Introduction Executive Summary This installment in our series on Chinese Digital Influence in Southeast Asia examines Vietnam, a country whose relationship with China is shaped by over two millennia of conquest, cultural exchange, and independence struggles, punctuated by the 1979 Sino-Vietnamese War. Despite normalized relations since 1991, Vietnam maintains a careful balancing act: pursuing security ties with the U.S., Japan, and South Korea while upholding a policy of assurance toward China to deter coercion. China's digital influence campaign relies on state media (CGTN, Xinhua, China Radio International) promoting narratives of shared heritage and cooperation, at times spreading misleading COVID-19 origin claims. Notably, our research uncovered a coordinated inauthentic network of thousands of accounts on X, created to amplify pro-China messaging around Xi Jinping's December 2023 visit to Vietnam. China's influence also extends to diplomatic training, cyber activity, and economic leverage as Vietnam's top trading partner, ranking 43rd on the Doublethink Lab China Index for 2021.

Introduction Executive Summary In the third part of our ongoing series on Chinese digital influence in Southeast Asia our focus is on the Philippines. The aim of this paper is to create a foundation on which more detailed research can be conducted as specific case studies. With increasing tensions between China and the Philippines in the South China Sea more research is urgently needed on Chinese influence operations targeting both the Philippines and the discourse around the South China Sea conflict. Key Findings: Members of the Chinese Embassy actively use their social media accounts to spread Chinese narratives in the Philippine information space. Official accounts are amplified by inauthentic accounts. There are examples of inauthentic coordinated behavior in the Philippines. The inauthentic pro-Chinese entity Asia Today is pushing out Chinese narratives around the South China Sea conflict. Historical Background Following its independence in 1946, the Philippines established diplomatic ties with the Republic of China and maintained them even after the nationalist government relocated to Taiwan in 1949. It wasn't until 1975 that the Philippines formally recognized the People's Republic of China and normalized diplomatic relations. Over the ensuing decades, the two countries engaged in numerous high-level visits and bilateral agreements focused on trade and cultural exchange, fostering what appeared to be a growing friendship............

Introduction Executive Summary In the fourth part of our ongoing series on Chinese Influence in Southeast Asia, our Focus shifts to Malaysia. As with all papers in this series, the aim is to create a foundation upon which more detailed research can be conducted in the form of specific case studies. Numerous factors contribute to Malaysia being a focal point for influence operations. The nation boasts the fifth largest economy in Southeast Asia, representing approximately 12% of the region's GDP. With substantial deposits of tin and oil along with ranking as the 11th largest producer of bauxite and manganese, Malaysia holds significant natural resource wealth. Additionally, it also holds the third largest gas reserve in the Asia-Pacific region, following China and Indonesia. Malaysia's economic landscape is characterized by robust agricultural and manufacturing sectors. Geopolitically, Malaysia occupies a pivotal position at the intersection of the South China Sea and Indian Ocean, making it also strategically significant. The Malacca Strait, a crucial maritime route linking the two regions, traverses along the Malaysian coastline. Moreover, Malaysia faces territorial disputes, particularly with China's claims based on the controversial nine-dash line, which encroaches upon Malaysian territories in the states of....

Introduction Executive Summary In the second part of our ongoing series on Chinese digital influence in Southeast Asia we are taking a closer look at Indonesia. Indonesia has the largest population and economy in Southeast Asia and is the most populous Islamic country in the world. It boasts large deposits of natural resources such as oil, gas, nickel, gold, tin, and copper. It is one of the largest agricultural exporters in the world with nearly 30% of the land in the country used for agriculture and has a fast-expanding fisheries Industry. Under the guidance of President Jokowi Widodo Indonesia seen unprecedented economic growth an ongoing modernization of the countrys infrastructure and an increasingly flourishing tech sector, which has seen companies such as Tokopedia and Gojek arise. Geographically the country is a strategically important crossroad between the South China Sea and Indian Ocean. All major shipping lanes between the 2 regions, mainly through the Malacca Strait, need to pass along the Indonesian coastline. The demographic, economic and geographic factors explain much of the activity of Chinese influence in Indonesia. The country is a key regional player and increasingly taking up a prominent role on the international field, making it a priority for world powers such as China. Key findings: China is using both official and unofficial digital channels to push its narratives in Indonesia. Key narratives are focused on shading a positive light on the treatment of Uighurs in Xinjiang, discrediting Japan around the Fukushima incident and..........

Tonga's information ecosystem is unusually concentrated and physically fragile, making it an attractive target for great-power competition in the Pacific. The Kingdom relies on a single submarine fiber-optic cable for global connectivity — a vulnerability starkly exposed when the 2022 Hunga Tonga eruption severed it for five weeks, forcing the diaspora to become the country's de facto information relay. Today, roughly 58.5% of Tonga's 104,000 residents are online, and of those, social media usage is almost entirely Facebook-driven (66.5% of the population), while X/Twitter has collapsed to under 1,900 users. This Facebook-first, X-absent media sphere means platform monitoring for influence operations must focus overwhelmingly on Meta properties. Compounding this concentration is a diaspora nearly twice the size of Tonga's resident population, spread across New Zealand, the US, and Australia, and connected to home primarily through Facebook groups, Messenger, and diaspora-based outlets like Kaniva Tonga News. Remittances make up ~39% of GDP, and the diaspora has demonstrated real political leverage — from a 2025 voting-rights campaign to a 2024 backlash over a leaked pro-China document that forced domestic political consequences. On the diplomatic-infrastructure front, the report traces how Tonga "hedges between China and the West": significant Belt and Road-linked debt to China's Export-Import Bank continues to constrain reconstruction, while the US, Australia, New Zealand, Germany/EU, and Japan have all stepped up counter-engagement — from deep-sea mineral partnerships to post-ransomware cyber assistance. While no large-scale coordinated influence campaign has been documented, prior incidents (deepfake audio, fake political letters, COVID conspiracy content) show Tonga's susceptibility to information manipulation, underscoring the case for proactive social-media monitoring and media-literacy resilience before a campaign — rather than after. Author: Esau Tupou (Head of the Tonga Computer Emergency Response Team) [Download PDF Here]

[Introduction] Cyber-based hostile influence campaigns are aimed at influencing target audiences by promoting information and/or disinformation over the internet, sometimes combined with cyber-attacks which enhance their effect (hence force Cyfluence, as opposed to cyber-attacks that aim to steal information, extort money, etc.) Such hostile influence campaigns and operations can be considered an epistemological branch of Information Operations (IO) or Information Warfare (IW). Typically, and as customary during the last decade, the information is spread throughout various internet platforms, which are the different elements of the hostile influence campaign, and as such, connectivity and repetitiveness of content between several elements are the main core characteristics of influence campaigns. Hostile influence campaigns, much like Cyber-attacks, have also become a tool for rival nations and corporations to damage reputation or achieve various business, political or ideological goals. Much like in the cyber security arena, PR professionals and government agencies are responding to negative publicity and disinformation shared over the news and social media. We use the term cyber based hostile influence campaigns, as we include in this definition also cyber-attacks aimed at influencing (such as hack and leak during election time), while we exclude of this term other types of more traditional kinds of influence such as diplomatic, economic, military etc. During the 3rd to 9th August 2026, we observed, collected and analyzed endpoints of information related to cyber based hostile influence campaigns (including Cyfluence attacks). The following report is a summary of what we regard as the main events. Some of the mentioned campaigns have to do with social media and news outlets solemnly, while others leverage cyber-attack capabilities. [Contents] [Introduction] [Report Highlights] [Report Summary] [State Actors] Russia Storm-1516 Fabricated Video Ukraine Identifies Russian Propaganda Network Ukraine Russian SVR Distributes Second Summer 2026 Propaganda Wave China China-Linked Network Deploys Bioweapon Narrative Targeting U.S. [AI Related Articles] Five Major AI Chatbots Reproduced Content Of EU-Sanctioned Outlet EU AI Act Transparency Enforcement Begins August 2nd AI-Generated Fake Influencer Accounts More Than Half of AI-Generated Security Patches Are Broken [General Reports] Political Leaders Will Pressure Officials to Change Election Outcomes [Appendix - Frameworks to Counter Disinformation] European Commission Begins Enforcing AI Act Obligation Roadmap for Addressing Effects of Censorship, Surveillance, and New Technology on Civil Society [CRC Glossary] [ Report Highlights] Storm-1516 fabricated a video using forged Deutsche Welle and Handelsblatt branding to falsely claim German Chancellor Friedrich Merz planned to resign, attributed by German security services to Russian military intelligence, while Ukraine's Foreign Ministry documented over 1,500 pro-Russian articles exploiting Spain's Ceuta migration crisis. The Russian SVR distributed a statement claiming Ukraine has no EU prospects across 510 resources in 20 languages in its second summer 2026 propaganda wave. FDD identified a China-linked network of at least 50 coordinated assets across 10 platforms deploying hashtags including #USBiolabs and #DTRASecrets to claim U.S. biological laboratories caused COVID-19, with accounts posting identical content within hours of each other, reviving a longstanding operation to shift pandemic blame to Washington while incorporating sub-narratives targeting U.S.-Taiwan relations. The IRGC issued a statement praising Iranian revolutionary media for countering adversary "hybrid and cyber warfare including AI" while asserting that the US and Israel suffered strategic defeat in recent conflicts with Iran. Research testing five major AI chatbots across 50 propaganda narratives in three languages found 16.6% of responses engaged with content from the Foundation to Battle Injustice, an EU-sanctioned outlet founded by deceased Wagner Group leader Yevgeny Prigozhin, reproducing claims including that Ukraine reused soldier corpses for meat products, with only 52% of responses rejecting the false claims and the vulnerability attributed to generative engine optimisation techniques designed to embed propaganda into AI training data. EU AI Act transparency enforcement commenced 02-08-2026, requiring chatbots to disclose AI status at first contact, deepfakes to carry labels, and AI-generated content to include machine-readable markers; investigations were opened against OpenAI, Anthropic, Google, and X, with the European Commission publishing a list of over 180 organisations signed to the Code of Practice on transparency of AI-generated content and penalties of up to EUR 15 million or 3% of global annual turnover for non-compliance. A Gallup poll of more than 23,000 U.S. voters found 67% concerned that political leaders will pressure election officials to change election outcomes, the highest-ranked of six tested concerns, with at least 40% expressing concern about each tested aspect of election integrity and Trump's net approval rating at -20.6 points, the lowest of his second term. [ Report Summary] German security services attributed to Storm-1516, a Russia-linked operation assessed as probably connected to Russian military intelligence, a fabricated video using forged Deutsche Welle and Handelsblatt branding to claim falsely Chancellor Friedrich Merz planned to resign; both outlets confirmed the fabrication, Merz's office stated the claims were completely invented and designed to confuse and unnerve the public, while France's Viginum agency has documented Storm-1516 conducting at least 77 disinformation operations targeting Western countries between late 2023 and March 2025. Ukraine's Foreign Ministry identified a coordinated Russian propaganda network exploiting Spain's Ceuta migration crisis, with pro-Russian outlets Pravda and RT publishing over 1,500 articles including approximately 300 in Spanish targeting European audiences; Ukrainian Foreign Minister Andriy Sibiga stated Russia has for years weaponised migration and socially sensitive topics to systematically destabilise Europe and called for complete bans on Russian propaganda platforms within European jurisdictions. The Russian Foreign Intelligence Service on 03-08-2026 issued a statement claiming Ukraine has no EU membership prospects and accusing the EU of stoking the war; Ukraine's Center for Strategic Communications documented over 750 distributions across 510 resources in 20 languages targeting audiences in Russia, the USA, Europe, Africa, and Asia, the second such SVR propaganda wave of summer 2026, while the EU's diplomatic arm found 80 of 500 investigated information manipulation incidents between January 2025 and May 2026 were linked to Ukraine's EU accession process. The IRGC issued a statement praising Iranian revolutionary media for countering adversary "hybrid and cyber warfare including AI" while asserting that the US and Israel suffered strategic defeat in recent conflicts with Iran. FDD's Center on Cyber and Technology Innovation identified at least 50 coordinated assets operating across 10 platforms including TikTok, Facebook, YouTube, and X, spreading claims that U.S. biological laboratories developed bioweapons causing COVID-19, deploying hashtags including #USBiolabs, #DTRASecrets, and #AmericanBioHazard; accounts posted identical or near-identical content within hours of each other, reviving a longstanding Chinese effort to shift pandemic blame to Washington while incorporating sub-narratives targeting U.S.-Taiwan relations. Research testing five major language models, xAI's Grok, OpenAI's GPT, Anthropic's Claude, Google Gemini, and Mistral AI, across 50 propaganda narratives in three languages found 16.6% of responses engaged with content from the Foundation to Battle Injustice (r-FBI), an EU-sanctioned outlet founded by deceased Wagner Group leader Yevgeny Prigozhin; specific models reproduced claims about Ukrainian soldiers' corpses being processed for meat and Zelenskyy's cryptocurrency mining, with only 52% of responses rejecting the false claims outright. EU AI Act transparency enforcement commenced on 02-08-2026, requiring chatbots to identify themselves as automated systems, deepfakes to carry labels, and AI-generated content to include machine-readable markers; general-purpose AI model providers must publish training data summaries covering chemical, biological, radiological, and nuclear risks, with penalties of up to EUR 15 million or 3% of global annual turnover, and investigations open against OpenAI, Anthropic, Google, and X. Futurism documented AI-generated fake influencer accounts on Facebook and Instagram deploying sexually suggestive video personas to attract male users who appear unaware the figures are artificial, with individual posts drawing close to 1,000 comments; the accounts systematically exploit a post-COVID loneliness epidemic and one account's file name referenced an AI music generation tool, illustrating that years of public discourse about AI-generated media have not produced meaningful general user skepticism. 1Password researchers testing OpenAI's ChatGPT 5.5 and Anthropic's Claude Opus 4.8 on six high-impact CVEs found a 47% overall success rate for complete vulnerability patching without introducing new problems; models frequently addressed only a subset of vulnerable code paths or added fragile guard code, and Veracode's separate testing of 100 models found 44% introduced a detectable OWASP Top 10 vulnerability into the codebase, while newer frontier models with advanced cybersecurity capabilities are being distributed to key industries before open-source alternatives can compete. Researchers by the UK Ministry of Defense developed an AI system that detects online discourse manipulation by measuring how far actual replies deviate from expected conversational responses, achieving 77% accuracy, roughly twice existing methods. A Gallup poll of more than 23,000 voters conducted April 24 through June 10 found 67% concerned that political leaders will pressure election officials to change election outcomes, the top-ranked of six tested threats, followed by 57% worried about improper ballot handling, 52% about voter intimidation, and 50% that their ballots will not be counted; CFR's James M. Lindsay noted that at least 40% expressed concern about each tested aspect and that Trump's net approval rating reached -20.6 points, the lowest of his second term. The European Commission began enforcing the AI Act's first binding obligations on 2 August 2026, covering rules on prohibited AI practices (effective February 2026) and new requirements for general-purpose AI models including transparency obligations for providers of AI systems classified as presenting systemic risk; enforcement is led by the AI Office within the Commission, with national competent authorities designated across EU member states, and fines reaching up to 35 million euros or 7% of global annual turnover for the most serious violations. An interview published by Jonathon W. Penney (Osgoode Law School/Citizen Lab) argues chilling effects — self-censorship from surveillance or legal threats — stem from psychological conformity, not rational calculation, making First Amendment doctrine inadequate. He cites four amplifiers (observation, uncertainty, personalization, power asymmetry) and evidence like Wikipedia traffic drops post-Snowden. He links this to democratic withdrawal, inequality, and extremist polarization, and calls for structural reforms (antitrust, transparency, surveillance limits) before narrower fixes like anti-SLAPP laws. [State Actors] Russia Storm-1516 Fabricated Video An article published by The Local states that German security services attributed to Storm-1516, a Russia-linked operation assessed as probably connected to Russian military intelligence, a fabricated video using forged Deutsche Welle and Handelsblatt branding to claim falsely Chancellor Friedrich Merz planned to resign; both media outlets confirmed the fabrication, the CDU party dismissed it as nonsense, and Merz's office stated the claims were completely invented and designed to confuse and unnerve the public. The article states that Germany's domestic intelligence agency assessed Storm-1516 to follow political developments in Germany and exploit them opportunistically closely, with France's Viginum agency having documented the group conducting at least 77 disinformation operations targeting Western countries between late 2023 and March 2025, including prior operations during Germany's February 2025 general election that brought Merz to power, consistent with the network's documented pattern of targeting electoral and political transition periods. Source: The Local. Russia-linked group blamed for fake Merz resignation video. [online] Published 8 August 2026. Available at: https://www.thelocal.com/20260808/russia-linked-group-blamed-for-fake-merz-resignation-video Top Of Page Ukraine Identifies Russian Propaganda Network A report published by UA.NEWS states that Ukraine's Foreign Ministry identified a coordinated Russian propaganda network exploiting Spain's Ceuta migration crisis, with pro-Russian outlets Pravda and RT deploying over 1,500 articles including approximately 300 in Spanish targeting European audiences; Ukrainian Foreign Minister Andriy Sibiga characterised the strategy as exploiting topics that evoke strong emotions in society to manufacture social discord, stating the Kremlin has for years weaponised migration and similar socially sensitive topics to systematically destabilise Europe. The report states that the Ukrainian assessment characterised the campaign as a pattern of systemic destabilisation rather than an isolated incident, the network functioning as a coordinated amplification system designed to manufacture the appearance of organic European public concern over migration and called for European nations to escalate counteraction including complete bans on Russian propaganda platforms operating within European jurisdictions. Source: UA.NEWS. Ukraine has exposed a new Russian disinformation campaign in Europe. [online] Published 31 July 2026. Available at: https://ua.news/en/world/ukrayina-vikrila-novu-informatsiinu-kampaniiu-rf-u-evropi Top Of Page Ukraine Russian SVR Distributes Second Summer 2026 Propaganda Wave A report published by UNN.ua states that the Russian Foreign Intelligence Service on 03-08-2026 issued a statement claiming Ukraine has no prospects for EU membership and accusing the EU of stoking the war, with Ukraine's Center for Strategic Communications monitoring over 750 distributions across 510 resources in 20 languages targeting audiences in Russia, the USA, Europe, Africa, and Asia, the second such SVR propaganda wave of summer 2026, following a prior statement distributed on June 19th. The report states that between January 2025 and May 2026, 80 of 500 foreign information manipulation incidents investigated by the EU's diplomatic arm were linked to Ukraine's EU accession, with the EU identifying steady patterns of narrative alignment between Russian state channels and assets that launder, repurpose, and amplify Kremlin talking points, including narratives that the EU is prolonging the war to weaken Russia, that some EU countries want to partition Ukraine, and that European and Ukrainian values are fundamentally incompatible. Source: UNN. Russia has launched a new wave of propaganda against Ukraine’s accession to the EU. [online] Available at: https://unn.ua/en/news/russia-has-launched-a-new-wave-of-propaganda-against-ukraine-s-accession-to-the-eu Top Of Page China China-Linked Network Deploys Bioweapon Narrative Targeting U.S. An analysis published by FDD states that FDD's Center on Cyber and Technology Innovation identified at least 50 coordinated assets across 10 platforms, including TikTok, Tumblr, Facebook, YouTube, Blogspot, X, Quora, and Pixiv, spreading claims that U.S. biological laboratories developed bioweapons responsible for COVID-19, deploying hashtags including #USBiolabs, #DTRASecrets, and #AmericanBioHazard while alleging the U.S. Defense Threat Reduction Agency manages a covert military laboratory network for infectious disease development; accounts repeatedly posted identical or near-identical text, hashtags, cartoons, videos, and images within hours of each other. The analysis states that the network revives a longstanding Chinese effort to shift pandemic blame to Washington, incorporating sub-narratives tailored to divide Washington and Taipei, including a 2023 Chinese state media amplification of a forged document falsely claiming the U.S. directed Taiwan to build a biological-weapons laboratory, while other posts alleged U.S.-supported facilities stored high-risk pathogens and destroyed samples in Ukraine to conceal evidence, illustrating a multi-theatre narrative architecture deploying distinct regional sub-narratives from a single coordinated asset base. Source: Foundation for Defense of Democracies. China-Linked Social Media Network Seeks To Shift COVID Responsibility From China to U.S. [online] Published 7 August 2026. Available at: https://www.fdd.org/analysis/2026/08/07/china-linked-social-media-network-seeks-to-shift-covid-responsibility-from-china-to-u-s/ Top Of Page Iran IRGC Praises Iranian State Media as Counter-Disinformation Frontline An article published by Tasnim News states that the Islamic Revolution Guards Corps stated on August 8th, 2026, praising Iranian revolutionary media outlets for countering what the IRGC characterized as adversary deployment of "hybrid and cyber warfare capabilities, including artificial intelligence" to distort facts and create division between the Iranian public and the Islamic Republic, framing Iranian state media as a frontline instrument in an active information conflict against the United States and Israel. The article states that the IRGC statement claimed the United States and Israel failed to achieve their objectives in recent conflicts with Iran, that international media acknowledged US "failure" and described Trump's actions as a "defeat", and that post-conflict understandings amounted to an "American surrender document", claims presented without independent verification and consistent with IRGC information operations framing; the statement is notable as a primary source document revealing how Iran officially positions its state media apparatus as a counter-disinformation instrument while simultaneously using that apparatus to propagate unverified narratives about adversary strategic failure. Source: Tasnim News Agency. IRGC Lauds Iranian Media for Countering Enemy Disinformation. [online] Published 8 August 2026. Available at: https://www.tasnimnews.ir/en/news/2026/08/08/3665982/irgc-lauds-iranian-media-for-countering-enemy-disinformation Top Of Page [AI Related Articles] Five Major AI Chatbots Reproduced Content Of EU-Sanctioned Outlet An investigation published by Euronews states that researchers testing five major language models, xAI's Grok, OpenAI's GPT, Anthropic's Claude, Google Gemini, and Mistral AI, across 50 propaganda narratives in three languages (English, German, French) found 16.6% of responses engaged with material from the Foundation to Battle Injustice (r-FBI), an EU-sanctioned outlet founded in 2021 by deceased Wagner Group leader Yevgeny Prigozhin that presents itself as a human rights NGO; 30.9% of responses addressed the topics without disclosing the sanctioned source, while only 52% rejected or debunked the false claims. The investigation states that the underlying vulnerability involves generative engine optimization, techniques designed to influence AI training data, paralleling search engine optimization methods, with specific examples including OpenAI's GPT 4.1 Mini citing r-FBI articles supporting claims about Ukrainian soldiers' corpses being processed for meat products, and Mistral Small 3.2 endorsing allegations about President Zelenskyy's cryptocurrency ventures causing Ukraine's energy crisis, identifying AI training data infiltration as an emerging hostile influence vector distinct from direct content injection. Source: Euronews. AI chatbots citing Russian propaganda sourced from EU-sanctioned outlet. [online] Published 27 July 2026. Available at: https://www.euronews.com/my-europe/2026/07/27/ai-chatbots-citing-russian-propaganda-sourced-from-eu-sanctioned-outlet Top Of Page EU AI Act Transparency Enforcement Begins August 2nd An analysis published by Help Net Security states that EU AI Act transparency enforcement commenced on August 2nd, 2026, requiring chatbots to identify themselves as automated systems at first contact, deepfakes to carry labels, and AI-generated or altered content to include machine-readable markers; general-purpose AI model providers must document information for competent authorities, implement copyright policies, and publish training data summaries addressing risks including chemical, biological, radiological and nuclear incidents, loss of control, cyber offences, harmful manipulation, and fundamental rights threats, with penalties of up to EUR 15 million or 3% of worldwide annual turnover for non-compliance. An analysis published by Help Net Security states that enforcement is being pursued against OpenAI, Anthropic, Google, and X among others, with over 180 organisations having signed the Code of Practice on transparency of AI-generated content; subsequent enforcement milestones include a December 2nd, 2026 ban on non-consensual AI-generated sexually explicit content and child sexual abuse material, a December 2nd, 2027 deadline for high-risk AI systems, and a August 2nd, 2028 deadline for high-risk systems built into regulated products, marking a phased escalation from transparency requirements to systemic risk regulation. Source: Help Net Security. EU Begins Enforcing AI Act, Putting AI Models Under the Microscope. [online] Published 4 August 2026. Available at: https://www.helpnetsecurity.com/2026/08/04/eu-ai-act-enforcement-ai-models/ Top Of Page AI-Generated Fake Influencer Accounts A report published by Futurism states that Meta's platforms are filling with AI-generated video of nonexistent young women deployed by fake influencer accounts, including accounts called Grace the Gymnast, Kylie Blaze, and Issy Dexan, that use sexually suggestive language to lure in male users who appear unaware the personas are artificial, with individual posts drawing close to 1,000 comments; the accounts systematically exploit a post-COVID loneliness epidemic, with experts finding that social media use makes users lonelier rather than fostering human connection. A report published by Futurism states that the AI-generated fake influencer schemes represent a convergence of easy-to-use video generation tools with social engineering techniques targeting basic psychological instincts, with the operations growing more sophisticated since 2023, moving from still images to AI video, and the widespread unaware engagement illustrating that years of public discourse about AI-generated media have not produced the population-level skepticism that media literacy initiatives predicted. Source: Futurism. Boomers on Facebook Are Leaving Comments That Make It Clear That They Have No Idea That AI-Generated Thirst Traps Aren’t Real. [online] Published 4 August 2026. Available at: https://futurism.com/artificial-intelligence/boomers-facebook-ai-thirst-traps Top Of Page More Than Half of AI-Generated Security Patches Are Broken An article published by CyberScoop states that 1Password researchers testing OpenAI's ChatGPT 5.5 and Anthropic's Claude Opus 4.8 on six high-impact, high-complexity CVEs found an overall success rate of 47% for complete vulnerability patching without introducing new problems, below a coin flip, with models frequently addressing only a subset of vulnerable code paths, adding fragile guard code that satisfied tests while failing to address the vulnerability's root cause, and sometimes introducing subtle changes in application behaviour while patching the immediate issue. The article states that Veracode's separate testing of 100 models found 44% introduced a detectable OWASP Top 10 vulnerability into the codebase, with most models showing stagnation in security patching despite enormous strides in crafting workable code; a Veracode vice president noted that AI tools remain unreliable for cybersecurity patching without knowledgeable humans in the loop, and that some kind of automated code review will be necessary, preferably not by the same automation tool that produced the code, in a world where AI agents generate exponentially more code than human defenders can review. Source: CyberScoop. More than half of AI-generated patches are broken. [online] Published 7 August 2026. Available at: https://cyberscoop.com/ai-code-patching-security-risks/ Top Of Page Researchers Develop AI Detection System That Identifies Discourse Derailment in Online Comments An article published by The Conversation states that researchers at Cardiff University and the University of Sheffield, funded by the UK Ministry of Defense Science and Technology Laboratory, developed a detection system for AI-assisted discourse derailment in online comment sections, finding that 65% of identified manipulative comments contained non sequiturs, 36% red herrings, and 20% personal attacks, with derailing comments significantly less likely to acknowledge prior messages or demonstrate empathy, based on manual analysis of over 1,600 comments beneath BBC News YouTube videos labeled against 25 discussion features. The article states that the detection system works by measuring divergence between actual replies and a set of AI-generated expected responses, with substantial deviation flagging potential discourse manipulation rather than scanning for suspicious vocabulary; the system achieved approximately 77% accuracy, roughly twice the effectiveness of existing word-level sentiment analysis systems and matching human researcher agreement levels, with the authors noting that as AI lowers the cost and raises the volume of synthetic disinformation, detection methods capable of identifying manipulation through conversational pattern rather than content alone become operationally significant. Source: The Conversation. AI is making disinformation harder to spot, but we’ve found a new way to catch it. [online] Available at: https://theconversation.com/ai-is-making-disinformation-harder-to-spot-but-weve-found-a-new-way-to-catch-it-288671 Top Of Page [General Reports] Political Leaders Will Pressure Officials to Change Election Outcomes An analysis published by CFR states that a Gallup poll of more than 23,000 voters conducted from April 24th, 2026 through June 10th, 2026 found 67% of Americans concerned that political leaders will pressure election officials to change election outcomes, the top-ranked threat, followed by 57% worried about improper ballot handling, 52% worried about voter intimidation near polling places, and 50% worried their ballots will not be counted; at least 40% of the public expressed concern about each of the six tested aspects of elections, with a majority concerned about four of them. According to the analysis, Trump's net approval rating now stands at -20.6 points, the lowest of his second term, while Democrats hold a 6.4-point edge on the generic congressional ballot; Larry Sabato's Crystal Ball projects 20 House seats as toss-ups, 15 currently or formerly Republican-held, up from April 13th as seats shift from leans Republican to toss-up, with CFR's Lindsay noting that democracy cannot succeed if the governed doubt that election results reflect their will. Source: Council on Foreign Relations. Voters Worry About Election Integrity. [online] Published 3 August 2026. Available at: https://www.cfr.org/articles/voters-worry-about-election-integrity Top Of Page [Appendix - Frameworks to Counter Disinformation] European Commission Begins Enforcing AI Act Obligation An announcement published by the European Commission states that the AI Act's first binding obligations began enforcement on August 2nd, 2026, covering rules on prohibited AI practices that took effect in February 2026 and new requirements for general-purpose AI models including transparency obligations for providers of systems classified as presenting systemic risk; enforcement is led by the AI Office within the Commission, with national competent authorities designated across EU member states and fines reaching up to 35 million euros or 7% of global annual turnover for the most serious violations. The announcement states that general-purpose AI model providers must now document their training data, energy consumption, and safety evaluations and submit these to the AI Office; providers of models designated as systemic-risk AI, defined as models trained with more than 10^25 floating-point operations, face additional adversarial testing, incident reporting, and cybersecurity requirements, with the Commission indicating it has already initiated formal evaluation processes against several major providers. Source: European Commission. Commission starts enforcing AI Act rules and new transparency requirements on 2 August. [online] Published 31 July 2026. Available at: https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august Top Of Page Roadmap for Addressing Effects of Censorship, Surveillance, and New Technology on Civil Society An interview published by TechPolicy.Press states that Jonathon W. Penney, York Research Chair in AI, Data Governance and the Law at Osgoode Law School and research fellow at Citizen Lab argues that chilling effects, defined as self-censorship and behavioral restraint triggered by awareness of surveillance, legal threats, or personal targeting, operate through deep psychological conformity mechanisms rather than rational legal calculation, rendering conventional First Amendment doctrine structurally inadequate; Penney identifies four amplifying factors, observation, uncertainty, personalization, and power asymmetry and supports the framework with population-scale empirical data including Wikipedia traffic declines following the 2013 Snowden disclosures and Google search behavior shifts for sensitive terms. The interview states that Penney identifies secondary harms flowing from chilling effects including democratic withdrawal, entrenchment of inequality through disproportionate surveillance of marginalized populations, and polarization within extremist subgroups where conformity mechanisms amplify rather than suppress hostile behavior; his policy framework prioritizes structural reform, antitrust enforcement against tech consolidation, government transparency, and surveillance restriction as preconditions before piecemeal measures such as expanded anti-SLAPP statutes, disclosure requirements, and personalized-targeting restrictions can be effective, framing the underlying problem as one of power: "privacy is about power... chilling effects is also a struggle over power, information, and broader structural power relationships in society". Source: Tech Policy Press. A Roadmap for Confronting the Chilling Effects of Censorship, Surveillance and New Technology. [online] Published 26 July 2026. Available at: https://www.techpolicy.press/a-roadmap-for-confronting-the-chilling-effects-of-censorship-surveillance-and-new-technology/ Top Of Page [CRC Glossary] The nature and sophistication of the modern Information Environment is projected to continue to escalate in complexity. However, across academic publications, legal frameworks, policy debates, and public communications, the same concepts are often described in different ways, making collaboration, cooperation, and effective action more difficult. To ensure clarity and establish a consistent frame of reference, the CRC is maintaining a standard glossary to reduce ambiguity and promote terminological interoperability. Its scope encompasses foundational concepts, as well as emerging terms relating to Hostile Influence and Cyfluence. As a collaborative project maintained with input from the community of experts, the CRC Glossary is intended to reflect professional consensus. We encourage you to engage with this initiative and welcome contributions via the CRC website. Top Of Page

[Introduction] Cyber-based hostile influence campaigns are aimed at influencing target audiences by promoting information and/or disinformation over the internet, sometimes combined with cyber-attacks which enhance their effect (hence force Cyfluence, as opposed to cyber-attacks that aim to steal information, extort money, etc.) Such hostile influence campaigns and operations can be considered an epistemological branch of Information Operations (IO) or Information Warfare (IW). Typically, and as customary during the last decade, the information is spread throughout various internet platforms, which are the different elements of the hostile influence campaign, and as such, connectivity and repetitiveness of content between several elements are the main core characteristics of influence campaigns. Hostile influence campaigns, much like Cyber-attacks, have also become a tool for rival nations and corporations to damage reputation or achieve various business, political or ideological goals. Much like in the cyber security arena, PR professionals and government agencies are responding to negative publicity and disinformation shared over the news and social media. We use the term cyber based hostile influence campaigns, as we include in this definition also cyber-attacks aimed at influencing (such as hack and leak during election time), while we exclude of this term other types of more traditional kinds of influence such as diplomatic, economic, military etc. During the 27th July to 2nd August 2026, we observed, collected and analyzed endpoints of information related to cyber based hostile influence campaigns (including Cyfluence attacks). The following report is a summary of what we regard as the main events. Some of the mentioned campaigns have to do with social media and news outlets solemnly, while others leverage cyber-attack capabilities. [Contents] [Introduction] [Report Highlights] [Report Summary] [State Actors] Russia Storm-1516 Ran 45 Campaigns Against Armenia's Elections and Targeted France's Declared 2027 Candidate Storm-1516 Used Fake BBC Video Russia Published 1,500 Articles Exploiting Spain's Ceuta Crisis Against Ukraine china Spamouflage Deployed 62 Accounts Targeting Chilean Journalists Fake AI Videos During Typhoon Noel Triggered Government Crackdown [Cyfluence Attacks] Laundry Bear Steals Government Emails Without User Interaction [AI Related Articles] EU AI Act Transparency Enforcement Begins [General Reports] Cheap Streaming Sticks Secretly Click Ads on AI-Generated Sites via Residential Proxy Networks Trump Distorted CIA Intelligence to Claim Venezuela Manipulated US Voting China's AI Microdrama Industry Harvests Faces at Scale Influence Operations Bulletin Q2 2026 [Appendix - Frameworks to Counter Disinformation] Weaponized Nostalgia Identified as Below-Radar Cognitive Threat [CRC Glossary] [ Report Highlights] DFRLab mapped Storm-1516's full interference infrastructure against Armenia's May 2026 parliamentary elections, 45 campaigns, 149.5 million views, 450 accounts, two false-front website clusters, GRU Unit 29155, while France's Viginum attributed to the same network the first documented Storm-1516 campaign against a declared presidential candidate: fabricated health claims against Edouard Philippe, declared 2027 contender, one of 205 operations Viginum has attributed to Storm-1516 since August 2023. Storm-1516 deployed a fake BBC video digitally inserting a stolen Lalique pendant on Ukraine's First Lady, Olena Zelenska, to generate 3.27 million views across 13,700 posts. At the same time, Ukraine's Foreign Minister revealed Russia had published more than 1,500 articles exploiting Spain's Ceuta migration crisis to spread anti-Ukraine narratives across European audiences. Graphika's Ore Else report documented Spamouflage deploying 62 inauthentic accounts across four platforms to target six named Chilean journalists covering copper smuggling, marking a documented operational shift from geopolitical influence objectives to economic-sector information control. On August 2nd, 2026, the EU AI Act's transparency requirements entered formal enforcement: chatbots must disclose AI status at first contact, deepfakes must be labelled, and AI-generated content must carry machine-readable marks, with more than 180 organisations signed to the Code of Practice and penalties of up to EUR 15 million or 3% of global turnover. AI-generated fake flood videos during Typhoon Noel circulated widely on Chinese social media, triggering panic-buying across affected regions and prompting an emergency crackdown order from the Cyberspace Administration of China specifically targeting AI-generated disaster disinformation. Google's Q2 2026 Influence Operations Bulletin documented the termination of more than 3,500 YouTube channels and several domains across operations linked to China (1,763 channels), India (1,419 channels across five campaigns), Russia (558+ channels and two domains across five operations), Azerbaijan, Chile, Hungary, Spain, Venezuela, Iran, and more than a dozen campaigns without confirmed state attribution. Cheap TV streaming sticks sold through major retailers secretly enroll in residential proxy networks and spoof mobile device identities to generate fraudulent clicks on AI-generated websites, illustrating the convergence of consumer electronics, ad fraud infrastructure, and AI-generated content farming into a self-sustaining criminal revenue cycle. Cyfluence Research Center documented weaponized nostalgia as a below-radar hostile influence technique, identifying a Russian-linked Facebook network of 75 or more pages embedding communist-era nostalgic affect across 12,790 posts targeting Romania, and PRC-aligned operations deploying five interlocking Ryukyuan nostalgic subthemes against Okinawa across X, YouTube, and Facebook, with content surges correlated with official PRC diplomatic actions, identifying nostalgia as a structural cognitive threat vector invisible to most automated detection systems. [ Report Summary] DFRLab documented Storm-1516's full interference infrastructure against Armenia's May 2026 parliamentary elections, 45 campaigns, 149.5 million views, 450 accounts, GRU Unit 29155, while Meduza reported France's Viginum attribution of fabricated health claims against Edouard Philippe as the first documented Storm-1516 operation targeting a declared presidential candidate. Lead Stories documented Storm-1516's deployment of a fake BBC news video falsely claiming Ukrainian First Lady Olena Zelenska was photographed wearing a stolen Lalique pendant at the Coalition of the Willing summit, with the pendant digitally inserted into genuine summit footage, generating 3.27 million views and 13,700 posts before BBC publicly confirmed on July 27th, 2026 that the video was fabricated. Ukraine's Foreign Minister Andrii Sybiha revealed that Russian state and state-aligned media published more than 1,500 articles exploiting Spain's Ceuta migration crisis to spread anti-Ukraine propaganda, deploying Pravda, RT, and affiliated outlets to link Ukrainian military assistance to EU-level migration pressures and weaken European public support for Ukraine. Graphika's Ore Else report documented Spamouflage deploying 62 inauthentic accounts across Facebook, Parler, Tumblr, and YouTube to suppress Chilean media coverage of copper smuggling investigations, targeting six named Chilean journalists with coordinated harassment and AI-generated counter-narratives, marking a documented operational shift for the network from geopolitical targeting to economic-sector information control. BBC reported that AI-generated videos falsely depicting catastrophic flooding during Typhoon Noel circulated widely on Chinese social media, triggering panic-buying across affected regions before the Cyberspace Administration of China issued an emergency crackdown order on July 23rd, 2026, specifically targeting AI-generated disaster disinformation. The EU AI Act's transparency requirements entered formal enforcement on August 2nd, 2026, requiring chatbots to disclose AI status at first contact, deepfakes to be labelled, and AI-generated content to carry machine-readable marks, with the European Commission AI Office and national authorities in all 27 member states activating enforcement powers and more than 180 organisations including Meta signed to the voluntary Code of Practice, while analysts identified enforcement gaps including strippable watermarks and the difficulty of automated machine-text detection. A joint advisory from cybersecurity agencies warned that Russian-linked threat actor Laundry Bear is exploiting Zimbra vulnerability CVE-2025-66376 to silently exfiltrate government email credentials with no user interaction required, using a lure posing as a Belgian media-integrity verification organisation to ensure delivery to government targets involved in media or information policy. Krebs on Security reported that inexpensive TV streaming sticks sold through major retailers secretly enroll in residential proxy networks and spoof mobile device identities to generate fraudulent clicks on AI-generated websites, creating a self-sustaining criminal revenue cycle in which consumers unknowingly subsidise ad fraud while advertisers fund traffic to synthetic content sites with no genuine readership. FactCheck.org documented that President Trump misrepresented a CIA devil's advocacy analytical exercise as confirmed intelligence, falsely claiming the CIA found evidence that Venezuela had exactly manipulated US voting machines in 2020, when the exercise produced no such evidence, devil's advocacy being a technique designed to stress-test prevailing assessments, not produce validated findings. Rest of World documented China's AI microdrama industry's systematic exploitation of human faces for AI-generated synthetic actors, with more than 95% of 128,000 microdramas produced in Q1 2026 using AI actors, ByteDance removing more than 85,000 unauthorised face reproductions, and Chinese courts logging 700 facial theft cases, illustrating the industrialisation of biometric data exploitation within a commercially legalised licensing framework. Google's Q2 2026 Influence Operations Bulletin documented the termination of more than 3,500 YouTube channels and several domains across operations linked to China (1,763 channels), India (1,419 channels across five campaigns), Russia (558+ channels and two domains across five operations), Azerbaijan, Chile, Hungary, Spain, Venezuela, Iran, and more than a dozen campaigns without confirmed state attribution. Cyfluence Research Center documented two hostile influence campaigns weaponizing nostalgia as a below-radar cognitive driver: a Russian-linked Facebook network embedding communist-era nostalgic affect across 12,790 posts targeting Romania, and PRC-aligned operations deploying five interlocking Ryukyuan nostalgic subthemes against Okinawa across X, YouTube, and Facebook with content surges correlated with official PRC diplomatic actions, identifying nostalgia as a structural cognitive threat vector that is largely invisible to automated detection systems. [State Actors] Russia Storm-1516 Ran 45 Campaigns Against Armenia's Elections and Targeted France's Declared 2027 Candidate An investigation published by DFRLab states that the Atlantic Council's Digital Forensic Research Lab mapped the full digital infrastructure behind Storm-1516's interference campaign targeting Armenia's May 2026 parliamentary elections, identifying 45 distinct narrative campaigns that generated 149.5 million views on X, distributed by a network of more than 450 accounts including six core amplifier accounts responsible for the bulk of reach. The operation produced AI-generated articles and videos through two false-front website clusters formatted as apparent local news outlets, publishing content in Armenian, English, French, and Turkish, attributed to GRU Unit 29155 and following the network's documented template of fabricated infrastructure establishment before an electoral period, followed by coordinated amplification to manufacture the appearance of organic public concern. Another article published by Meduza states that France's Viginum service attributed to Storm-1516 a campaign fabricating false health claims about Edouard Philippe, the former French Prime Minister and declared candidate for France's 2027 presidential election, described by a French security source as the first documented Storm-1516 campaign targeting a declared presidential candidate, one of 205 operations Viginum has attributed to the network since August 2023. Storm-1516 is assessed as active since 2023, linked to Russia's GRU, and its operator base includes former employees of Yevgeny Prigozhin's information operations infrastructure; the Philippe targeting fits a documented pattern of selecting political figures whose election would strengthen Western security architecture and deploying fabricated personal health or integrity claims that force candidates into public denials amplifying the original false claim regardless of the denial's success. Sources: DFRLab. Uncovering the Digital Infrastructure Behind Russian Interference in Armenian Elections. [online] Published 29 July 2026. Available at: https://dfrlab.org/2026/07/29/uncovering-the-digital-infrastructure-behind-russian-interference-in-armenian-elections/ Meduza. Russian disinformation network Storm-1516 accused of targeting French presidential candidate Édouard Philippe with fake health claims. [online] Published 24 July 2026. Available at: https://meduza.io/en/news/2026/07/24/russian-disinformation-network-storm-1516-accused-of-targeting-french-presidential-candidate-edouard-philippe-with-fake-health-claims Top Of Page Storm-1516 Used Fake BBC Video A fact-check published by Lead Stories states that a fake video formatted as an authentic BBC news report falsely claimed Ukrainian First Lady Olena Zelenska was photographed wearing a stolen Lalique pendant at the Coalition of the Willing summit, with the pendant digitally inserted into genuine summit footage. The fabricated content generated 3.27 million views and 13,700 social media posts before the BBC publicly confirmed on July 27th, 2026, that the video was fake and did not originate from any BBC broadcast or publication. Lead Stories attributed the operation to Storm-1516, consistent with the network's documented use of established broadcaster brands to lend false credibility to fabricated content targeting Ukrainian national figures. The publication states that the fake BBC video illustrates a core Storm-1516 operational technique: attaching fabricated narratives to visually authentic-appearing footage from genuine events, with broadcaster logos and graphic design elements reproduced to bypass credibility filters among audiences unfamiliar with the specific broadcast format being impersonated. The Zelenska pendant claim targets the First Lady of a wartime head of state and is consistent with Storm-1516's documented strategy of generating reputational damage narratives around Ukrainian national figures, a tactic effective even when quickly debunked, because the debunking process produces additional broadcast coverage of the original false claim and forces official Ukrainian institutions to expend credibility capital issuing denials. Source: Lead Stories. Fact Check: FAKE BBC Report Claims Olena Zelenska Was Spotted Wearing Stolen Lalique Pendant. [online] Published 27 July 2026. Available at: https://leadstories.com/hoax-alert/2026/07/fact-check-fake-bbc-report-shows-zelenska-wearing-stolen-lalique-pendant.html Top Of Page Russia Published 1,500 Articles Exploiting Spain's Ceuta Crisis Against Ukraine An article published by European Pravda states that Ukrainian Foreign Minister Andrii Sybiha revealed that Russian state and state-aligned media published more than 1,500 articles exploiting Spain's Ceuta migration crisis to advance anti-Ukraine propaganda narratives across European audiences, deploying Pravda, RT, and affiliated outlets to link Ukrainian military assistance to EU-level migration pressures. Sybiha stated that Ukraine had uncovered and exposed the Russian propaganda campaign, which sought to leverage an active European migration crisis to shift European public opinion against continued support for Ukraine by connecting EU policy failures to the costs of the Ukraine conflict. The article states that the Ceuta exploitation campaign illustrates a recurring Russian FIMI strategy of attaching anti-Ukraine messaging to genuine European domestic crises, a technique that requires no fabricated events, only the selective framing of real developments to support predetermined narratives. By deploying more than 1,500 publications across Pravda, RT, and affiliated platforms rather than relying on inauthentic amplification networks, the operation exploited the established reach of Russian state media infrastructure to distribute its messaging, making platform-level content removal less effective than would be the case for synthetically amplified material. The exposure by Sybiha follows a documented pattern of Ukrainian intelligence and diplomatic disclosure of active Russian information operations, designed to pre-emptively denature narratives before they achieve wider penetration in Western European media. Source: European Pravda. Sybiha: Ukraine uncovers Russian propaganda campaign linked to crisis in Spanish city. [online] Published 31 July 2026. Available at: https://www.eurointegration.com.ua/eng/news/2026/07/31/7242718/ Top Of Page China Spamouflage Deployed 62 Accounts Targeting Chilean Journalists A report published by Graphika states that Spamouflage, the China state-aligned network also documented as Dragonbridge and Taizi Flood, deployed 62 inauthentic accounts across Facebook, Parler, Tumblr, and YouTube to suppress Chilean media coverage of copper smuggling investigations, targeting six named Chilean journalists with coordinated harassment and AI-generated content designed to discredit their reporting. The campaign, documented in a Graphika investigation titled Ore Else, combined AI-generated visual and text content with coordinated account volume to reduce the visibility of the targeted journalists' copper smuggling coverage and associate it with pro-industry counter-narratives. The report states that the Ore Else investigation identifies the operation as a documented evolution for Spamouflage: rather than the geopolitical and election-focused targeting previously documented for the network, the infrastructure was here deployed to protect copper supply chain narratives of direct relevance to Chinese commercial interests, suggesting that the Spamouflage model is available not only for political influence objectives but for direct commercial information control in any sector where China holds strategic interests and where investigative journalism poses a reputational or supply chain risk. The use of four distinct platforms, including Parler and Tumblr alongside the more commonly monitored Facebook and YouTube, reflects an adaptive distribution strategy designed to maintain operational reach after platform enforcement actions on any single channel, a structural adaptation that limits the effectiveness of single-platform moderation responses. Source: Graphika. Ore Else: Spamouflage Targets Chile’s Copper Smuggling Coverage. [online] Published 30 July 2026. Available at: https://www.graphika.com/reports/ore-else Top Of Page Fake AI Videos During Typhoon Noel Triggered Government Crackdown An article published by BBC states that AI-generated videos falsely depicting catastrophic flood conditions during Typhoon Noel circulated widely on Chinese social media platforms, triggering panic-buying across regions where viewers could not verify on-the-ground conditions against the fabricated footage. The fabricated disaster content demonstrated the particular vulnerability of AI-generated disinformation during natural disaster events, where time pressure, communication disruption, and public anxiety create conditions in which synthetic emergency content can propagate rapidly before fact-checking or platform moderation systems respond. The article states that the Cyberspace Administration of China issued an emergency enforcement action on July 23rd, 2026, specifically targeting AI-generated content misrepresenting disaster conditions, as the volume and apparent realism of synthetic flood videos became significant enough to require direct state intervention. The Noel flooding episode illustrates a tension within China's AI content regulation framework: AI-generated synthetic media is an official development priority sector, while uncoordinated AI content that disrupts public order represents a direct challenge to state information control. The emergency crackdown focused on content capable of generating public panic, leaving unresolved the broader question of how platform-level accountability for synthetic disaster content should be institutionalised within China's existing AI regulatory architecture. Source: BBC News. Trump says Iran war talks taking place during lull in strikes. [online] Published 24 June 2026. Available at: https://www.bbc.co.uk/news/articles/cx27mjvxgg1o Top Of Page [Cyfluence Attacks] Laundry Bear Steals Government Emails Without User Interaction An article published by Nextgov/FCW states that a joint advisory from cybersecurity agencies warned that Russian-linked threat actor Laundry Bear is exploiting Zimbra email server vulnerability CVE-2025-66376 to silently exfiltrate government email credentials without any user interaction, no link click, no attachment open, no action of any kind required from the target. The zero-click exploit delivers the credential theft payload when the target's Zimbra server receives and processes a specially crafted email, with the initial lure formatted as communications from a Belgian media-integrity verification organisation, designed to ensure delivery to government and public sector recipients involved in media or information policy. The article states that the Laundry Bear operation merges cyber exploitation with influence infrastructure deception: the lure delivering the zero-click exploit is itself a false-flag persona organization, a fake Belgian media-verification body, whose institutional framing is specifically calibrated to be credible to the government email recipients targeted. This combination of a zero-interaction technical exploit with a persona-organisation social engineering lure represents an escalation in operational sophistication, as it eliminates the human-action dependency that has historically been the primary point of failure and detection in spear-phishing campaigns. Government email systems compromised via CVE-2025-66376 expose the full contents of targeted accounts without any audit trail of the initial infection trigger, creating a covert intelligence collection capability with no forensic footprint at the user level. Source: Nextgov/FCW. Russian hackers can steal government emails without victims clicking a link, cyber agencies warn. [online] Published 24 July 2026. Available at: https://www.nextgov.com/cybersecurity/2026/07/russian-hackers-can-steal-government-emails-without-victims-clicking-link-cyber-agencies-warn/414967/ Top Of Page [AI Related Articles] EU AI Act Transparency Enforcement Begins An announcement published by the European Commission states that from August 2nd, 2026, the AI Act's transparency framework requires AI systems to disclose they are not human at first contact with users, deepfakes to be explicitly labelled, and AI-generated or altered content to carry machine-readable marks enabling automated platform and regulatory detection. High-risk AI systems in regulated products are deferred to August 2028 and high-risk applications in recruitment, credit scoring, and law enforcement to December 2027; IBTimes UK confirmed that more than 180 organisations, including Meta across Facebook, Instagram, and Threads, signed the voluntary Code of Practice on transparency of AI-generated content ahead of the mandatory enforcement date, with the Commission's AI Office and national authorities across all 27 EU member states activating documentation compulsion, technical evaluation authority, and penalties calibrated to global annual turnover from August 2nd, 2026. Another article published by The Next Web states that enforcement faces a central operational vulnerability: watermarks can be stripped, metadata can be lost in format conversions, and machine-written text is notoriously difficult to detect automatically, making the transparency framework only as effective as the detection tools that back it, tools that remain commercially inconsistent in 2026. A possible simplification package could defer machine-marking obligations to December 2026 while maintaining chatbot disclosure from August 2026; carve-outs exempt clearly unrealistic or fantastical content, machine-written text reviewed by humans with genuine editorial responsibility, and artistic or satirical content with appropriate disclosure. The EU regime is anticipated to shape worldwide labelling practices as platforms standardize compliance globally; Meta's voluntary pre-enforcement signature on the Code of Practice is a commitment whose gap with actual implementation will constitute the first test of the AI Office's enforcement authority from August 2nd, 2026. Sources: European Commission. Commission starts enforcing AI Act rules and new transparency requirements from 2 August. [online] Published 3 August 2026. Available at: https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august The Next Web. EU AI Act labels become compulsory for synthetic content. [online] Published 31 July 2026. Available at: https://thenextweb.com/news/eu-ai-act-labels-compulsory-synthetic-content Top Of Page [General Reports] Cheap Streaming Sticks Secretly Click Ads on AI-Generated Sites via Residential Proxy Networks An article published by Krebs on Security states that inexpensive TV streaming sticks sold through major online retailers secretly enroll in commercial residential proxy networks without user knowledge or consent, renting out the devices' internet connections and spoofing them as mobile phone identities to generate fraudulent advertisement clicks on AI-generated websites. The scheme creates a criminal revenue model in which consumers unknowingly contribute their home bandwidth and IP reputation to ad fraud operations, while advertisers are billed for traffic to AI-generated content sites that have no genuine human readership. The article states that the scheme is structurally self-sustaining: device manufacturers sell sticks at prices partially subsidised by proxy enrolment revenue, making the fraud model profitable at the device supply level before any advertising click is generated. Advertisers pay programmatic systems for traffic that spoofed mobile device identities are specifically designed to pass through standard detection filters, and AI-generated content sites collecting per-click payments require no ongoing human content creation costs. No single intervention point is sufficient to collapse the scheme; eliminating proxy enrolment requires manufacturer-level accountability that current retail supply chains do not enforce, eliminating fraudulent traffic requires ad network reforms that programmatic buying architectures are not designed to deliver, and the replacement cost for deplatformed AI-generated content sites approaches zero. Source: Krebs on Security. Read This Before You Buy That TV Streaming Stick. [online] Published 30 July 2026. Available at: https://krebsonsecurity.com/2026/07/read-this-before-you-buy-that-tv-streaming-stick/ Top Of Page Trump Distorted CIA Intelligence to Claim Venezuela Manipulated US Voting A fact-check publication by FactCheck.org states that President Trump publicly cited CIA intelligence to claim Venezuela had exactly manipulated US voting machines during the 2020 election, misrepresenting a CIA analytical technique known as devil's advocacy, in which analysts deliberately argue against prevailing assessments to test their robustness, as a confirmed intelligence finding. FactCheck.org's review found that the CIA devil's advocacy exercise produced no evidence of Venezuelan interference with US voting systems, and that the technique's design and purpose are explicitly to generate stress-test arguments rather than validated intelligence conclusions. The misrepresentation of intelligence methodology, presenting a process that explicitly did not produce a finding as the source of that finding, represents a structurally effective disinformation technique because institutional credibility attaches to the citing organization rather than to the specific analytical output being claimed: a CIA process carries inherent authority in public perception regardless of what that specific process concluded. Debunking this category of claim requires communicating both that the specific assertion is false and that the cited analytical method is structurally incapable of producing the type of validated intelligence finding described, a two-step correction that is considerably harder to convey than the original single-step assertion. FactCheck.org assessed Trump's claim as false. Source: FactCheck.org. Trump’s Distorted Venezuela Elections Claim. [online] Published 23 July 2026. Available at: https://www.factcheck.org/2026/07/trumps-distorted-venezuela-elections-claim/ Top Of Page China's AI Microdrama Industry Harvests Faces at Scale An article published by Rest of World states that China's AI-powered microdrama industry has industrialised the use of synthetic actors based on real human faces, with more than 95% of 128,000 microdramas produced in Q1 2026 using AI-generated actors, generating a commercial market in which individuals rent their facial likeness for AI reproduction in exchange for payments. ByteDance removed more than 85,000 unauthorised face reproductions from its platforms during the period reviewed, and Chinese courts have logged 700 facial theft cases from creators whose likenesses were used without consent, establishing the scale of unconsented biometric exploitation within a framework that simultaneously permits licensed use. An article published by Rest of World states that China's face-licensing ecosystem creates a two-tier commercial structure: a legal tier in which individuals consciously sell facial licensing rights for AI reproduction in entertainment, and an illicit tier in which faces are copied, modified, and deployed without consent or payment, with the legal tier normalising the infrastructure the illicit tier exploits. In the context of information integrity, the systematic commercial development of large, licensed datasets of real human faces for AI-generated synthetic actors represents an industrial-scale capability for producing indistinguishable synthetic human likenesses, a foundational capability layer applicable to AI-generated synthetic media in disinformation contexts. The ByteDance enforcement actions and 700 court cases document only cases reaching formal resolution; total unconsented face use in AI microdramas is substantially larger. Source: Rest of World. In China, people are renting out their faces to AI. [online] Published 27 July 2026. Available at: https://restofworld.org/2026/china-ai-microdramas-face-licensing/ Top Of Page Influence Operations Bulletin Q2 2026 Google's Q2 2026 Influence Operations Bulletin covers coordinated influence operations terminated on its platforms between April and June 2026. In China, 1,763 YouTube channels were terminated as part of an ongoing investigation into a coordinated inauthentic network linked to the People's Republic of China. The network was uploading content in Chinese and English focused on China-US foreign affairs. An additional 2 Blogger blogs linked to China were terminated for sharing pro-China content in English and Chinese. In Russia, five separate operations were identified and actioned. The largest involved 505 YouTube channels linked to a named Russian consulting firm sharing content in Russian that was supportive of Russia and critical of Ukraine, NATO, and the West. A second operation involved 28 YouTube channels sharing content in Hungarian supportive of a Hungarian political party. A third operation involved 23 YouTube channels sharing content in Russian supportive of Russia and critical of Moldova. A fourth involved 2 YouTube channels sharing content in Armenian critical of the Armenian government. Additionally, one domain was blocked from eligibility to appear on Google News and Discover for sharing content in Portuguese supportive of Russia and critical of the United States. One further domain linked to the Czech Republic was blocked for sharing content in Czech associated with Russian state media. In India, five separate operations were terminated during the quarter. The largest involved 992 YouTube channels sharing content in Hindi and Marathi supportive of an Indian political party. The remaining four operations involved 236, 108, 49, and 34 channels respectively, operating in English, Hindi, Punjabi, and Tamil, all supportive of Indian political parties. Combined, Indian-linked operations accounted for more than 1,419 channel terminations in a single quarter. In Azerbaijan, 132 YouTube channels were terminated for sharing content in Azerbaijani supportive of Azerbaijan and critical of Armenia and critics of the Azerbaijani government. In Chile, 110 YouTube channels were terminated for sharing content in Spanish critical of one candidate in Colombia's 2026 presidential election and supportive of another. In Hungary, 105 YouTube channels were terminated for sharing content in Hungarian critical of a Hungarian political party. In Spain, 54 YouTube channels were terminated for sharing content in Spanish critical of the Spanish government. In Venezuela, 43 YouTube channels were terminated for sharing content in English and Spanish supportive of Venezuela. In Argentina, 13 YouTube channels were terminated for sharing content in Spanish supportive of a candidate in Colombia's 2026 presidential election. In Iran, 2 YouTube channels were terminated for sharing content in English and French supportive of Iran and critical of Israel and the United States. Among campaigns without confirmed state attribution, Google terminated 49 YouTube channels sharing content in English and Zulu supportive of a South African political party and critical of the South African government; 44 channels in Arabic critical of the Iraqi government; 31 channels in Ukrainian critical of the Ukrainian government; 93 channels in Indonesian and Malay supportive of the Malaysian government; 50 channels in English and Urdu supportive of the Pakistani military and government; 30 channels in Belarusian critical of the Belarusian government; 22 channels in Korean supportive of South Korean political figures; and multiple operations targeting Indonesian, Japanese, Turkish, Italian, Armenian, and Paraguayan audiences across a range of supportive and critical narratives. Additional smaller operations were recorded across further languages and regions. Top Of Page [Appendix - Frameworks to Counter Disinformation] Weaponized Nostalgia Identified as Below-Radar Cognitive Threat A report published by the Cyfluence Research Center states that CRC documented two empirical case studies of hostile influence campaigns weaponizing nostalgia as their primary psychological driver: a Russian-linked network of 75 or more Facebook pages in Romania embedding nostalgic affect across 12,790 posts through implicit references to the communist era, and PRC-aligned campaigns across X, YouTube, and Facebook targeting Okinawa with five interlocking Ryukyuan nostalgic subthemes, with content surges correlated with official PRC diplomatic actions and state media activity, indicating deliberate coordination between state narrative-setting outlets and inauthentic amplification clusters. CRC identified 78 X accounts associated with the Okinawa-targeting network, the majority suspended at the time of publication, alongside a Facebook infrastructure including an Okinawan Independence page and a group promoting cessation of US base construction, both assessed as advancing PRC-aligned geopolitical narratives. The report states that nostalgia functions as a below-radar ambient emotion that does not announce itself as political, unlike high-arousal negative emotions such as anger or outrage, nostalgic content circulates as cultural celebration, religious reflection, or communal memory and remains largely invisible to automated narrative detection systems, making it a structurally effective cognitive threat vector that is slow to produce measurable indicators and difficult to attribute to hostile actors. CRC analysis identifies a dual-strand PRC influence strategy: nostalgia narratives delegitimize the present by measuring it against a romanticized past rendered wrongly lost, while parallel techno-utopian narratives measure it against a Chinese-led future only PRC alignment can deliver, addressing target audiences simultaneously from both temporal directions so that the present is rendered inadequate from both sides without any individual content stream announcing a coordinated agenda. Counter-messaging and prebunking face a structural challenge because directly challenging nostalgic content risks appearing hostile to legitimate cultural expression or identity, requiring influence defense practitioners to engage the emotional register of the content rather than relying solely on factual rebuttal. Source: Cyfluence Research Center. Research Section. [online] Available at: https://www.cyfluence-research.org/research-section Top Of Page [CRC Glossary] The nature and sophistication of the modern Information Environment is projected to continue to escalate in complexity. However, across academic publications, legal frameworks, policy debates, and public communications, the same concepts are often described in different ways, making collaboration, cooperation, and effective action more difficult. To ensure clarity and establish a consistent frame of reference, the CRC is maintaining a standard glossary to reduce ambiguity and promote terminological interoperability. Its scope encompasses foundational concepts, as well as emerging terms relating to Hostile Influence and Cyfluence. As a collaborative project maintained with input from the community of experts, the CRC Glossary is intended to reflect professional consensus. We encourage you to engage with this initiative and welcome contributions via the CRC website. Top Of Page

While influence operations research has traditionally focused on high-arousal emotions like anger and outrage, this report by Alina Bârgăoanu and Maya Sobchuk examines a quieter, more insidious vector: nostalgia. Unlike overt propaganda, weaponized nostalgia operates as an "ambient" emotion, it doesn't announce itself as political, but instead shapes how audiences judge the present through idealized, emotionally warm portrayals of the past, gradually normalizing distrust in current institutions and eroding critical evaluation. Drawing on two original investigations, the report documents this dynamic in action. In Romania, a Russian-linked network of roughly 75 Facebook pages and affiliated clickbait sites active since 2020 and reaching a combined audience in the millions has spent years embedding nostalgia for the communist era across 12,790 analyzed posts. Rather than explicit political messaging, the content leans on themes of family, faith, childhood, tradition, and "true" values, implicitly contrasting a morally coherent past with a fragmented present. Notably, these pages were built years in advance of any electoral target and have survived repeated exposure, including through the contested 2024 election cycle. In Okinawa, Japan, the report documents PRC-aligned campaigns exploiting Ryukyuan historical identity across X/Twitter, YouTube, and Facebook. These efforts range from official Chinese state media (including a dedicated Global Times hashtag, #RyukyuChronicles) to coordinated networks of inauthentic accounts some AI-generated, some sloppily assembled with mismatched VPNs and bios promoting narratives of Ryukyu's "undetermined status," historical grievance against Japan, and opposition to U.S. military presence. Over 44–56% of accounts engaging in these narratives displayed bot-like characteristics. The comparative analysis reveals a shared playbook: nostalgic content is dressed up as cultural celebration, historical education, or community memory, making it resistant to being dismissed as propaganda. The report also identifies a complementary strategy, pairing nostalgic narratives with "techno-utopian" messaging (as seen in Chinese diplomatic content in Malaysia) that frames a China-aligned future as the answer to a present rendered inadequate from both temporal directions. The authors argue that because nostalgia is ambient rather than viral, it evades most automated detection systems, making manual, qualitative analysis essential. The report closes with recommendations for influence defense practitioners: engage the emotional register of these narratives rather than relying on factual rebuttal alone, build cognitive resilience before narratives normalize, and treat slow narrative permeation as seriously as sudden disinformation bursts. Authors: Alina Bârgăoanu & Maya Sobchuk [Download PDF Here]

Background On 30 July 2026, thousands of migrants crossed from Morocco into the Spanish enclaves of Ceuta and Melilla, overwhelming local police and triggering an emergency situation. At the time of writing, at least nine people have reportedly died. In response, the Spanish government announced it will deploy its military.[1] In conjunction with the events on the ground, the information space became a second arena of conflict. Within 24 hours of the first illegal border crossings, CRC researchers identified and analyzed hundreds of posts across X/Twitter and Reddit, spanning eleven languages. The picture that emerged is familiar to anyone who has tracked hostile influence efforts associated with the People’s Republic of China (PRC) and Russia, as well as their usage of strategic communication assets. Although the events were still unfolding on the ground, they were instantly framed and weaponized, with several conspiratorial narratives quickly proliferated across platforms and key target audiences. The malign messaging was amplified by an existing infrastructure of influencers and online personas, seemingly in an attempt to target European and NATO cohesion. Figure 1 - X/Twitter posts by @Inevitablewest and @elonmusk framing the Ceuta border breach as a crisis / invasion. Narrative Analysis CRC analysts mapped five core narrative clusters affecting online discourse around the Ceuta border crossings. They were assessed by core framing, relative volume, principal amplifiers, and platform and language distribution. As shown below, securitized and anti-government narratives dominated the information environment, while conspiratorial, geopolitical, and humanitarian framings gained more limited traction. # Narrative Cluster Velocity Core Framing Circulation N1 Islamic Military Invasion High The crossing as a religiously motivated offensive. A conquest of European or Christian civilization. Focus on reported violence, looting, and home invasions. European/American far right, identitarian accounts and Russian state media. Highly Emotive content and messaging. N2 Sánchez Policy Failure / Open Borders High The crossing is due to the Sánchez government’s amnesty policies and the Spanish Supreme Court ruling on maritime returns. Calls for military deployment, border closure, and emergency measures. Spanish opposition figures, European conservative and populist politicians. Criticism mostly based on policy debate. N3 Israel/US Geopolitical Manipulation Medium The border crossing is a false-flag or coordinated retaliatory operation against Spain, in response for its pro-Palestinian position. The goal is to seize control of the Strait of Gibraltar and/or destabilize the EU. Geopolitical commentators, politically aligned influencers, low-follower accounts. Cross-platform correlation. N4 Morocco Hybrid Warfare / State Pressure Medium Deliberate Moroccan weaponization of migration, potentially linked to Spain’s diplomatic ties with Algeria. Circulates among geopolitical commentators, journalists, and users. Overlaps conspiratorial or extremist framing (N1 or N3). N5 Humanitarian / Decolonization Low Presents migrants as people fleeing poverty, characterizes Ceuta and Melilla as colonial remnants, and depicts the European response as hypocritical or disproportionate. Amplified by pro-Moroccan and left-leaning accounts. “Ceuta is Morocco” framing also observed on Reddit. Figure 2 – Timeline showing key X/Twitter posts, classified into main narratives and including retweet amplitude. Conspiracies Hotbed The most analytically significant narrative observed in our dataset claims that the Ceuta crossing was a covert operation coordinated by Israel and the United States, designed to punish Spain for its pro-Palestine foreign policy and wrest Spanish control of the Strait of Gibraltar, a critical chokepoint for Atlantic-Mediterranean maritime traffic. The main "evidence" cited is a 2019 tweet by Yair Netanyahu, son of the Israeli Prime Minister, in which he referenced potential Israeli funding of NGOs in Ceuta and Melilla as counter leverage against Spain. Although that tweet itself is indeed real, it was taken out of context to serve as “proof” for the alleged hostile foreign led “invasion”. Figure 3 – X/Twitter posts propagating the allegation that the Ceuta border breach was orchestrated by the U.S., Morocco and Israel. This claim, along with the misattribution of recent statements made by President Trump and other US officials, are clear examples of DISARM ‘Technique T0042: Seed Kernel of Truth’, by which malinformation is used to “promote a narrative less common in the target audience, but preferred by the attacker.”[2] The conspiratorial narrative achieved measurable traction. One post framing the crossing as a joint US-Israel operation to seize the Strait of Gibraltar gained millions of views and was retweeted over 4,400 times. Figure 4 - X/Twitter posts framing the Ceuta border breach as a Moroccan operation against Spain. Another, attributing the “operation” to "Spanish intelligence" and claiming a Moroccan false flag, reached 2,943 retweets. Neither claim has any basis in public record or official statement. Figure 5 - Example of X/Twitter post promoting the narrative that the Ceuta border crossing was a "joint operation" designed to punish Spain for its pro-Palestinian position. The Strait of Gibraltar framing does not appear to be incidental. Weakening Western cohesion and control of strategic maritime routes – and particularly Spain's position as part of NATO’s southern flank – is a Russian strategic objective. Figure 6 – X/Twitter post by geopolitical commentator Bruno Maçães, framing the events in Ceuta as an American hybrid attack against Spain. Having said that, the narrative did not need to directly originate in Moscow in order to serve its interests. It was repeated and reframed even by self-proclaimed pro-European politicians and geopolitical commentators. State Aligned Media It’s worth noting the active role of Russian state media outlets in the propagation and amplification of inflammatory messaging and conspiratorial narratives. For example, Russia Today (RT), which is sanctioned and blocked in the European Union, chose to cover highly contentious posts by leading Western figures, emphasizing narratives of Western fragmentation and decline among a mostly non-Western audience. Figure 7 - Samples of coverage and narrative amplification by RT on X/Twitter. The observed selective coverage aligns with the familiar modus operandi of pro-Russian groups and the supportive influence infrastructure. Russian media outlets, doubling as overt influence assets, consistently frame geopolitical developments to fit a specific set of meta-narratives (e.g. Western civilizational decline; Failure of European societies; Progressive liberalism as an existential threat to Europe’s future). To do that, Russian propaganda outfits do not have to generate disinformation. Instead, they exploit actual events. In addition, Russian propaganda is delivered through a wide framing and amplification ecosystem, in which fringe theories are laundered toward legitimacy through pseudo-journalistic sources. Why This Matters This preliminary analysis does not seek to minimize the gravity of the events unfolding in the Spanish enclaves of Ceuta and Melilla. Morocco’s use of border management as political leverage is well documented, while Spain’s Supreme Court ruling and 2026 amnesty program warrant legitimate policy scrutiny. However, these debates are increasingly being distorted by unsubstantiated conspiracy theories. Claims attributing the border crisis to coordinated U.S., Israeli, and Moroccan offensive plans lack credible evidence and risk diverting attention from the actors, policies, and structural pressures directly involved. Such narratives clearly serve the strategic interests of geopolitical rivals, primarily Russia, China, and Iran, by deepening mistrust and contempt toward Western governments and institutions. What began in Ceuta and Melilla on 30 July as a local border crisis has already generated diplomatic, political, and societal repercussions extending far beyond the contested territories. Although the full implications remain unclear, the current crisis must also be assessed through its digital-cognitive dimension, where competing narratives already amplify tensions, reshape public perceptions, and influence geopolitical actions. [References:] CNN. Spain declares emergency in Ceuta after thousands of Moroccans cross into enclave. [online] Published 30 July 2026. Available at: https://edition.cnn.com/2026/07/30/europe/ceuta-emergency-thousands-moroccans-intl (Instagram) DISARM Foundation. T0042: Seed Kernel of Truth. [online] Available at: https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0042.md (disarm.foundation)

ISBN: 978-3-9829099-0-5 | ISSN: 3055-8867 | DOI: doi.org/10.67592/ucb.v1 Synopsis What happens when a city is not only disrupted, but also narrated, contested, and manipulated in real time? Urban Cyfluence Blueprint – Volume 1: Asia introduces a new way of understanding urban vulnerability in the digital age. As cities rely more on digital infrastructure, data systems, and public trust, disruption can quickly move across institutions, platforms, and public perception. Bringing together expert perspectives from across Asia, this volume examines how cyber disruption, information disorder, geopolitical contestation, and shifting trust reshape the way cities are governed and perceived. The Blueprint argues that urban resilience is no longer only about infrastructure, technology, or crisis response. It must also account for how trust is built, damaged, and weaponized. As the inaugural volume of the Urban Cyfluence Blueprint Series, this publication focuses on Asia, with future volumes planned for Oceania and Europe. Chapter 1 Conceptual Foundation: Urban Cyfluence in Asia Chapter 2: Geopolitical Contestation in Asia Chapter 3: Urban Governance, Social Condition and Public Trust Chapter 4: Smart-City Governance and Digital Transformation Chapter 5: Cybersecurity and Digital Infrastructure Vulnerabilities Chapter 6: Information Disorder, Public Narratives, and Urban Trust Chapter 7: Comparative Asian Perspectives and Framework Synthesis This blueprint available to purchase on: Copyright Urban Cyfluence Lab . 2026