and-whatsapp-AJF9jNzB
Tiktok
TikTok Deploys Election Taskforce Ahead of Gagauzia Vote
An announcement published by TikTok says the platform is preparing for the general election in Moldova's autonomous region of Gagauzia on November 15th, with a dedicated election taskforce made up of cybersecurity, misinformation, and integrity teams, working alongside moderation technology and external partners such as fact-checking organisations. In Gagauzia, TikTok is partnering with Reuters for fact-checking, will show an Election Awareness guide to people searching for election-related terms, and is providing educational videos created with its media literacy partner Stop Fals! to help users spot potentially false information.
TikTok says it removes content that shares false information about how and when to vote, bans accounts that pretend to be a politician or a news publication, and acts against misleading AI-generated content even if it is labelled. Claims that cannot be immediately verified, for example while votes are still being counted, receive an 'unverified information' label and are not recommended to the For You feed, while its cybersecurity and threat disruption teams remove fake accounts and covert networks trying to manipulate public debate; paid political advertising remains prohibited, including creators being paid to promote a politician or party.
Source: TikTok. Protecting Our Community’s Experience During the Upcoming Gagauzia General Election. [online] Available at: https://newsroom.tiktok.com/protecting-our-communitys-experience-during-the-upcoming-gagauzia-general-election?lang=en
Russia
Apparent Storm-1516 Video Fakes Assault Claims Against Sherrod Brown
An analysis published by NewsGuard's Reality Check states that a Russian influence operation is targeting Democratic Ohio Senate candidate Sherrod Brown with a fake TV news video reporting that four former staffers accused him of sexual assault. Pro-Russian X user @X_Global_tv posted the supposed Cleveland 19 report at 2:58 p.m. on October 26th, and NewsGuard determined that it added dubbed audio to authentic footage from an October 21st Cleveland 19 segment about an attack ad against Ohio governor candidate Dr. Amy Acton; the station's news director, Brian Sinclair, told NewsGuard, 'We have reported no such thing'.
By the morning of October 27th, X had suspended @X_Global_tv, but other accounts had already shared the clip, including a conservative user whose post drew 536,700 views and had yet to be flagged by a Community Note the next morning; one of the four named former staffers called the claim 'completely false and fake news as it pertains to me.' NewsGuard says the video's format and amplification pattern make it appear to be the work of Storm-1516, to which the anonymous Gnida Project also attributed it, and notes that the same operation produced AI deepfakes targeting Texas candidate James Talarico a week earlier, while another Russian operation, Matryoshka, has posted fake reports about Brown and other Democratic Senate candidates.
Source: NewsGuard Reality Check. Russia Fabricates Sexual Assault Claims. [online] Available at: https://www.newsguardrealitycheck.com/p/russia-fabricates-sexual-assault
Russian Fakes Target France's Pro-Ukraine Presidential Contenders
An article published by The Kyiv Independent states that Moscow-linked campaigns have spread false claims that center-left Raphael Glucksmann helped set up torture prisons in Ukraine, that Gabriel Attal inherited a drug empire, and that centrist Edouard Philippe suffers from dementia, while France's Viginum agency has already detected hundreds of disinformation operations targeting the April 2027 presidential vote. NewsGuard's Chine Labbe told the outlet that, as of mid-October 2026, NewsGuard had counted 89 fake Matryoshka reports targeting French presidential candidates and, since the summer, seven claims targeting French candidates from Storm-1516, a GRU-linked campaign according to the Kyiv Independent, three of which imitated real news outlets.
According to Viginum, the summer fakes targeting Philippe and Glucksmann were carried out by Storm-1516, and the independent Gnida Project reported that the same operation later posed as environmental news site Reporterre to claim Glucksmann spent over 2 million euros on private jet flights. Viginum described the operations as 'mediocre' and 'lacking visibility,' but Sciences Po researcher Amelie Jaques-Apke argues that 'the real risk lies in amplification' and that the more durable objective is 'to make whatever result emerges look illegitimate.'
Source: The Kyiv Independent. Fact-check: Inside Russia’s Campaign to Undermine France’s Pro-Ukraine Candidates. [online] Available at: https://kyivindependent.com/fact-check-inside-russias-campaign-to-undermine-frances-pro-ukraine-candidates/
Fake Euromaidan Press Clone Pinned Russian Bus Bombing on Ukraine
An article published by Euromaidan Press states that it was impersonated in a Russian disinformation campaign through a copycat website, with a hyphen added to its name, that published a fabricated article alleging a Ukrainian drone had killed civilians in Kramatorsk and citing anonymous 'Ukrainian OSINT channels'. In reality, the October 8th strike was a Russian aerial bombing of two public buses that killed 33 civilians; the fake began circulating on X on October 24th with an apparently AI-produced video, and the videos on accounts such as @vick55top averaged 400,000 to 500,000 views, which the outlet calls a likely sign of inauthentic amplification.
The clone scraped the entire Euromaidan Press site and injected the fabricated story among genuine articles, and its look-alike domain was registered on October 15th, eight days before the fake appeared, according to who.is data. Gnida Project and NewsGuard attribute the fake to Storm-1516, whose some 906 fabricated reports have impersonated 163 outlets from 21 countries since 2023, according to NewsGuard; the outlet says complaints to host Namecheap, to Cloudflare and to the registrar got the clone taken down, and it published its takedown procedure for other newsrooms.
Source: Euromaidan Press. A Russian Disinformation Campaign Cloned Euromaidan Press to Blame Ukraine for Russia’s Own Strike on Kramatorsk — We Took the Fake Down. [online] Published 29 October 2026. Available at: https://euromaidanpress.com/2026/10/29/a-russian-disinformation-campaign-cloned-euromaidan-press-to-blame-ukraine-for-russias-own-strike-on-kramatorsk-we-took-the-fake-down/
Impostor Toronto Sun Site Fabricated Zelenskyy Nova Scotia Bunker Purchase
An analysis published by DisinfoWatch states that a website posing as the Toronto Sun, toronto-sun.ca, falsely claimed on October 22nd that Ukrainian President Volodymyr Zelenskyy had bought a $42-million Cold War nuclear bunker in Debert, Nova Scotia, an article the newspaper's deputy editor confirmed to Lead Stories was fake. DisinfoWatch collected 2,259 X posts connected to the claim between October 22nd and 25th, which had approximately 7.76 million recorded views, and found that four posts accounted for 1,746 of the 1,754 reposts captured.
Some patterns raise questions about possible coordination, such as two accounts publishing the same opening wording 100 seconds apart and 24 accounts reposting all four leading messages, but DisinfoWatch stresses that these do not prove anyone organised the sharing. The method resembles Russia's Doppelganger and Storm-1516 operations, yet a technical comparison by Vigil Strategic Intelligence against approximately 820 known adversary domains found no shared infrastructure, though the site's ownership is concealed and public Doppelganger records lack sufficient detail for a conclusive comparison; a domestic hoax or independent operator remains possible, and DisinfoWatch says naming a specific Russian operator would go beyond what its investigation establishes.
Source: DisinfoWatch. Fake Toronto Sun Story Spreads Zelenskyy Bunker Hoax to Millions on X. [online] Available at: https://disinfowatch.org/fake-toronto-sun-story-spreads-zelenskyy-bunker-hoax-to-millions-on-x/
TASS-Founded Network Recasts Leipzig Sabotage Probe as Anti-Russian Politics
A fact-check published by Ukrinform states that the so-called Global Fact-Checking Network (GFCN), established by Russia's state-owned TASS news agency, published an article claiming that a joint investigation by The Telegraph and Welt am Sonntag proves that accusations of Russia organising sabotage targeting a Ukrainian An-124 cargo aircraft at Leipzig/Halle Airport were fabricated, and arguing that the investigation itself is part of a political campaign aimed at influencing public opinion ahead of regional elections in Germany. Ukrinform finds that GFCN treated a single misdated sentence as deliberate falsification without evidence and claimed the incident was concealed until September 1st, although the first media reports appeared on August 5th and Germany's National Security Council met on August 7th.
GFCN also omitted forensic details reported by The Telegraph, including DNA matching Belarusian suspect Andrei Karshakov on a glove fragment near the scene, though Ukrinform notes this evidence does not on its own establish that Russian intelligence directed the operation. GFCN, whose establishment was announced in November 2024 and whose founders were TASS, the non-profit Dialog Regions and the New Media Workshop, is headed by US- and EU-sanctioned Vladimir Tabak, and has been described by Reporters Without Borders as a tool for spreading Kremlin propaganda under the guise of independent international fact-checking.
Source: Ukrinform. Russian Pseudofactchecking Network GFCN Manipulates The Telegraph Investigation into Sabotage in Leipzig. [online] Available at: https://www.ukrinform.net/rubric-factcheck/4179991-russian-pseudofactchecking-network-gfcn-manipulates-the-telegraph-investigation-into-sabotage-in-leipzig.html
Kremlin Denies Political Prisoners While Accusing Ukraine of Holding Them
An article published by EUvsDisinfo states that the Kremlin 'categorically' denies the existence of political prisoners in Russia, as spokesperson Dmitry Peskov said on September 30th, while using the term extensively about Ukraine and claiming that Kyiv jails people for their political views or pro-Russian stance, which Ukrainian media see as part of a Kremlin FIMI campaign to discredit Ukraine's justice system. EUvsDisinfo calls such claims unsubstantiated, noting that civilians were imprisoned under a March 2022 legal reform punishing collaboration with the invading forces and that neither the United Nations nor Amnesty International or Human Rights Watch consider them political prisoners.
As of October 2026, Memorial's 'Support for Political Prisoners' project recognises 1,825 people as political prisoners held in 336 institutions across 78 regions and lists 78 who died in custody, while estimating in 2025 that the true total, including Ukrainian prisoners of war and civilian hostages, was probably around 10,000. Most cases stem from laws introduced in March 2022, with most prisoners convicted of spreading 'knowingly false information' about the armed forces or 'discrediting' them, and EUvsDisinfo describes the Kremlin's accusations against Ukraine as 'a brazen inversion’.
Source: EUvsDisinfo. Russia Introduces New Laws to Jail Critics but Denies It Holds Any Political Prisoners. [online] Available at: https://euvsdisinfo.eu/russia-introduces-new-laws-to-jail-critics-but-denies-it-holds-any-political-prisoners/
Russian Outlets Turned Kyiv Basement Complaint Into 'Secret Drone Production'
A fact-check published by StopFake states that no one discovered any 'secret drone production' in the basement of a Kyiv apartment block: the residents' complaint, spread by pro-Kremlin propagandist and former Verkhovna Rada deputy Ihor Mosiichuk, concerned only work being carried out by a tenant of private premises in the building and the tenant's restriction of access to the basement. Mosiichuk himself spoke only of 'possible' production, and, according to StopFake, his own statements to the Prosecutor General's Office and the SBU state outright that there is no evidence of drone production.
According to StopFake, the complaint says police told the applicants that drones would not be made in the building, while the residents complain about a power cable, a room for an industrial generator, construction waste and the expected work of machine tools, which StopFake describes as a conflict with the new owner and tenant of the premises. In Russian retellings, the suspicion instantly became a 'discovered' fact: Lenta.ru headlined that secret drone production had been uncovered, Ukraina.ru wrote that the basement was 'barricaded for drone production', and Argumenty i Fakty ran the headline 'Zelensky needs a sea of blood. UAV production placed in a residential building in Kyiv', with none of them offering any evidence beyond Mosiichuk's post.
Source: StopFake. Manipulation: A Secret Drone Production Facility Was Discovered in the Basement of a Residential Building in Kyiv. [online] Available at: https://www.stopfake.org/uk/manipulyatsiya-u-pidvali-zhitlovogo-budinku-v-kiyevi-rozkrili-sekretne-virobnitstvo-droniv/
China
Spamouflage Accounts Pose as US Voters Before Midterms
A report published by Graphika states that, ahead of the 2026 US midterm elections, Spamouflage-linked accounts and inauthentic pro-China accounts on X are posing as US voters and posting divisive content about US politics, social issues and the elections, mirroring tactics described in its 2024 report The #Americans. Graphika identified three activity sets: a likely Spamouflage-linked account, @speedysmm4547; a small network of four accounts with Spamouflage histories amplifying a MAGA-styled persona with 14.7k followers; and a purchased, hijacked, or otherwise repurposed Philippine culture account, Coolture, which had 201.6k followers as of October 30th.
The accounts post across the political spectrum and frequently question election integrity and the legitimacy of US democracy, with one using an AI-generated video to critique the democratic process. Posts in all three sets contain full-width punctuation consistent with operators typing English on Chinese-language keyboards, and most engagement comes from accounts within each network rather than authentic users, though Graphika notes that gaining access to an established account with more than 200k followers gives Spamouflage content a built-in reach that most of its personas lack.
Source: Graphika. The Americans: Season 2. [online] Available at: https://graphika.com/blogs/the-americans-season-2
TBeijing Targets Marcos Government With Sanctions and Propaganda
An analysis published by The Jamestown Foundation states that the People's Republic of China (PRC) is escalating its political warfare campaign against the Philippines in a bid to discredit the pro-US government of President Ferdinand Marcos Jr. and enable the victory of a more accommodationist leader in the May 2028 presidential election. Beijing has sanctioned Defense Secretary Gilberto Teodoro Jr., the first time it has targeted a sitting cabinet official of a country it diplomatically recognises, while Chinese academics argued at a June 30th symposium in Guangzhou that the Philippine province of Batanes belongs to the PRC.
Jamestown also cites new allegations that suggest deepening PRC meddling in domestic politics: in October 2026, Manila's National Security Council said it would investigate reports of PHP 319 million ($4.8 million) in remittances from the PRC to a company linked to Vice President Sara Duterte's husband, allegations Duterte denies, while Chinese media have been supportive of her, with a scholar quoted by Global Times citing her 'relatively pragmatic stances.' It assesses that Beijing's heavy-handed tactics are likely to backfire, stoking Philippine nationalism and pushing Manila closer to the United States, Japan and Taiwan.
Source: Jamestown Foundation. PRC Escalates Political Warfare Against Philippines. [online] Available at: https://jamestown.org/prc-escalates-political-warfare-against-philippines/
Iran
Iranian Officials Reportedly Describe Plans to Disrupt US Midterms
An article published by The Jerusalem Post states, citing The Telegraph, that Iran is preparing to interfere in the US midterm elections on November 3rd after attempting to disrupt Israel's general election, with several Iranian officials telling the British newspaper that Tehran views both votes as an opportunity to weaken its principal adversaries politically. According to one official, Tehran had been examining ways to recruit individuals involved in both countries' electoral processes, while cyber groups had been established to target their election systems, and another described the operations as an extension of Iran's military confrontation with Washington and Jerusalem aimed at destabilising both countries rather than securing victory for particular candidates.
The Telegraph's report did not establish that Iranian operatives had successfully penetrated voting systems in either country. The officials indicated that Tehran hopes political divisions in Israel and the US will constrain their governments' ability to conduct further military operations against Iran, with Brunel University of London's Steven Wagner assessing that Tehran would prefer Netanyahu to lose power but could also benefit from a prolonged political stalemate, even as Foreign Ministry spokesman Esmail Baghaei publicly dismissed the significance of Israel's election.
Source: The Jerusalem Post. Article 913265. [online] Available at: https://www.jpost.com/middle-east/iran-news/article-913265
Iran, Isnad, and Doppelgänger Targeted Israeli Social Media
A report published by the Institute for National Security Studies (INSS) states, in a joint publication with the FakeReporter research initiative, that the most prominent foreign actors targeting Israeli social media ahead of the October 27th Knesset elections are Iran, the Turkey-based Isnad network associated with the Muslim Brotherhood, and the Russian influence operation Doppelgänger, which are believed to share a goal of eroding public trust in state institutions and the electoral process. Golden Owl describes a broad network of Hebrew-language personas on X posing as Israelis, approximately 150 of which are linked to Iran according to account information displayed by X, and FakeReporter documented a network that simultaneously pushed messages supporting the Haredi struggle against conscription and messages opposing the Haredi public.
INSS monitoring covered approximately 100 Isnad accounts impersonating Israelis that published around 25,000 posts between August 1st and October 13th, 2026, while Alethea found that Doppelgänger, which also targeted the US and French elections, used dozens of accounts to post content and more than a thousand to amplify it, its Israeli component consisting primarily of a website impersonating a well-known Israeli news site whose content focused on eroding trust in relations between Israel and the United States. The authors say most of the activity exploits the election period to intensify existing influence efforts rather than interfering directly in the vote, that content usually reaches a broad audience only when real Israelis share it, and that this English version, published after the election, reflects a report first published in Hebrew on October 22nd.
Source: Institute for National Security Studies (INSS). Elections 26 Report. [online] Available at: https://www.inss.org.il/publication/elections-26-report/
Cyfluence Attack
Hackers Hit Ukraine's Air Raid Alerts With Fake Nuclear Warnings
An article published by The Kyiv Independent states that Ukraine's air raid alert system was hacked late on November 1st, the Air Force said, as sirens sounded across the country and people received false alerts warning of nuclear, chemical, and street fighting threats, with a variety of fake alerts and messages in Russian sent to users' phones through the officially supported Air Alert app. One false warning read, in Russian, 'Hi! A nuclear alert is about to go off all across Ukraine! Don't worry, the Oreshnik is on its way,' and the app's developers said 'unauthorized persons have interfered with the application' and that they had disabled push notifications and temporarily suspended it.
Several regional governors advised residents that there was no threat, and officials warned the cyberattack could involve a phishing operation, with Vinnytsia Oblast Governor Natalia Zabolotna urging people not to click on the link in the message; the false alerts were cleared about an hour later. Russia's air raid alert system was also hacked in the early hours of November 2nd, with messages claiming 'nuclear warheads' had been launched, in what the Kyiv Independent says may have been a Ukrainian response to the earlier Russian cyberattack.
Source: The Kyiv Independent. Ukraine’s Air Raid Alert System Hacked, Air Force Says, as False Nuclear, Chemical Warnings Sound. [online] Available at: https://kyivindependent.com/ukraines-air-raid-alert-system-hacked-air-force-says-as-false-nuclear-chemical-warnings-sound/
[AI Related Articles]
Deepfakes Portray Democrats Negatively More Than Republicans
An analysis published by Cybernews states that its researchers examined 104 political deepfakes reported in the Resemble AI database from early 2025 to October 13th, 2026, finding that Democrats were depicted negatively in 49 of them compared with 28 negative deepfakes about Republicans. Trump posted 20 of the analysed deepfakes; Republican candidates, officials and party groups shared 22 and Democratic-linked sources 7, while 46 of the 104 came from sources not clearly affiliated with any party or unknown, and seven were traced to foreign state actors including Russia, Iran and China.
Cybernews says its analysis suggests the spread of political deepfakes is not limited to foreign-funded bot farms, as the parties themselves use AI to target opponents, often rivals both within and outside their own party, citing a raccoon deepfake in Alabama's Republican primary runoff for lieutenant governor and Andrew Cuomo's deepfakes attacking Zohran Mamdani. It notes that a 2026 analysis of 25 studies suggests political deepfakes are not inherently more persuasive than other misinformation but cause destabilisation and erode trust, while one experiment found that their delegitimising impact 'was resilient to corrections’.
Source: Cybernews. Political Deepfakes 2026 Midterms. [online] Available at: https://cybernews.com/ai-news/political-deepfakes-2026-midterms/
Researchers Say AI Chatbots Spread Election Errors Before Midterms
An article published by France 24 states, in an AFP report, that researchers say AI chatbots are dispensing misleading voter information, misidentifying candidates and regurgitating Russian propaganda ahead of the November 3rd US midterms, the first federal election in which millions of voters are actively relying on AI tools for political information. A Forum AI study of eight models found that almost 40 percent of chatbots' answers to election-related queries contained at least one factual error, including Google's Gemini 3.6 Flash giving November 3rd as Pennsylvania's deadline to request a mail-in ballot when the actual deadline was a week earlier.
Researchers also warned of vulnerability to foreign influence operations: when prompted by NewsGuard, Google's AI Overview, Gemini and Microsoft's Copilot repeated an unfounded allegation against Texas Senate candidate James Talarico, which came from a likely AI-altered clip and bore the hallmarks of a Russian campaign, although a later AFP test found the tools citing professional fact-checkers. Google said the issue was addressed as its systems updated, Microsoft said Copilot later identified the claim as fabricated, and Brennan Center research found leading chatbots pushed back against common election conspiracy theories even when repeatedly challenged.
Source: France 24. Spewing US Election Falsehoods, AI Chatbots Face Scrutiny. [online] Published 1 November 2026. Available at: https://www.france24.com/en/live-news/20261101-spewing-us-election-falsehoods-ai-chatbots-face-scrutiny
Australian Judge Spares Jail for First Person Charged Under Deepfake Law
An article published by ABC News states that William Hamish Yeates, 20, the first person in Australia to be charged under federal laws introduced in 2024 to combat deepfake pornography, has avoided jail after a judge concluded he did not have a 'malicious motive.' Yeates admitted creating sexually explicit deepfake images of a teenage girl and sharing them on Ero Me and X in 2024 and 2025, and District Court Judge Anne Barnett sentenced him to two years and three months but released him on a three-year recognisance release order on condition of good behaviour.
Judge Barnett accepted that his offending was associated with obsessive thinking, that his compulsive sexual behaviour disorder contributed to it, and that his youth and autism spectrum disorder reduced his moral culpability to some extent, but said this did not diminish the harm to the victim, who first saw her Year 12 graduation photo on a pornographic website. She said this type of offending 'disproportionally targets women and girls' and that women 'are entitled to participate in online and public life free from harassment and intimidation and sexualised abuse.'
Source: ABC News. SA Man Avoids Jail in Milestone Deepfake Pornography Case. [online] Published 27 October 2026. Available at: https://www.abc.net.au/news/2026-10-27/sa-man-avoids-jail-in-milestone-deepfake-pornography-case/107313206
Most AI Election Posts in Brazil Lacked Labels Despite Court Rules
An article published by Rappler states that fact-checking agency Agência Lupa, through its VigIA project, confirmed that 920 of 1,941 election-related posts were AI-generated between August 16th and September 28th during Brazil's 2026 presidential race, and that 60% of these were deepfakes. Although Brazil's Superior Electoral Court (TSE) has banned deepfakes and required disclosure labels for other AI campaign materials since 2024, Lupa found that 60% of the analysed AI posts lacked transparency labels from their authors and that almost half (47%) of the synthetic media came from voters operating outside candidate disclosure rules.
The TSE ruled in September that the deepfake ban applies to content characterised as electoral propaganda, after declining to penalise Senator Flávio Bolsonaro for showing AI-generated images of his imprisoned father endorsing him at a private Liberal Party convention. Lupa founder Cristina Tardáguila said the rules 'are being fully and truly disrespected by all stakeholders' and that the 'biggest loophole is the lack of [law] enforcement', and Rappler presents Brazil's experience as a warning for the Philippines' 2028 elections.
Source: Rappler. Lessons from the Philippines’ AI Content Surge That Bypassed Brazil Election Rules — Report. [online] Available at: https://www.rappler.com/technology/lessons-philippines-ai-content-surge-bypassed-brazil-election-rules-report/
[General Reports]
Google Terminates Thousands of YouTube Channels in Q3 Influence Takedowns
A bulletin published by Google states that it terminated coordinated influence operation campaigns on its platforms in Q3 2026, including 6,103 YouTube channels in July, 3,406 in August, and 4,963 in September as part of its ongoing investigation into operations linked to the People's Republic of China sharing content in Chinese and English about China and US foreign affairs. Other large takedowns included 6,888 and 10,134 YouTube channels in campaigns linked to Indonesia that were supportive of its government, and 899, 621 and 409 channels in July, August and September in campaigns linked to a Russian consulting firm sharing Russian-language content supportive of Russia and critical of Ukraine, NATO and the West.
The bulletin also records smaller campaigns, such as 106 YouTube channels terminated in July for sharing Romanian and Russian content critical of Moldova's government and supportive of its pro-Russian opposition, several Iran-linked campaigns critical of Israel and the United States, and Israel-linked channels and blocked domains supportive of Israel and critical of Iran and Palestine. Google says some investigations drew on leads from Meta, Anthropic and Amnesty International, and besides terminating YouTube channels, it blocked domains from Google News surfaces and Discover, terminated Blogger blogs and Ads accounts, and banned a Play developer.
Source: Google. Influence Operations Bulletin: Q3 2026. [online] Available at: https://blog.google/security/influence-operations-bulletin-q3-2026/
Apparently Misread Ballot Alert Fuels False Cook County Rigging Claim
A fact-check published by NewsGuard's Reality Check states that conservative social media accounts falsely claimed that voting machines in Cook County, Illinois, discouraged voters from selecting Republican judicial candidates, based on an October 20th video of an unnamed voter saying a machine told her 'People are not typically choosing this person!' The claim appears to have originated in an October 20th X post by @WallStreetApes that received 800,000 views and 44,000 likes, and neither that post nor a repost by @catturd2 carried a Community Note.
Deputy Clerk of Communications Sally Daly of the Cook County Clerk's Office called the claim 'patently false,' saying voting equipment 'does not tell voters which candidates are more popular,' and NewsGuard notes there are no Republican judicial candidates on the November 2026 ballot in Cook County. The woman appears to have misunderstood a notification reading 'This contest is undervoted!', shown when a voter does not make all available selections, and NewsGuard has identified 29 other viral false claims about the midterms as early voting begins.
Source: NewsGuard Reality Check. Early Voting Is Underway, and So Are Election Misinformation Campaigns. [online] Available at: https://www.newsguardrealitycheck.com/p/early-voting-is-underway-and-so-are
TikTok Influencers Open to Undisclosed Political Ads
A report published by NewsGuard states that it created a fake consulting firm, R&H Strategies, which on October 13th emailed 60 US-based political TikTok creators, 30 on the right and 30 on the left, offering $750 to $2,000 for a one-minute video supporting a congressional campaign on the condition that they not disclose it was paid content. Twenty-one replied that they were interested without objecting to the condition, with left-leaning creators more receptive (12 of 30) than right-leaning ones (nine of 30), and in 12 follow-up phone interviews, nine influencers or their representatives confirmed they would post the message without disclosing payment.
Undisclosed paid political messaging is legal in federal races, since FTC rules exempt political messaging and the Federal Election Commission does not require influencers to disclose campaign payments, but TikTok's rules bar paid political content whether disclosed or not. NewsGuard says the responses reveal widespread confusion and the lack of an industry standard for disclosing paid political content, and notes that no videos were commissioned or produced and no money changed hands.
Source: NewsGuard. 35 Percent of TikTok Influencers Agree to Boost Midterm Candidates with No Disclosure of Payments in NewsGuard Sting. [online] Available at: https://www.newsguardtech.com/special-reports/35-percent-of-tiktok-influencers-agree-to-boost-midterm-candidates-with-no-disclosure-of-payments-in-newsguard-sting
Researchers Trace Racist Anti-Qatar Ad Campaign Likely to Israel
A report published by Dysinfluence states that researchers Marc Owen Jones and Sohan Dsouza documented a covert paid influence campaign that, between October 2023 and October 2026, recorded at least 533 million exposures of anti-Muslim, anti-migrant, racist, and anti-Qatar advertising in 30 countries, mostly in Europe, a total projected at 831 million for advertising the archives could not obtain, which the authors call likely a massive undercount. In Europe, the campaign uses the structure of the 'Great Replacement' conspiracy theory with Qatar in the role antisemitic versions give to George Soros, and the researchers' archive of its content holds 1,473 Facebook advertisements with 94.7 million recorded reach, 189 YouTube videos on 15 channels with 132 million public views, and 359 TikTok advertisements with 72.2 million reach.
The authors say the evidence indicates with moderate to high confidence that the campaign originated in Israel, citing Telegram video metadata showing a Sunday-to-Thursday working week at UTC+3 on machines with Hebrew drive and folder names, an Israeli fixed-line IP address exposed in one Wikipedia editing session, and campaign material passing twice through Johnnie Moore and his firm JDA Worldwide, although the client who commissioned the operation is not established. Meta removed the first-phase network in about mid-May 2024, but advertising resumed under new identities in November 2024; across the operation, advertising was placed through accounts and companies recorded in Vietnam, Brazil and Belgium, and the authors warn that it remains active in countries approaching major elections, including France and Italy in 2027.
Source: Disinformation Index. The Great Replacement. [online] Available at: https://thegreatreplacement.dysinfluence.com/report
AI Fakes and Voter Scares Flooded Israel's Election Day
An article published by Ynetnews states that a study by Israeli disinformation watchdog FakeReporter found that false information flooding social media on election day generated more than 3 million cumulative views, including a coordinated fear campaign portraying voter turnout in Arab communities as a threat. Prime Minister Benjamin Netanyahu shared a Channel 14 report claiming 'unusual congestion at polling stations in the Arab sector' with an image purportedly showing crowds of voters in Sakhnin that FakeReporter determined was entirely fabricated with an AI image generator, and the post, amplified by coalition lawmakers and media personalities, accumulated more than 2 million views on its own.
The report also raises concerns about possible foreign interference; a website circulated in WhatsApp groups supporting the government portrayed Gadi Eisenkot as enjoying widespread Palestinian support, and technical analysis led researchers to TikTok and Instagram accounts, one of which had been flagged as operating from Iran. It follows a pre-election deepfake that exploited the likeness of the late Shiri Bibas to urge Israelis to vote for the Democrats party, and the Central Elections Committee found no evidence of systematic ballot tampering after Netanyahu shared a separate claim about damaged right-wing ballots.
Source: Ynetnews. Article rjorajjpfx. [online] Available at: https://www.ynetnews.com/tech-and-digital/article/rjorajjpfx
CNA Verify Finds Nearly 400 Posts Falsely Blaming Singapore
An investigation published by CNA states that CNA Verify found close to 400 posts across Instagram, TikTok, YouTube, X and Facebook pushing false and unfounded claims tying Singapore to Indonesia's stock market rout and to a supposed meeting between Singapore's ambassador in Jakarta and Indonesians Dino Patti Djalal and Saiful Mujani that never took place; the posts appeared from October 19th to October 27th and have attracted nearly 12 million views in total. Among accounts targeting the two men, the largest group appears to be a network of 68 lookalike, self-styled news pages that shared captions and graphic templates, including 15 TikTok accounts created on a single day in May, though their posts drew a median of about 760 views each.
CNA Verify found clear signs that several accounts were coordinated, being set up on the same day and posting the same words and pictures at nearly the same time, but it could not establish whether a single operator was behind them. RSIS research fellow Muhammad Faizal bin Abdul Rahman pointed to studies showing that Indonesia's online space is full of 'buzzers', saying some may be coordinated by local political actors and some may be organic, and that for nationalism to be convincing 'it must aim at others that make convenient targets, such as smaller states’.
Source: CNA. Indonesia Disinformation: MSCI and Dino Patti Djalal. [online] Available at: https://www.channelnewsasia.com/singapore/indonesia-disinformation-msci-dino-patti-djalal-6502461
Fake Accounts Impersonate Armenia's Speaker, Ministers, and Yerevan Mayor
An article published by OC Media states that several high-ranking Armenian officials, including Parliamentary Speaker Ruben Rubinyan, Yerevan Mayor Tigran Avinyan, Education Minister Zhanna Andreasyan, Environment Minister Hambardzum Matevosyan, Economy Minister Gevorg Papoyan and Human Rights Defender Anahit Manasyan, have warned that fake social media accounts were created using their names and photographs. The officials and their spokespeople urged people to disregard messages from the accounts, avoid sharing personal or official information and refrain from making transfers, while the Central Bank of Armenia separately warned about fake documents circulated in its name and used by scammers.
CyberHub co-founder Artur Papyan said he did not believe it was a coincidence that a specific group of officials was targeted at the same time and viewed it in the context of attempts to erode public trust, recalling similar impersonation attempts between October 2025 and the end of January 2026 whose messages had Russian words left in some texts. He cautioned that this was not enough to conclude that Russia was behind those attacks, suggested they could have formed part of 'hybrid attacks' originating from Azerbaijan or Russia, and said there was not enough information to identify those behind the latest incidents.
Source: OC Media. Armenian Officials Warn of Apparently Organised Social Media Impersonation Campaign. [online] Available at: https://oc-media.org/armenian-officials-warn-of-apparently-organised-social-media-impersonation-campaign/
Survey Finds Only 32% Highly Confident in Media's Midterm Reporting
An article published by Nieman Lab states that a survey from the Medill Local News Initiative and the Alliance for Trust in Media found that about six in 10 Americans have at least 'some' confidence that news organizations will report the upcoming midterm election results accurately, but only 32% have 'quite a bit' or 'a great deal' of confidence, while 37% have 'not too much confidence' or 'no confidence at all.' The nationally representative survey of 1,057 US adults also found that about half of Americans have little or no confidence in news outlets to investigate voter fraud claims thoroughly.
Slightly more respondents said journalists manipulate the news for political or commercial purposes than said they report it accurately, with nearly 80% of Republicans saying journalists try to manipulate the news compared with 38% of independents and 24% of Democrats. Nieman Lab notes that the findings echo a Gallup survey putting trust in media to report 'fully, accurately, and fairly' at 33%, and that President Trump has cast doubt on elections on 70% of days since returning to office.
Source: Nieman Lab. Only 32% of Americans Have High Confidence That News Orgs Will Report Midterm Election Results Accurately. [online] Published October 2026. Available at: https://www.niemanlab.org/2026/10/only-32-of-americans-have-high-confidence-that-news-orgs-will-report-midterm-election-results-accurately/
[Appendix - Frameworks to Counter Disinformation]
Pakistan Election Commission Proposes Deepfake Ban and AI Labels
An article published by The News International states that the Election Commission of Pakistan (ECP) has proposed amendments to the Code of Conduct for Political Parties barring parties, candidates, election agents and their supporters from creating or disseminating AI-generated or manipulated material likely to deceive voters, and requiring 'clear and conspicuous disclosure' on campaign material generated or substantially altered through AI. The proposals would prohibit deepfakes creating false, derogatory or defamatory synthetic likenesses of candidates, election officials, the judiciary or the armed forces, bar AI-based bots and automated accounts used to create fake trends, and require AI robocalls or voice-cloned messages to disclose that at the start.
Separate provisions would require media organisations, journalists and social media influencers to label AI-generated election material, task Pemra, the Social Media Protection Regulatory Authority and the National Cyber Crime Investigation Agency with monitoring undisclosed or unlabelled content, and oblige media organisations and platforms to take down or relabel misleading AI content when directed. Election observers would have to report AI-generated disinformation promptly without further disseminating it, and stakeholders have been invited to submit feedback to the ECP by November 20th, 2026.
Source: The News International. ECP Moves to Curb Deepfakes, AI-Driven Election Disinformation. [online] Available at: https://www.thenews.pk/story/1445224-ecp-moves-to-curb-deepfakes-ai-driven-election-disinformation
BBC Research Finds Significant Efforts to Discredit the Broadcaster
An announcement published by the BBC states that the BBC World Service has launched Global Signals, research intended to strengthen its ability to understand and respond to disinformation, which examines how disinformation in Russian appeals to its audience and how the BBC, blocked in Russia, is continually attacked and discredited. Working with BBC Monitoring, its Global Audiences team and the Centre for the Analysis of social media (CASM Technology), researchers assessed over 100,000 posts from known disinformation accounts and over 54,000 mentioning the BBC across 11 social platforms between February 1st and May 31st, 2026, focusing on the Russian and Arabic environments.
The research found significant efforts to attack and discredit the BBC, and further analysis suggests that networks across both the Arabic and Russian information ecosystems fabricated BBC personas and content, that the BBC needs scale and pace to begin to respond to the challenges of Russia's state investment, and that blocking and jamming in Russia make circumvention essential to achieve the presence it has in Arabic markets. CASM Technology's Carl Miller said 'The Russian information ecosystem is incredibly crowded with inauthentic online activity' and that 'the resource focused on attacking the BBC is breathtaking’.
Source: BBC Media Centre. World Service: Global Signals Information Research. [online] Published 2026. Available at: https://www.bbc.com/mediacentre/2026/world-service-global-signals-information-research
Former Diplomat Urges Network-Focused Remit for UK Information Defence Centre
A commentary published by StopFake states, in a commentary by former British diplomat Andy Pryce for CEPA, that the UK's new National Centre for Information Defence (NCID), which Prime Minister Andy Burnham said at September's UN General Assembly would 'detect, attribute and disrupt' hostile state attacks, should focus on the networks threatening the UK's information space and will not decide what Britons are allowed to say. Pryce writes that the centre should ask who is behind an operation, who pays for it, what infrastructure enables it and what else the same network is doing against the UK, and that it needs legal powers and a wide investigatory remit balanced by transparent accountability and parliamentary scrutiny.
He rejects Reform leader Nigel Farage's claim that the centre would be a 'Ministry of Truth to clamp down on free speech', noting that its scope and powers have yet to be determined, and argues that NCID should foster two-way data sharing with social media platforms and frontier AI companies, respond to malign campaigns within news cycles and build national resilience to FIMI. Pryce also says the UK should form part of a European Endowment for Information Integrity, which Poland announced at disinfo2026 that it is supporting.
Source: StopFake. It’s the Networks, Stupid. [online] Available at: https://www.stopfake.org/en/it-s-the-networks-stupid/
[CRC Glossary]
The nature and sophistication of the modern Information Environment is projected to continue to escalate in complexity. However, across academic publications, legal frameworks, policy debates, and public communications, the same concepts are often described in different ways, making collaboration, cooperation, and effective action more difficult.
To ensure clarity and establish a consistent frame of reference, the CRC is maintaining a standard glossary to reduce ambiguity and promote terminological interoperability. Its scope encompasses foundational concepts, as well as emerging terms relating to Hostile Influence and Cyfluence.
As a collaborative project maintained with input from the community of experts, the CRC Glossary is intended to reflect professional consensus. We encourage you to engage with this initiative and welcome contributions via the CRC website.
