When Texas Democratic US Senate nominee James Talarico stepped off the campaign trail with the flu in late September 2026, right-wing media figures and influencers turned his absence into a conspiracy theory centered on claims that he was secretly being treated at an Ohio psychiatric hospital. The claim, built on a deceptive phone call, was debunked within hours, yet it still reached millions of users in these final weeks before the 2026 US midterm elections.

The episode shows how quickly an information vacuum can become a vehicle for election misinformation. Alice’s Emerging Trend Detection Team (ETD) tracked the narrative from its first appearance and saw daily mentions climb from fewer than 3,000 in early October to a peak of about 154,000 on 12 October 2026.

An absence becomes a vacuum

Talarico’s prolonged absence from the campaign trail created the vacuum that the false narratives would later fill. After his campaign said he had been diagnosed with the flu on 29 September, Talarico, who faces Republican Texas Attorney General Ken Paxton in the 3 November 2026 election, stepped back from campaigning and made no in-person appearances for nine days.

Limited public updates left room for speculation, and political attacks quickly turned the silence into a story. Paxton’s campaign demanded “proof of life” and promoted missing-person posters, while President Donald Trump called Talarico “MISSING IN ACTION” and asked, “What is wrong with him?” These attacks framed the absence as suspicious and set the stage for more extreme explanations.

From rumor to conspiracy

The narrative escalated in two stages. Around 8 October 2026, conservative activists and influencers began alleging that Talarico had suffered a mental breakdown. In one prominent example, Republican fundraiser Caroline Wren alleged on former White House adviser Steve Bannon’s “War Room” podcast that Talarico had a “full-blown mental breakdown.” The claims rested on unnamed sources, and Talarico’s reappearance in Austin on 9 October did little to slow the allegations.

The rumors hardened into a specific, seemingly verifiable claim on 11 October, when right-wing influencers Nick Sortor and Rhein Amacher asserted that an Ohio psychiatric hospital had confirmed Talarico was a patient, citing a recording of a call with a facility staffer. A day earlier, Wren had shared flight-tracking screenshots purporting to show a private charter jet, with no known link to Talarico, flying from Austin to an airport near the facility and back.

The evidence behind that claim, however, was manufactured. The full six-minute recording showed the caller posing as Talarico’s cousin with a made-up access code, while the staffer repeatedly said she could not find him. The widely shared 47-second clip omitted those denials. Packaged with a named facility and flight data, the clip nonetheless lent a vague rumor the appearance of an investigated, verifiable claim.

Viral spread by the numbers

Each escalation in the narrative drove a sharp jump in mention volume, peaking on 12 October as the hospital claim and its debunking spread. Sortor’s original post alone has passed 7 million views. Potential reach, a measure of the combined audiences of accounts discussing the claim, more than quadrupled in two days. Volume fell sharply after the peak, likely as debunks spread and the news cycle moved on, and these figures include fact-checks and pushback alongside promotion of the claim.

How the ecosystem amplified the claim

The speed of the spread reflects a right-wing information ecosystem that acts as both an echo chamber and an amplifier. High-profile figures, including Elon Musk and prominent far-right influencers like Benny Johnson and the Libs of TikTok account, pushed the claim to millions of views within hours, many with near-identical framing declaring Talarico “UNFIT TO SERVE.” Right-wing and conspiratorial websites then repackaged it as legitimate news reporting, giving it a more durable, searchable form.

The claim’s originators made little pretense of verification. During a live audio discussion, Amacher stressed that he was not a journalist, telling participants, “We’re not held to that same standard, and I’m surely not.” When criticized, he responded, “Nah, public humiliation is the end goal here.”

The effects of the narrative also spilled beyond purely political content. Our team observed users posting inauthentic reviews of the Lindner Center of Hope that referenced Talarico, pulling an uninvolved healthcare provider into a partisan conspiracy theory.

Debunked but not dismissed

The claim collapsed within hours, but neither its promoters nor their audiences accepted the correction. The Lindner Center of Hope stated that Talarico “has never received treatment” there, and Talarico said he had “never even been to Ohio.” Back on the campaign trail, Talarico dismissed the theories, telling reporters, “I had the flu.”

Platform responses were uneven. Within hours, a community note on Sortor’s post flagged the hospital’s denial, but an account that publicly challenged the recording’s authenticity was briefly suspended before its access was restored.

Promoters and followers alike responded to the debunking by moving the goalposts. The claim’s originators offered technical explanations for gaps in their own evidence and denied remarks they had made on record. The claim’s supporters parsed the hospital’s wording for loopholes, accused it of lying to protect a patient, and insisted the story had not been debunked.

Each correction fed the conspiracy, which helps explain why volume peaked the day after the hospital’s denial. This resistance to fact-checking is typical of the closed information loops our team tracks daily, where a debunk is often understood as confirmation of a cover-up.

Filling the next vacuum

The Talarico case shows how quickly an information vacuum can be filled during a competitive election and how fast the misinformation ecosystem Alice tracks daily can amplify a false claim. Influencers who openly dismissed journalistic standards obtained evidence through a deceptive call in which the caller posed as a relative, selectively clipped it, and pushed it to millions within hours. Corrections did little to stop them.

The same pattern can play out during any election or other sensitive period. An unexplained incident, a delayed announcement, or a gap in official communication can each create an opening, and speculation, purported insider sources, and fabricated or selectively edited “evidence” can follow within days.

Platforms can watch for the warning signs this case exposed, including sudden rumors about an unexplained event; audio or documents presented as proof without verifiable context; open-source data, such as flight-tracking data, repurposed to fit a narrative; and coordinated activity targeting uninvolved third parties. The window for an effective response is short.

If your platform is facing similar risks from election-related misinformation and candidate health conspiracies, Alice’s intelligence experts can help you identify, mitigate, and stay ahead of evolving threats. Learn more about our Intelligence offerings here, or speak with an expert here.

Viral Diagnosis: How the Far Right Turned James Talarico’s Flu Into Midterm Fiction was originally published in Intelligence @ Alice on Medium, where people are continuing the conversation by highlighting and responding to this story.

From analyzing more than 2,800 social media accounts linked to smuggling along the US-Mexico border, Alice found audio repeatedly used to signal cartel control, attract recruits and evade detection.

A video shows migrants walking through the desert near the US-Mexico border. There is no caption, no hashtag and no phone number. The only element attached to the post is a song, and to the right audience that song is the advertisement: a crossing is on offer, and the people running it want you to know who controls the route.

Alice has documented this tactic at scale, reviewing more than 2,800 social media accounts offering or facilitating human smuggling across the US-Mexico border between 2024 and 2026. In many cases, the content these accounts post is paired with a track tied to organized crime, and the choice of track often appears deliberate. Specific artists recur in specific corridors, from Ciudad Juárez to Tamaulipas, alongside the markers of specific cartels. Lyrics promise success rates and “consulates” with no paperwork. When official tracks are removed, the songs return as unlabeled, invisible to any search for the artist or title.

Narcocorridos, a subgenre of the northern Mexican corrido (a traditional narrative ballad) that recounts the activities of drug traffickers and the criminal organizations they serve, are already under scrutiny offline. In 2025, several Mexican states banned them at public events and the US Treasury sanctioned the rapper El Makabelico over alleged financial ties to the Cartel del Noreste (CDN). Far less attention has gone to how the same music works on social media.

This article examines that use, maps the songs and artists Alice observed by corridor and organized crime group, and shows how threat actors keep tracks circulating after removal.

Four Operational Functions of Audio in Human Smuggling Content

Short-form video platforms let any user attach a track to a post, reuse audio from someone else’s video, and browse every post that shares the same sound. Smugglers take advantage of each of these features. Across the accounts Alice reviewed, audio served four recurring functions, often within the same post:

1. Advertising copy. Lyrics describe the service and are paired with footage of crossings, maps and migrant testimonials, often with no caption at all. In one smuggling song, the narrator claims nine out of every ten migrants cross, and another describes a consulate with no paperwork, visas or passports, where the only requirement is cash.
2. Affiliation signal. The choice of track can indicate which group controls a route without the account naming it. An account offering tunnel crossings into El Paso paired Juárez Cartel references with tracks by prolific artists.
3. Discovery and recruitment. Audio pages group every post that uses an audio track, turning a human smuggling song into an index of providers for migrants and a meeting point for smugglers, drivers and migrant brokers. On one post associated with a smuggling-related narcorrido, close to twenty smugglers and guides offered their services in the comments, most from personal accounts — the lyrics often supporting the recruitment pitch.
4. Evasion. Tracks are reuploaded as unlabeled to survive removal. One of the songs most consistently tied to human smuggling content in Alice’s analysis, El Makabelico’s “Flaco Mendoza V2,” is often circulated this way.

Mapping Audio to Corridors and Organized Crime Groups

Alice’s analysis shows a consistent correspondence between specific artists, border corridors and organized crime groups. The map below summarizes these associations:

• Among the corridors, Ciudad Juárez stood out, with accounts displaying Juárez Cartel references appearing far more often than those linked to any other group.
• In Tamaulipas, the pattern is different: a cluster of regional rappers, led by El Makabelico, whose tracks circulate among accounts displaying CDN references and promoting crossings toward San Antonio and Houston.
• Further east, Alice identifies the crossing of both marijuana and people, with content showing migrants, some of them apparently minors, carrying drugs across the border This pattern is consistent with forced criminality, in which human smuggling networks shift legal and physical risk onto the people they move.

How Songs Circulate Without Their Names

When a user posts a video with music playing in the background, or uploads an audio clip directly, most short-form video platforms create a new audio entry and credit it to the uploader rather than the artist. For smugglers ,and the fan pages that circulate cartel-associated music, this is the most effective way to keep a song online. Alice observed several variations:

• Unlabeled re-uploads. Cartel-associated tracks reposted with no title, or credited to an anonymous account name, so a search for the artist or song returns nothing.
• Edits. Remixes, sped-up or slowed versions, single-verse excerpts and a cappella cuts that change the audio enough to complicate matching against the source track.
• Sampling. A viral recording of a smuggler arguing with a US Border Patrol agent, in which he insists he is a coyote rather than a guide, was remixed by regional artists into new tracks with no recorded link to the original clip.
• Audio-only posts. Videos whose description contains nothing but the audio, leaving no text for keyword-based detection to find.

Removing an official track does not remove its derivatives. Each reupload starts a new audio page with its own audience. When Alice re-tested a set of previously identified human smuggling-associated tracks in 2025, most had lost visibility and at least one had been removed entirely, but several held steady, and new tracks, several of them uploaded as unlabeled original audio, had taken their place. One reupload even included a verse in which the performer describes finding his human smuggling contacts through social media.

Looking Ahead: Closing the Audio Blind Spot

Audio is one of the least moderated layers of human smuggling content. A post with no caption passes text-based review, and enforcement built on track titles and artist names misses most reuploads. The cost of that gap falls on migrants.

Smuggling routes along the border are controlled or taxed by organized crime groups that profit from every stage of the journey: as crossings fell in 2025, prices rose to $20,000 or more for a Tijuana crossing that once cost around $8,000, and migrants waiting in border cities face kidnapping, with ransoms of $1,500 to $10,000 reported in Reynosa, Matamoros, Nuevo Laredo and Ciudad Juárez. Alice has also documented “funded trips” that bind migrants to smugglers through debt, and recruitment that pushes migrants, including minors, into carrying drugs across the border. Every post that stays online is a potential entry point into these networks.

The stakes for platforms have also risen. Since February 2025, the US government has designated the Sinaloa Cartel, CJNG, CDN and the Gulf Cartel as Foreign Terrorist Organizations, and in July 2026 it added the Juárez Cartel. Every group mapped in this article now carries that designation, raising the legal and reputational stakes for platforms that host content facilitating their operations.

The music is not going away. Despite state-level bans, at least 13 Mexican municipalities hired narcocorrido artists with public funds for Independence Day celebrations in September 2026, and the killing of CJNG leader El Mencho in February 2026 is likely to produce new songs that memorialize leaders and redraw territorial claims. Each new track and reupload creates a new signal, while older signals lose value as songs are removed or fall out of use.

Closing this gap means treating audio as intelligence: matching reuploads and edits against known source tracks, monitoring the audio pages of high-risk songs, reading lyrics in their regional context, and combining audio with corridor references, coded emojis and invitations to move to private channels. It also means re-testing constantly, because the signals that surface smuggling networks today will not be the ones that surface them next year. Alice maintains this mapping across corridors, artists and aliases, which allows platforms to identify smuggling networks early and protect the people they target.

If your platform is facing similar risks, Alice’s intelligence experts can help you identify, mitigate, and stay ahead of evolving threats. Learn more about our Intelligence offering here, or speak with an expert here.

Human Smuggling Has a Soundtrack: How Cartel-Linked Networks Turn Songs Into Border Crossing Ads was originally published in Intelligence @ Alice on Medium, where people are continuing the conversation by highlighting and responding to this story.

In the weeks before Sweden’s parliamentary election on 13 September 2026, online misinformation shifted from broad claims about immigration and political power to specific allegations about voting eligibility, institutional bias, and electoral manipulation. A smaller, low-impact strand linked to Russian information operations added fabricated reports of foreign hacking and political scandal, while election-day delays of postal ballots and administrative errors were quickly recast as evidence of systemic fraud.

The progression of the misinformation narratives was largely chronological. Great Replacement-style narratives (claims that immigration is being used to deliberately replace a native population) first provided an alleged motive for manipulating the census. Misrepresented voting rules and fabricated media content were then introduced, along with purported mechanisms and accomplices that users cited as evidence for broader allegations of election fraud. When genuine problems emerged on election day, they were absorbed into a narrative that had already established why the result should not be trusted.

Great Replacement narratives enter the election debate
In August, many election-related misinformation claims adapted the Great Replacement conspiracy theory to Sweden’s political system. Beyond alleging that immigration was changing the country, users asserted that the Social Democratic Party had deliberately encouraged immigration to create a loyal electorate and secure permanent political power.

One widely circulated claim cited the Social Democrats’ 62.5 percent vote share in Rinkeby-Tensta, an immigrant-dense Stockholm district, in the 2018 election as proof that the party had “imported” voters to inflate its support. The figure was outdated: by 2022, Social Democrat support in Rinkeby-Tensta had fallen to about 33 percent, part of an 11-point average decline across Sweden’s immigrant-dense districts since 2018. More importantly, a single party’s support can vary from district to district and shift sharply over time without evidence of a plan to engineer the outcome.

This distinction is key. Demographic groups can have strong political preferences, and polling can legitimately measure those differences. The misinformation lies in presenting such patterns as proof of a coordinated plan by “global elites” to replace Swedish voters or to engineer a permanent majority.

Related allegations gave the conspiracy a more immediate political form. Municipal employees were accused of encouraging Muslims at a mosque to support the Social Democrats, while other posts alleged an agreement between the party and the transnational political group, the Muslim Brotherhood. No evidence showed that immigration policy or Muslim political participation was being deliberately engineered or covertly coordinated for electoral advantage. Taken together, these incidents nonetheless created the impression that it was.

Great Replacement-style rhetoric, therefore, became the starting point, linking immigration anxiety to the emerging suggestion that Sweden’s electorate had been deliberately reshaped to favor a specific party.

Suspicion moves closer to the ballot box
By late August, misinformation claims had shifted from focusing on the composition of the electorate to the rules and administration of the election.

In one example, social media users claimed that approximately 600,000 non-Swedish citizens would be permitted to vote in the parliamentary election. The allegation conflated national election rules with those governing municipal and regional elections, in which some noncitizen residents may vote under defined conditions.

Overseas voting was also presented as a possible means of disenfranchisement. Sweden’s Electoral Authority was accused of concealing postal-voting options from Swedes living abroad, supposedly because expatriate voters were more likely to support the right-wing bloc. Other narratives alleged that weaknesses in voter identification enabled multiple voting or that election officials were preparing to favor the Social Democrats.

Similar themes intensified during election week. Left-bloc parties were accused of planning to give foreign nationals voting rights in parliamentary elections, although no corresponding national-level proposal was identified. These claims appeared to extrapolate from discussions about changing residency requirements for foreign nationals voting in municipal and regional elections. In addition, local Muslim communities were portrayed as a coordinated voting bloc that could determine the election for the left-wing bloc, while public institutions were accused of facilitating the process.

These claims circulated before the result was known and offered reasons to reject an unfavorable outcome. If the electorate had already been deliberately reshaped and voting procedures were already compromised, almost any subsequent disruption could be interpreted as confirmation of electoral manipulation.

Fabricated reports add false evidence
A separate and more limited strand of activity introduced fabricated reports of foreign interference and political scandal.

On 18 August, a video imitating Euronews claimed that German hackers connected to Chancellor Friedrich Merz had breached BankID, stolen Swedish voter data, and intended to help incumbent Prime Minister Ulf Kristersson’s coalition win the election.

The story was based on a genuine March 2026 cybersecurity incident involving the leak of BankID source code and credentials. The fabricated video repurposed that breach as evidence of election manipulation. Euronews had published no such report, and BankID is not used to vote in Sweden, where voting is conducted using paper ballots.

A second video, styled as a Spiegel TV news report, alleged that Kristersson and Merz operated companies involved in money laundering, drug proceeds, and a pedophile ring. There is no record that Spiegel TV published any such investigation, while the alleged companies and criminal case did not exist.

The videos appeared to be part of the same coordinated effort, and bore the hallmarks of two Russian information operations commonly tracked as Storm-1516 and Matryoshka, the same networks Alice’s Early Trend Detection team examined in its recent series on Russian election interference, covering Germany’s regional elections and the US midterms.

This content remained low-impact compared to the domestic narratives surrounding immigration and voting procedures. Its significance lay primarily in its method, using counterfeit media branding, targeting recognizable political figures, and borrowing details from real events, which were combined to give invented allegations credibility through the appearance of professional reporting.

Election-day problems become proof of fraud
On 13 September 2026, Scandinavian postal service PostNord was several hours behind schedule in delivering advance ballots to polling stations across some 20 municipalities. The delay stemmed from an unexpectedly high volume of votes after a record 3.6 million advance votes, with the final deliveries arriving by around 5:00 PM.

Although there was no evidence that ballots had been lost, manipulated, or deliberately withheld, the delay quickly acquired another meaning. Social media users speculated that bags of ballots could disappear “along the way” or be intercepted before reaching election officials.

A fabricated screenshot of an Expressen article then claimed that PostNord trucks had crashed in a traffic accident, causing thousands of advance votes to be lost. An AI-generated image appeared to show two crashed PostNord trucks beside an embankment, with one vehicle submerged in a lake and ballot papers floating in the water.

No such incident was reported, and the image appeared to have been generated using artificial intelligence. Nevertheless, the fabricated article gave the emerging fraud narrative the appearance of a documented event. A real delivery delay had been transformed into a false story in which thousands of votes were physically destroyed.

Other election-day claims followed the same pattern. Missing ballots for Örebropartiet, a right-wing and anti-immigration local party, were blamed on “socialist election workers” supposedly attempting to suppress its vote. Some ballots were reportedly unavailable, but voters could still select the party by writing its name on a blank ballot. No evidence suggested that election workers had deliberately removed the ballots.

These examples began with a genuine event or unresolved detail, then added intent and coordination that the evidence did not support. When suspicion had already been established, the distance between an administrative problem and a claim of electoral fraud became easier to cross.

Separate allegations converge after the vote
In the days following the election, individual allegations were assembled into a broader challenge to the result.

A viral claim cited a temporary zero result for the Moderate Party in Fruängen as proof of manipulation. The figure resulted from a registration error in the preliminary count and was corrected without affecting the final outcome. Nevertheless, the initial error continued to circulate as evidence that the system could alter or conceal vote totals.

Claims that noncitizens had voted in the election also reappeared, accompanied by allegations that polling workers had enabled the misconduct. Videos appearing to show unused Moderate Party ballot papers discarded for recycling were portrayed as evidence that cast votes had been dumped to benefit the left-wing bloc. They did not show completed ballots or establish that any valid votes had been discarded.

“Anonymous” testimony gave the allegations further authority. An alleged poll worker was said to have exposed organized ballot manipulation by immigrant families, while other unverified accounts were compiled as evidence of nationwide fraud.

Recognized institutions were then invoked to validate the narrative. Sveriges Television was accused of accidentally displaying the “real” result before votes had been counted, while a 2018 comment by Danish parliamentarian Michael Aastrup Jensen, criticizing Sweden’s lack of ballot privacy after that year’s election, was recirculated as a fresh OSCE assessment of the 2026 vote, despite Jensen never having represented the OSCE.

By 25 September, a Statistics Sweden literacy estimate had also been drawn into the story. Social media users claimed the agency had revealed that “780,000 illiterate people” decided the election. The figure came from a 2023 survey estimating that approximately 780,000 people aged 16 to 65 had insufficient Swedish literacy skills. It did not establish how many were eligible to vote, whether they voted, or which parties they supported, and it was unrelated to the election.

Why this matters
Sweden’s election misinformation developed through a recognizable sequence. Great Replacement-style narratives supplied an alleged motive, while public institutions and election officials were cast as supposed enablers. Voting rules, postal delays, ballot availability, and counting errors then became potential mechanisms of manipulation. Fabricated reports apparently associated with Russian information operations added false evidence, although they remained a limited part of the wider narrative environment.

The allegations did not need to agree with one another. Some blamed election workers, others immigrant families, or foreign hackers. Their force came from convergence, with each offering a different route to the same predetermined conclusion.

For Trust and Safety teams, this demonstrates why election-fraud narratives must be monitored before voting begins. Early indicators can include immigration framed as a strategy to manufacture an electoral majority, religious or ethnic communities portrayed as illegitimate voting blocs, confusion between national and local voting rules, and public institutions accused of preparing to manipulate the result. Real cybersecurity incidents, administrative delays, and preliminary counting errors may then be repurposed as purported proof.

Fact-checking individual claims remains necessary, but it may not dismantle the wider narrative. A registration error can be explained, a fabricated report exposed, and a statistic restored to context. The larger story can survive if audiences already believe that the institutions providing those corrections are part of the problem.

In Sweden, immigration anxiety supplied the alleged motive, institutional distrust identified the supposed enablers, and fabricated reporting and election-day incidents provided purported evidence. The framework for rejecting an unfavorable result was in place before voting began, and the result itself, a narrow 176-to-173-seat swing to the opposition that ended the Sweden Democrats’ role in government, was exactly the kind of outcome that framework existed to challenge.

Alice’s Early Trend Detection team tracks misinformation and disinformation globally every day, including around elections. If your platform is facing similar risks, Alice’s intelligence experts can help you identify, mitigate, and stay ahead of these threats. Learn more about our Intelligence offering here, or speak with an expert here.

Sweden’s 2026 Election Misinformation Narratives: From Immigration Anxiety to Election Fraud was originally published in Intelligence @ Alice on Medium, where people are continuing the conversation by highlighting and responding to this story.

Scandal on Air: How Fake Showdowns With Central Bank Governors Are Selling AI Investment Scams Across Europe

Fake TV scandals, real central bank governors. Scammers in six European countries are cloning trusted news outlets and utilizing conspiratorial language to sell AI investment scams that the banks supposedly don’t want you to know about. These scams don’t just impersonate the news; they sell to audiences that disinformation has already primed to distrust institutions. AI-generated images, cloned newsrooms, and cloaked links help them survive a quick check and avoid platform review.

Introduction

The headline looks like BBC News. Reform UK party leader Nigel Farage has confronted the Governor of the Bank of England live on Question Time, accusing him of “lying to millions of Britons.” The Governor tears off his microphone and walks out. Farage has just revealed, the page claims, what the Bank does not want the public to know: that AI-powered trading platforms are the way out of financial struggle.

None of it happened. The page is a clone, the broadcast never aired, and the “platform” is a front for an investment scam. And it is one of a set. Alice’s Early Trend Detection team identified near-identical scams in the UK, France, Ireland, Italy, Slovakia, and Spain, each staging a fake confrontation or interview with the central bank governor of that country.

Central banks have noticed. In June 2026, the Bank of England warned the public after an AI-generated video showed Farage attacking Governor Andrew Bailey on a Question Time-style set, with Bailey saying fake adverts impersonating central banks “are on the rise.” Italy’s Banca d’Italia also issued repeated warnings about deepfakes of Governor Fabio Panetta, and the National Bank of Slovakia has warned about fake articles misusing its governor’s name.

The warnings tend to stop at the disguise. What they miss is the persuasion. These scams do not just copy the look of trusted news; they copy the logic of disinformation. Elites are hiding the truth. Broadcasts pulled by the authorities. Ordinary people are robbed by the system. Fraud and conspiracy content are converging, and the audiences primed by one are being monetized by the other.

What we found: One story, six countries

Across these scams, the same story is told with a different cast each time.

In five of the six cases, a trusted or popular public figure confronts the central bank governor on a real, recognizable program. The governor loses his temper and walks out. In the chaos, the public figure reveals an AI trading platform that anyone can join for a few hundred euros or pounds.

The Slovak case breaks the pattern in two ways. Instead of a walkout, the NBS Governor appears to endorse the platform in a fabricated interview, and the format is different, too. It ran as a paid display ad dressed up as an official pension notice, “Important announcement regarding the increase in pensions,” which narrows the target to older users.

Every version of these scams ends the same way, with a form asking for a name and phone number. Anyone who fills it in is funneled to an investment-scam call center. The same structure has circulated across Europe for years. Global cybersecurity company ESET tracked one such network of deepfake investment scams under the name Nomani and recorded a 62% rise in these scams in 2025, with Slovakia among the countries most frequently targeted.

The recent cases targeting audiences in other countries show the template being localized on a case-by-case basis, down to the individual talk show, the country’s own governor, and appealing to the right grievance in the local language.

The problem is growing quickly. The privacy firm Surfshark estimates that deepfake scams cost victims worldwide at least USD 1.1 billion in the first nine months of 2025, roughly triple the 2024 figure, with celebrity investment scams accounting for 80% of losses.

Speaking the language of conspiracy

Classic investment fraud sells greed, the promise of getting rich fast. These scams sell grievance instead. The pitch is not only that you could be rich. It is that someone powerful has been stopping you from doing so.

• The system is robbing you. The fake Italian article is titled “You’re robbing Italian families!” In the UK version, the fabricated Bank of England Governor calls the banking system “a scheme that enriches itself at the expense of ordinary people’s savings.” In France, a fake Le Figaro article has retail magnate Michel-Édouard Leclerc accusing the then-Governor of the Bank of France of keeping French people poor. It is the same anti-elite framing found across political misinformation, repurposed as a sales pitch.

• The missing evidence is the evidence. One fake BBC article claims the broadcast was “scrubbed from every platform by midnight, replaced everywhere with the message: ‘Content removed by court order.’” The line could come straight from a conspiracy channel. It pre-empts the obvious check, “why can’t I find this clip?”, and turns the failure to find it into evidence of a cover-up. The Governors’ walkouts do the same work. As one fake commenter puts it, “If the Governor runs away from the truth, that truth is scary.” Some versions add persecution to the story. In the UK, Jeremy Vine is “led away in handcuffs” after the broadcast; in Spain, economist Gonzalo Bernardos is said to have been arrested after discussing the platform on air. The person who reveals the secret is punished, a familiar conspiracy trope.
• Real political figures, real grievances. The scams attach themselves to people and issues already charged with emotion: the leader of Reform UK, pensions in Slovakia, and the cost of living in Italy. When an Italian conspiracy account reshared the fake on their social media account, it moved straight into an audience already primed to distrust institutions.

• Fake episodes citing fake episodes. The Italian scam builds on a feud readers may already know. Italian writer and journalist Roberto Saviano and businessman Flavio Briatore have fallen out publicly, but only online, never on TV. One scam page had already turned it into a fake broadcast, with Briatore storming out of a Rai 1 studio after a row over taxes. The new post plays as the sequel. Its teaser: “After the Saviano-Briatore clash, another, even more heated one between Giordano and Panetta… Topic?” An AI-generated image shows TV presenter Mario Giordano and Bank of Italy Governor Fabio Panetta on the set of Porta a Porta, with a linked article describing Giordano accusing Panetta of letting banks profit while Italian families struggle, until Panetta walks out.

This is not only a European pattern. During Canada’s 2025 federal election, fake CBC articles built around election news ads pushed readers towards crypto investment schemes, some of which used deepfakes of journalists and political leaders. On March 7, the Central Bank of Sri Lanka issued a public warning about “fraudulent AI-generated videos” featuring the bank’s governor, Nandalal Weerasinghe, circulating on social media in which he endorsed investment schemes promising “extraordinary financial returns.” Wherever political attention and institutional distrust run high, fraudsters follow.

The AI layer

AI runs through these scams at three levels.

• AI as the product. Every platform is sold as “AI-driven” or “automated” trading, operating twenty-four hours a day across global markets. The term does the persuading. It signals sophistication and explains away implausible returns. As one fake commenter advises, “you need to be patient and let the AI do its job.”
• AI as the forgery. The Italian lure uses an AI-generated image of journalist Mario Giordano and Governor Panetta as guests on Porta a Porta, an appearance that never happened. In the UK, the Bank of England’s June warning concerned a fully AI-generated video of a staged brawl, similar to the French case. ESET has found that deepfakes in this scam ecosystem now show higher resolution, fewer unnatural movements, and better audio sync, making them harder to dismiss at a glance.

• Manufactured social proof. Beneath every article sits a wall of testimonials. “I work at one of the Big Four banks… we’re explicitly told NEVER to mention them,” “I’ve deposited EUR 2,000 in total and have already withdrawn EUR 10,000.” In the UK, an online reviewer reassures would-be investors that the platform is legitimate. The comments mimic the insider-testimony style of conspiracy content: anonymous people claiming privileged knowledge of what the authorities are hiding.

Borrowed credibility

The scams take trust from real institutions at every step of the funnel.

• Cloned newsrooms. Pages reproduce the layout of BBC News, RaiNews, and Aktuality, El Mundo, and Le Figaro, or recognizable TV shows, but none of the URLs belong to those outlets.
• Mainstream ad inventory. The Slovak scam reached users through paid, geo-targeted display ads on ordinary websites, placing fraud beside legitimate content.
• A regulator’s number, borrowed. The fake Farage article claims the platform is “FCA-compliant.” That registration number is real, but it belongs to a different entity, one already on the FCA’s Warning List. A reader who checks the number finds a match; only a closer look reveals the mismatch. In France, the platform promoted in the fake Le Figaro article had already been on the financial regulator AMF’s blacklist since July 2025.
• An invented government program. The Italian version claims the platform hosts a “National Financial Support Program” launched by the Ministry of Economy and Finance in March 2026. In reality, the platform has neither authorization nor backing from the Ministry.

The final layer is concealment. When Alice’s analysts followed one of the Irish ads, the link led not to a trading platform but to an ordinary Amazon Ireland shopping page. This is known as cloaking: the link checks who is clicking, based on factors such as location, device, or where the click came from, and shows the real scam only to its intended targets. Everyone else, including moderators, researchers, and ad reviewers see something harmless. ESET has found that these campaigns “redirect non-target users to benign cloaking pages” and often run for only a few hours, while the Slovak scam’s domain changed with every click. The scam shows itself only to the people it wants.

Each layer is designed to withstand a quick check, which is exactly the kind of check most readers make.

Why this matters

These scams are cheap to run, quick to localize, and short-lived by design. Alice’s analysts estimated their reach was between 1K and 100K users within hours of publication. That speed matters because the value is not in any single page but in recognizing the template.

Once the structure is clear, the next iteration becomes predictable. A new country, a new governor, a new talk show, a new grievance. The same scam is already circulating in Italy under different guises, including Mario Draghi and a cloned La Repubblica. Days before the Italian case, the Irish Examiner reported on scam ads on social media platforms that used AI-generated images of Allied Irish Banks (AIB) Chief Executive Colin Hunt alongside broadcasters Claire Byrne and Patrick Kielty to promote a fake crypto trading platform. Two months earlier, Spanish fact-checkers had debunked the same walkout story starring Bank of Spain Governor José Luis Escrivá.

Platforms that track only individual URLs or ad accounts will always be a step behind. Those who understand the narrative and can read the template will spot the next one before it spreads.

For Trust and Safety teams, the signals to watch are:

• News-styled ads and posts that link to domains unrelated to the outlet they imitate
• Stories of central bankers or officials “walking out” of live broadcasts
• Claims that coverage was removed “by court order” or suppressed by the authorities
• “AI trading” pitches with low entry amounts (around EUR 250) and lead-capture forms
• Scam content is being picked up and reshared by conspiracy communities

The convergence runs both ways. Disinformation erodes trust in institutions, and fraud turns that loss into profit. Handle one without the other, and the door stays open.

If your platform is facing impersonation scams, fraudulent ads, or conspiracy-driven fraud like the campaigns described here, Alice’s intelligence experts can help you identify, mitigate, and stay ahead of evolving threats. Learn more about our Intelligence offering here, or speak with an expert here.

Scandal on Air: How Fake Showdowns With Central Bank Governors Are Selling AI Investment Scams… was originally published in Intelligence @ Alice on Medium, where people are continuing the conversation by highlighting and responding to this story.

Russia’s Election-Interference Ecosystem. Part 2 - Borrowed Faces, Borrowed Logos: Russia Targets the US Midterms

Shortly after targeting Germany’s mainstream parties, the Russia-aligned Matryoshka network (also tracked as Operation Overload and Storm-1679) launched a new campaign aimed at the November 2026 US midterms. The operation, which began in early September 2026, includes videos that appear to show celebrities attacking the Democratic Party, alongside others that fabricate scandals involving Democratic politicians.

Lessons from Germany and the 2024 US election suggest the videos are likely just the start of a broader disinformation campaign. This is the second piece in our series examining how Russia-aligned influence operations are adapting their playbooks for elections in 2026, and it builds on our analysis of US midterm election misinformation.

Same Actor, Same Playbook

Matryoshka, one part of a wider Russia-aligned influence ecosystem, follows a documented playbook. Typically, a small set of seeder accounts posts fabricated content, and a second wave of quoter accounts amplifies it to manufacture the appearance of organic spread. The same posts often mass-tag dozens of real newsrooms and journalists, hoping to provoke reactions that inadvertently boost the fake’s reach.

The current wave follows that model, using fake videos that impersonate media outlets and falsely cite credible sources to give their claims authority. Borrowing the credibility of mainstream media is a common tactic of Russia-aligned disinformation aimed at the Kremlin’s perceived adversaries in the West, as documented in Part 1 of this series on Germany’s Saxony-Anhalt election.

The videos and hashtags in the latest wave attack the Democratic Party as a whole and share several features:

• Many appear to combine voice cloning with real footage and images to impersonate prominent actors, falsely portraying them as criticizing the Democratic Party over various issues. Several posts carried the hashtag #AllDemocratsAreCriminals, framing the content as part of a larger movement to reject the party.
• The first wave targeted celebrities like Julia Roberts and Sarah Jessica Parker, while a later batch appeared to show Ben Affleck, Jamie Lee Curtis, and Pedro Pascal. The clips attack the Democratic Party broadly, with the actors purportedly arguing, for instance, that the party is “evil” and “wants to destroy us all.” Others included specific critiques around flashpoint issues, including transgender youth, gender identity, the Black Lives Matter movement, religion, and tellingly, support for Ukraine.
• Some posts falsely claimed the actors had sued the Democratic Party over the unauthorized use of their likenesses in a campaign to mislead voters.
• The short clips carry branding from CNN, the BBC, POLITICO, MS NOW, The Atlantic, and The New York Times, mimicking the outlets’ on-screen graphics closely enough to mislead viewers casually scrolling through their feeds.

Campaign Targets Democrats in Competitive Races

Several videos have also targeted specific Democratic candidates in key Senate races with invented corruption and scandal claims. One fake CNN segment falsely claims that Maine Senate candidate Troy Jackson raped a woman who took her own life after he announced his candidacy.

Another ties Michigan Senate candidate Abdul El-Sayed to a fabricated antisemitism scandal and accuses North Carolina Senate candidate Roy Cooper of “calling for letting another 12 to 15 million immigrants into” the country. The influence campaign has also targeted Georgia Senator Jon Ossoff and Texas Senate candidate James Talarico, extending from broad partisan messaging to race-specific targeting.

That combination of broad national messaging and content focused on contested states echoes the two-tier approach used by the wider Russia-aligned ecosystem in 2024. In that cycle, these actors disseminated content targeting the Democratic presidential candidate, then-Vice President Kamala Harris, alongside state-specific voter fraud claims in key battleground states such as Pennsylvania and Georgia.

Notably, the networks have also worked to inoculate their content against debunking by faking retractions and fabricating reports that portray Democrats as spreading fake news or covering up scandals. Prominent examples include:

• When MS NOW debunked the celebrity videos, accounts linked to the campaign circulated a second wave of fabricated video reports falsely claiming that Brandy Zadrozny, a disinformation reporter for MS NOW, had retracted her coverage.
• One post accused Democrats of resorting “to their old scare tactic — the threat of Russian interference in the November midterm elections.” It was shared alongside doctored Washington Post and USA Today headlines that appeared to confirm that Democrats are spreading fake news about Russian interference in the midterms.
• One video in the recent cluster falsely attributed to VIGINUM, France’s counter-disinformation agency, claimed that the Democratic Party is spending billions of dollars to erase compromising information about its 2026 Senate candidates from the internet.

Familiar Faces Give a Limited Campaign Room to Grow

Voice cloning and repurposed footage make these videos appear more credible at first glance than text-based disinformation. A viewer scrolling past a familiar face and a familiar news logo has less reason to pause and verify, and that familiarity can also help drive engagement. Some platforms have removed portions of the campaign, but the volume and speed of the networks’ output mean takedowns lag well behind distribution.

The campaign’s reach remains limited, and the networks may not match their 2024 investment this cycle, given the absence of a presidential contest and their focus on the Russia-Ukraine conflict. However, their content drew millions of views during the 2024 presidential cycle and could do so again if they commit more resources.

The limited reach of the initial videos may also reflect a deliberate but temporary strategy. The networks are probably holding back amplification resources while they evaluate which narratives and formats gain the most traction. Election-season influence operations rarely peak on day one, as our previous analysis shows. The latest activity, built on celebrity impersonation and spoofed news branding, likely marks the early stage of broader targeting ahead of the November 2026 vote.

Germany and 2024 Offer a Road Map for the Midterms

Russia-aligned networks’ operations in Germany and the 2024 US election likely offer insight into their plans for the US midterms. In Germany, disinformation, including false claims of corruption and scandals, targeted political parties and candidates, except the far-right Alternative for Germany (AfD), mirroring the attacks on Democratic candidates in the US in 2026.

Similarly, a video purportedly showing a postal worker destroying mail-in ballots cast for the AfD in Saxony-Anhalt’s September 2026 election followed a template that Storm-1516, a Russia-aligned operation, used before Germany’s 2025 federal election. The format traces back to a 2024 US video of destroyed mail-in ballots that intelligence agencies attributed to Russian actors.

This suggests these networks treat proven templates as reusable assets across elections rather than one-off, country-specific fabrications. Recent videos targeting elections in Germany have included fabricated claims of dead people voting, manipulated postal votes, and immigrants being “hastily granted German citizenship” so they could vote. These are all examples of narratives that could be easily adapted to target the US.

Russia-aligned actors are likely to continue prioritizing narratives that amplify existing social divisions in the countries they target. In Germany, fake content exploited East-West tensions and immigration. In 2024, the fake Georgia video of a purported Haitian immigrant voting twice built on existing stories about immigrants and voting. The 2026 celebrity videos follow suit, pairing attacks on Democrats with wedge issues such as transgender youth, race, religion, and support for Ukraine.

The 2024 US cycle offers a possible road map for what comes next. Candidate-denigration videos appeared in September 2024, weeks before the election. Voter fraud videos followed in the final two weeks, timed to land close enough to Election Day that fact-checkers would struggle to respond before ballots were cast. Finally, fake FBI warnings of rigged machines and terror threats were deployed in the final days to seed doubt about the outcome and depress turnout.

The 2026 influence campaign is currently in the first phase of that sequence. Voter fraud narratives are likely to follow as competitive races come into sharper focus, probably aimed at the battleground states that will decide control of Congress. As Election Day (3 November 2026) approaches, these actors could also impersonate election officials and law enforcement, timing their efforts for maximum disruption and minimal opportunity to correct them.

The Pattern Behind the Videos

Russia-aligned networks have targeted elections in multiple countries over the last decade. The overlaps between the German and US campaigns, from reused video templates to a familiar escalation sequence, point to a playbook that is refined and redeployed rather than reinvented.

Alice’s Early Trend Detection team tracks misinformation and disinformation globally every day, including around elections. This sustained monitoring provides insight into the intent and capabilities of threat actors as their tactics and targets evolve, allowing platforms to act while campaigns are still in their early stages.

If your platform is facing similar risks around election-period impersonation or coordinated disinformation, Alice’s intelligence experts can help you identify, mitigate, and stay ahead of these threats. Learn more about our Intelligence offering here, or speak with an expert here.

Russia’s Election-Interference Ecosystem. was originally published in Intelligence @ Alice on Medium, where people are continuing the conversation by highlighting and responding to this story.

Saxony-Anhalt’s election drew two separate Russia-aligned networks working the same race toward different ends. One fabricated evidence to back a recycled postal-ballot fraud story already circulating locally. The other ran character-assassination campaigns against Germany’s mainstream parties. This is the first of two pieces on how Russia-aligned influence operations are adapting their playbooks for 2026’s Western elections. Part 2 will look at the US midterms, where one of the same networks is running a similar operation targeting American voters using deepfake videos.

A landmark vote, and a familiar story

On 6 September 2026, voters in Saxony-Anhalt went to the polls in what was widely billed as a bellwether for the far-right’s momentum in eastern Germany and across Europe. It wasn’t just a landmark for the far-right Alternative für Deutschland (AfD), which came close to an outright majority. It was also a landmark for something less visible. Months before a single vote was cast, a narrative infrastructure was already being built to contest the election’s outcome.

In the months before the vote, a handful of false claims made the rounds. The government was supposedly preparing to invoke special federal powers to override an AfD win, riot police were said to be stockpiling equipment for unrest that hadn’t happened yet, and one claim held that the election itself might be scrapped over an unrelated security incident. None of it was dependent on the actual result and that was the intention. The grievance was already built and waiting, so whichever way the vote went, there’d be something ready to point to.

Within hours of polls closing on 6 September, social media was awash with claims that postal ballots had been manipulated to deny the AfD victory. Some of that noise was homegrown. Some of it, according to fact-checkers at Correctiv, traced directly back to a known Russia-aligned influence network. And some of it was being read and replicated uncritically by media outlets thousands of kilometers away.

None of this is new in itself. At Alice, the Early Trend Detection (ETD) Team has been tracking election-fraud mis- and disinformation for years tracking tens of thousands of narratives. What’s different about Saxony-Anhalt is the clarity with which the network operations could be seen working and being accepted into the mainstream in real time. Within days, a genuine statistic alongside fabricated evidence got picked up by partisan outlets abroad, turning it into an internationally cited statistic, stripped of the context that would’ve undercut the false claim.

This blog is the first of two case studies we’re publishing this month on how Russian-aligned influence operations are industrializing election interference. This is not a single monolithic “troll factory,” but a set of specialized operations, each with its own tradecraft, working Western elections in parallel. Germany’s Saxony-Anhalt vote is where we start. The US midterms, covered in Part 2, are where a related but distinct operation is already underway.

A template gaining momentum

The core claim circulating around Saxony-Anhalt’s election was straightforward. Postal votes broke against the AfD by a wide margin, and that gap is proof of manipulation rather than a demographic pattern. It’s a compelling story because part of it is true. Postal and in-person electorates often do vote differently, and this dynamic is not new.

Alice’s ETD team’s tracking of functionally the same claim shows it becoming markedly more frequent and prominent from the Saxony and Thuringia state votes in September 2024 onward: recurring in Brandenburg weeks later, around a Bundestag constituency in February 2025, a Brandenburg mayoral race that October, and a district election in March 2026.

Each time, the pattern was the same: a vote-split graph or a turnout anomaly circulated as “proof,” a fringe outlet or commentator gave it a headline, and it fed straight into the pre-existing “the system is rigged against us” narrative already built around the AfD. Saxony-Anhalt wasn’t a new story, but it was one with increased production value.

Two networks, two different jobs

What was new in 2026 was the sophistication and the fact that two Russia-aligned operations were at work simultaneously, pursuing two different angles.

The first produced fabricated “evidence.” In one example, a video purporting to show postal ballots cast for the AfD being invalidated circulated widely on mainstream social media platforms in the days before the election. Correctiv’s technical debunk found duplicate ballot numbers, incorrect envelope seals, and formatting that didn’t match official samples. The video was the latest release from Storm-1516, a pro-Russian disinformation operation active since 2023.

This was not the outfit’s first attempt at this exact format. A near-identical fake video was debunked ahead of Germany’s 2025 federal election, and the underlying template goes back to a fabricated video of destroyed mail-in ballots that US intelligence agencies attributed to Russian actors during the 2024 US election. The same network also spent August spreading a fake resignation video of Chancellor Friedrich Merz using false Deutsche Welle branding, part of what one industry assessment described as a pivot toward targeting European leaders backing Ukraine.

Germany isn’t an isolated data point in Storm-1516’s record. The same network has run comparable campaigns against nearly every contested European election in recent memory. From a fabricated corruption story against Moldova’s president ahead of the country’s September 2025 vote, a fake video putting invented remarks in the mouth of Hungary’s opposition leader ahead of that country’s April 2025 election, to false scandal videos claiming French President Emmanuel Macron spent €148 million building a private underground bunker. Individually, each reads as a local story. Together, they describe one operation running the same playbook against whichever European election is next on the calendar.

The second job: attacking everyone except the AfD

Alice’s investigation into the same September 2026 election cycle found a separate network, Matryoshka, also known as Operation Overload, impersonating media outlets to push fabricated narratives of scandal and abuse against Germany’s mainstream parties.

Tellingly, the AfD and the left-populist and pro-Russian Sahra Wagenknecht Alliance (BSW) were left almost entirely untouched. Roughly 40 percent of the videos used AI-voiced deepfakes and were posted on a suspiciously rigid weekday schedule, with engagement spikes that looked coordinated rather than organic. The same network hit Sweden’s national broadcaster with a spoofed news segment attacking the prime minister just over two weeks before Sweden’s own September 2026 election, and in the same timeframe targeted Gabriel Attal, a frontrunner for France’s 2027 presidential race, with a separate impersonation campaign.

The operations are an implicit division of labor. One operation manufactures evidence of fraud that feeds directly into a domestic party’s grievance narrative, while a second runs character attacks on everyone else. Both serve the same broader goal — destabilizing governments that back Ukraine — through different mechanisms, in the same three-week window, across three countries.

When the story crosses borders

The final layer is amplification, and it’s the hardest to fact-check because there’s often no fabricated video, image, or document to point to. Once a real statistic — the postal/in-person vote gap — is attached to the fraud claim by a domestic commentator, it gets picked up and laundered by outlets domestically and abroad within days, presented as evidence “no longer explicable by demographics.” No fabrication was required at this stage; a real number, stripped of context, did the work.

This cross-border reuse runs both ways. A “dead voters” narrative that surfaced around Germany’s 2025 federal election, sourced to an Austrian outlet, echoed the same “the dead are voting” framing used around the 2020 and 2024 US elections. The narrative ran in parallel with a similar claim made by a losing candidate contesting Romania’s 2025 presidential election. None of these are copies of each other so much as the same rhetorical tool, reached for independently whenever a close or contested result needs an explanation that isn’t “we lost.”

This isn’t the first time Alice’s ETD team has tracked manufactured legitimacy. Our earlier reporting on Moldova’s diaspora-targeting networks ahead of its September 2025 election found widespread narrative laundering of pro-Russian fabricated claims across a web of ostensibly unconnected outlets to create the illusion of narrative consensus, especially targeting diaspora voters. Moldova was a ripe target for disinformation laundering because of its borders with Romania and Ukraine.

While Moldova’s case relied on volume across covert, interconnected domains, to spread fabricated narratives, interference in Saxony-Anhalt relied on a single real statistic drawn from official election results, reframed by a domestic commentator, to imply something the numbers alone didn’t support. The underlying strategy of spreading disinformation is the same: repetition and recontextualization can do the work of laundering a false narrative, regardless of the authenticity of its origin point.

Why this matters beyond one election

Saxony-Anhalt is not the end of the story. As of this writing, the same claim shape has already reappeared around Lower Saxony’s local elections on 13 September, and ahead of the Mecklenburg-Vorpommern votes on 20 September, a race already primed by months of “the system is rigged” narratives before a single ballot is cast.

A durable domestic template, reusable by anyone, that becomes exponentially more effective the moment a well-resourced influence operation attaches forged media or a convenient statistic to it. Understanding one piece, the fabricated video, the statistical reframing, or the character-assassination campaign, without the others means missing how the full picture reinforces itself to voters election after election.

This is precisely the kind of cross-cutting pattern that’s easy to miss looking at any single platform, country, or election in isolation, and hard to see without monitoring built to track how narratives move across borders and platforms in real time. Alice’s Emerging Trend Detection team surfaces these connections as they form, not after the fact, correlating fringe claims, influence-operation tradecraft, and cross-border narrative reuse well before a story like this reaches mainstream attention.

Coming in Part 2: The US Midterms

The character-assassination Matryoshka network described above, also tracked as Operation Overload, didn’t stop after September’s German regional votes. In mid-September, the same network launched a campaign ahead of the November 2026 US midterms. A wave of deepfake videos using voice-cloned Hollywood actors and fabricated CNN branding to attack Democratic candidates, following the same media-impersonation playbook it used against Germany’s mainstream parties, adapted for a different electorate and a different set of targets.

That’s where Part 2 of this series picks up: a closer look at the celebrity-deepfake campaign, how it fits the broader pattern of escalation Alice experts are tracking, and what a US-focused Russian-aligned operation does as the midterm elections fast approach.

If your platform is facing similar risks around elections, coordinated influence operations, or cross-border narrative manipulation, Alice’s intelligence experts can help you identify, mitigate, and stay ahead of evolving threats. Learn more about our Intelligence offering here, or speak with an expert here.

Inside Russia’s Election-Interference Ecosystem. was originally published in Intelligence @ Alice on Medium, where people are continuing the conversation by highlighting and responding to this story.

Drawing on 200+ offender and victim testimonies and over 4k+ discourse within sextortion ecosystems, Gavi examines how generative AI is used across grooming, sextortion, and child sex trafficking.

Generative AI is appearing in deceptive and exploitative online activity, but its role in online child harms is often described too broadly. An AI-generated image, altered voice, or chatbot may form part of an abuse process without causing or controlling the wider harm.

Alice’s research identified three distinct patterns:

1. AI can provide direct coercive leverage in sextortion
2. AI can support preparation and deception in grooming
3. AI can assist promotion or concealment around human-led trafficking.

This distinction matters as platforms develop safeguards. Detection focused only on AI-generated content may miss the behavior that turns an otherwise ordinary capability into part of an abuse process. Research by the WeProtect Global Alliance and Thorn and All Tech Is Human has similarly emphasized the need to address generative AI misuse in the context of online child sexual exploitation and abuse. Our research covered open- and dark-web forums, private messaging groups, social media communities, AI discussion boards, and trafficking-linked channels.

Three abuse pathways, three roles for AI

Grooming, sextortion, and child sex trafficking have different objectives and operational patterns. Alice’s research placed AI at different points in each pathway.

Grooming: preparation and deception

In grooming, the strongest evidence of AI use appeared before or around initial contact. Offenders discussed using AI to obtain guidance, construct synthetic child or peer personas, and rehearse manipulative interactions. Some described combining synthetic images, invented biographies, and altered voices to make a false peer identity appear credible. These discussions demonstrated planning and capability development.

The research did not establish recurring, fully automated, end-to-end grooming. AI’s more evident role was preparatory: helping offenders create personas, develop scripts, or rehearse behavior before human-led engagement.

Sextortion: fabrication becomes leverage

Sextortion showed the clearest operational AI use because fabricated or manipulated material could be converted directly into coercive leverage. The evidence indicated that AI-assisted image manipulation, voice alteration, and synthetic personas could strengthen deception. Fabricated sexualized material can also support threats when an offender does not possess authentic intimate imagery.

Offender resources also described combining image manipulation, voice generation, lip synchronization, face swapping, and conventional editing. These discussions do not establish that every workflow was successfully deployed. They show, however, how accessible tools could be coordinated within an established sextortion process without advanced model-development skills.

The FBI has also warned that financially motivated sextortion schemes targeting minors can escalate rapidly after an offender obtains compromising material or creates the appearance that it exists. Generative AI provides another way to create that appearance and increase pressure on a target.

Child sex trafficking: promotion around human-led exploitation

In child sex trafficking-related ecosystems, the commercial exploitation of a real child remains the defining element. The research did not establish routine or end-to-end AI-led trafficking in a single systematic way. The clearest observed uses supported promotion, customer acquisition, content packaging, and concealment around human-led exploitation.

Alice observed trafficking-linked infrastructure using AI-generated imagery, avatars, and synthetic spokespeople to promote services and direct viewers toward related off-platform channels. The synthetic media did not, by itself, advertise a child. Its significance came from its connection to infrastructure where sexual activity involving minors was advertised. This context changes how apparently adult-presenting or non-explicit promotional material should be assessed.

Other discussions described possible uses of AI narration and fabricated livestream interfaces. These examples demonstrated harmful intent or plausible abuse concepts, but the available evidence did not verify operational deployment. The stronger finding was narrower: AI could support the packaging and promotion of exploitation that remained human-led.

What this means for platforms

The findings suggest that platforms should assess AI-enabled child endangerment as a behavioral process rather than a content category. A synthetic image or altered voice may be benign in isolation. Risk becomes more visible when that content is connected to child-specific targeting, deceptive identity construction, coercive threats, payment demands, or exploitation-linked infrastructure.

Offenders can also distribute activity across multiple services. An AI provider may see a prompt, a social platform may see contact between accounts, and a payment provider may see a transaction. Individually, these signals may appear ambiguous. Safeguards should therefore consider repeated behavior, contextual indicators, and escalation across the abuse pathway, rather than relying only on whether content was AI-generated.

The differences among the three harms require different responses. Sextortion safeguards should prioritize coercion, threats, and distribution pathways. Grooming safeguards should account for persona construction and preparatory behavior. Trafficking-related detection should examine how synthetic promotional material connects to booking, payment, and off-platform exploitation infrastructure.

The central question is not simply whether AI appears in the process. It is whether AI helps move activity toward targeting, coercion, or commercial exploitation. This distinction can help platforms prioritize harmful behavior while limiting unnecessary intervention in benign AI use.

If your platform is assessing similar risks, Alice’s intelligence experts can help identify emerging abuse patterns and translate adversarial intelligence into proportionate safeguards. Learn more about Alice’s Intelligence offering, or speak with an expert.

Grooming, Sextortion, and Child Sex Trafficking: How Generative AI Is Impacting Each Harm Area was originally published in Intelligence @ Alice on Medium, where people are continuing the conversation by highlighting and responding to this story.

Noa Davidyan explores how AI-generated visuals are repackaging terrorist symbols into scalable signals of affiliation, glorification, and threat-relevant identity.

Introduction: AI Is Turning Symbols Into Systems

AI-generated propaganda does not replace real-world terrorist symbols. It gives them new surfaces. A slogan can be rendered as if it were carved into stone; a media-wing logo can be turned into a glossy studio object; a deceased leader can be visually reanimated as a timeless icon; and a cultural marker can be woven into a repeatable identity template. The result is not simply more extremist content. It is synthetic legitimation: AI helps make organizational symbols look permanent, emotionally resonant, and platform-native.

This article examines case studies from ecosystems associated with three U.S.-designated Foreign Terrorist Organizations (FTOs): ISIS, Lebanese Hizballah, and al-Qaeda.

It explores the use of AI-generated and AI-enhanced content to repackage explicit organizational identifiers- slogans, flags, leader imagery, media-brand marks, and other contextual signals, into new visual formats that are easier to circulate and harder to detect through legacy moderation cues.

Why Symbolism Matters for Threat Monitoring

Terrorist symbolism is not decorative. Recent research on terrorist logos argues that logos operate as signaling devices, providing cues about organizational identity and the propensity to use violence. Visual propaganda has always been central to extremist communication, but digital tools make high-quality visual production cheaper, faster, and easier to distribute globally.

The meaning of a symbol is also context-dependent: a flag, color palette, horse, mountain, leader portrait, or religious phrase can carry different meanings depending on its surrounding text, account context, audio, repost network, and audience interpretation. Generative AI changes the monitoring challenge because it can produce endless new visual instances of old ideological signs.

Hash-matching, keyword detection, and logo recognition may miss a slogan that has been rendered as a synthetic monument, a leader portrait that has been stylized as devotional art, or an official media logo that has been repackaged as a platform-native animation.

For intelligence teams, the value is not only in identifying one image. It is in recognizing when the same symbolic grammar- slogan, logo, leader, audio, and visual style- begins to repeat across posts, accounts, and formats.

The Ecosystem

The examples below do not all represent official media-wing production. In FTO ecosystems, symbolic content often moves through layered distribution: official media assets, affiliated outlets, supporter-created edits, repost accounts, indexed audio objects, AI hobbyist pages, and cross-platform remixing. AI enters this ecosystem as an accelerator rather than a standalone strategy: it makes symbols easier to restyle, animate, localize, and repeat.

For that reason, attribution in this blog uses four categories: official media-wing output; official-symbol remix; supporter-created or supporter-distributed content; and contextual supportive discourse.

Case Study 1: ISIS

Slogans as Synthetic Monuments

The ISIS examples involve explicit organization-identifying language: variants and abbreviations of the common slogan “The Islamic State remains” (“دولة الإسلام باقية”; Dawlat al-Islam baqiya). This is not a generic religious phrase in the observed examples; it is deployed as an ISIS slogan.

The Arabic example renders the slogan as if it were physically carved into a rocky desert landscape. The visual move matters: AI does not simply repeat the slogan as text. It transforms it into synthetic monumentality, suggesting permanence, territory, and historical depth.

The second example compresses the same symbology into a mythologized desert scene. Behind the riders appears an ISIS-associated black flag, while the Arabic word “remaining” (“باقية”; baqiya), appears prominently at the bottom of the image next to a black flag emoji. The term is part of the well-known ISIS slogan “The Islamic State shall remain” and functions here as a condensed symbolic signal: even when detached from a full slogan or formal propaganda poster, the single word and flag imagery are enough to invoke ISIS identity, continuity, and persistence. Research on pro-ISIS GenAI imagery has similarly found that Islamic State flags are especially prominent in AI-generated supporter content, underscoring the importance of the flag as a rapid affiliation marker.

Together, these examples show how AI can turn an ISIS slogan into a synthetic claim on space. The phrase is not merely repeated as text; it becomes a rock carving, a wall inscription, or a territorial marker in a desert scene. The symbolic effect is permanence: the organization is visually imagined as something carved into landscape and history, not just posted online.

Al-Furqan as official-media symbolism, restyled

Another interesting example of symbolic redesign is the AI-stylized logo of Al-Furqan Media Foundation, an official central media institution of the Islamic State rather than a generic supporter-made symbol.

The observed AI-styled image restages the Al-Furqan logo as an object of beauty and anticipation: a polished sign sits in a lush, flower-filled environment beside a studio microphone, with soft green light and the phrase “قريباً إن شاء الله تعالى” (“soon, God willing”).

This matters for threat monitoring because official-media branding can travel even when the content itself is not an official release. A supporter-created AI image using Al-Furqan branding can still function as an official-symbol remix: it borrows the authority of the media wing while benefiting from the flexibility and ambiguity of supporter distribution. Terrorist logos have been studied as signaling devices that communicate affiliation, ideology, and threat-relevant identity beyond simple branding.

Case Study 2: Lebanese Hizballah

The leader as voice, banner, and force

The example places Hassan Nasrallah, Hizballah’s former longtime Secretary-General, at the center of a synthetic Hizballah scene: His portrait appears over a yellow Hizballah flag and a formation of armed fighters, while the accompanying audio features a Nasrallah propaganda speech against the West.

The visual structure is not subtle. Nasrallah functions as the face of authority; the flag functions as the organizational identifier; and the fighter formation functions as proof of disciplined force. Together, the image turns leadership, armed capacity, and organizational identity into one easily shareable symbolic object. AI intensifies this older media logic by allowing the leader to be placed inside scenes that never existed: battlefield formations, monumental backdrops, stylized flags, or martyr-like visual environments. For monitoring, the important signal is not only the portrait. It is the combination of leader image, organizational flag, militant formation, and reused speech audio.

The Patch as Portable Organizational Branding

This Hizballah example focuses on the use of the organization’s flag emblem as a uniform patch. The AI-generated image shows a soldier-like figure in tactical gear, viewed from behind, with a shoulder patch carrying the Hizballah flag logo. The Arabic text at the top reads: “Only the resistance protects our lands…” (“المقاومة فقط من تحمي أراضينا…”). The symbolic anchor here is not the soldier alone. Without the patch, the image could be read as generic AI military imagery.

The Hizballah emblem on the uniform changes that reading: it turns the figure into a branded representative of “the resistance” and ties the image to Hizballah’s organizational identity. In this sense, the patch works like a portable flag. It places the group’s logo directly on the fighter’s body, transforming the body into a moving symbol of the organization. For monitoring teams, this kind of emblem placement is important because the logo may appear as a small patch rather than as a full flag or standalone symbol, and only appears violative to the trained eye. AI can therefore make organizational branding more subtle, portable, and harder to detect through simple logo-matching alone.

Case Study 3: Al-Qaeda

Repackaging Bin Laden Through AI

This example shows how AI can repackage a terrorist leader-symbol into another type of format. The post features an AI-generated portrait of Osama bin Laden, al-Qaeda’s founder and former leader: his face is partially blurred, but the white robe, beard, visual framing, and supporter hashtags identifying him as “Sheikh Osama” make the reference clear.

The image is paired with audio from a bin Laden speech and on-screen transcription. One visible line reads: “O Allah, support the mujahideen everywhere” (“اللهم انصر المجاهدين في كل مكان”). Together, the AI portrait, original speech audio, subtitles, and hashtags turn bin Laden into a reusable symbolic presence rather than an archival figure. AI does not replace the older symbol; The use of bin Laden’s original speech audio behind the AI-generated, partially blurred portrait appears to operate as a creative redistribution tactic: it gives legacy al-Qaeda propaganda a new visual wrapper.

For threat monitoring, this matters because the post may evade simple detection cues: it does not rely on an al-Qaeda logo, the portrait is synthetic and blurred, and the text is framed as religious supplication. Yet the combination of image, voice, subtitle, and hashtag still functions as a glorification signal and a transnational jihadist affiliation cue.

Cross-Case Pattern: AI Makes Symbols More Portable

Across case studies, the same pattern repeats: AI does not invent terrorist symbolism from nothing. It gives existing symbols new surfaces, new emotional registers, and new distribution formats.

This is why threat monitoring cannot rely only on explicit threats, known logos, or previously hashed propaganda. AI-generated symbolism can produce new images that do not match legacy assets while still functioning as signals of affiliation, glorification, and ideological continuity.

Conclusion: From Propaganda Assets to Synthetic Symbolic Systems

These case studies point to a shift from isolated propaganda assets to synthetic symbology. AI is not replacing the real-world symbols of terrorist organizations; it is giving them new visual forms that can look permanent, emotional, modern, and easy to circulate. A slogan can be carved into a synthetic landscape. A media-wing logo can be restyled as an anticipatory brand object. A leader’s image and voice can be reassembled into a new platform-native glorification signal.

For platforms and safety teams, the challenge is that these artifacts may not match known propaganda hashes, legacy logos, or explicit threat language. Their meaning emerges through context: recurrence, audio, captions, visual motifs, account behavior, and organizational linkage. Monitoring these symbolic systems early can help identify emerging threat patterns before they scale, while also avoiding overbroad enforcement against cultural, religious, or political expression that is not connected to terrorist support.

Understanding how these signals travel is essential for platforms seeking to detect emerging terrorist-supportive content without over-enforcing against legitimate expression.

If your platform is facing similar risks, Alice’s intelligence experts can help you identify, monitor, and mitigate these evolving threats. Learn more about our Intelligence offering, or speak with an expert today

Artificial Propaganda: AI Symbolism in FTO Ecosystems was originally published in Intelligence @ Alice on Medium, where people are continuing the conversation by highlighting and responding to this story.

Disinformation Beyond Borders — Part 1: Pakistani Online Narratives on India’s Defense and Diplomacy

Politically motivated disinformation campaigns are a rapidly evolving threat across South Asia, with digital information warfare between India and Pakistan being a deeply bilateral conflict. This blog series focuses on Pakistan-linked campaigns targeting India across a wide range of themes. This piece, the first in the series, examines narratives about Indian diplomacy and defense affairs.

Pakistan-linked disinformation targeting India’s military strength and diplomatic standing spikes following major India-related security and diplomatic events. This is especially the case since the 22 April 2025 terrorist attack in Pahalgam, Jammu and Kashmir (J&K), that killed 26 Indians. The Resistance Front (TRF), an Islamist militant group linked to Pakistan-based Lashkar-e-Taiba (LeT), claimed responsibility.

India responded on 7 May 2025 with Operation Sindoor, a counterterrorism effort that targeted Pakistan-linked terrorist infrastructure. Both events triggered a surge of disinformation from Pakistani social media accounts and set the template that later campaigns would repeat.

Anti-India Disinformation Campaigns

Pakistan-linked disinformation campaigns targeting India cover a wide range of themes. This piece, the first in a series, focuses on narratives about Indian diplomacy and defense affairs.

A persistent recurring narrative casts a military image of vulnerability and a shrinking diplomatic footprint. The objective is to challenge India’s international stature established over the last decade and undermine its credibility as a leading advocate for the Global South.

The claims are well-constructed, combining AI-generated media, manipulated visuals, and fabricated details into content convincing enough to leave a lasting impression on audiences within India, and to deepen polarization among communities already divided by the Line of Control (LoC), a military border that separates India and Pakistan in the disputed region of Kashmir. These claims also target and reach Indian and Pakistani communities abroad.

How the Campaigns Operate

Most of the individual social media accounts driving these campaigns present themselves as intelligence analysts, fact-checkers, or independent news outlets. Some are geo-located in Pakistan and adopt fake Indian names and bios. In tracking them, Alice noticed some are cited as sources in AI-generated search results, extending their reach beyond the platform of origin.

Several tactics recur across campaigns. Claims are often planted overnight in South Asian time zones, giving them hours to circulate before most users are back online, and fabricated visuals frequently borrow the logos and backdrops of prominent Indian news channels or alter genuine newspaper articles to insert false content, both of which aim to improve perceived legitimacy.

Posts also use images of political leaders and other prominent figures to draw immediate attention. Some pre-empt scrutiny by claiming authorities have “not yet issued an official statement,” using the absence of reporting as evidence to corroborate their claims.

Operation Sindoor: Manufacturing Defeat

India’s counterterror Operation Sindoor generated the first wave of these recent coordinated anti-India claims, built around a single theme of Indian military failure. In the Pahalgam attack’s immediate aftermath, some accounts tried to shift blame from Pakistan, alleging the Indian government had orchestrated it and that the Indian counteroperation, Operation Mahadev, staged encounters of Kashmiri detainees rather than arresting actual terrorists.

Once Operation Sindoor was launched, the claims moved to manufactured combat failures. Unrelated footage circulated as proof of Indian strikes on Pakistani civilian areas, and exaggerated claims held that Pakistani defenses had destroyed Indian military infrastructure. AI-generated distress calls, purportedly from captured Indian Air Force (IAF) pilots, reinforced claims that India was concealing pilot deaths, while other claims alleged BrahMos missile shortages, radiation leaks at Indian missile facilities, and failures in India’s air defense systems.

A third cluster targeted India’s resolve rather than its capability, alleging the Indian Navy was too hesitant to engage, that India ultimately surrendered, and, in the most viral version, that India “begged” Pakistan for a ceasefire. Even a year later, deepfakes of senior military officials and cabinet ministers “admitting” to concealed losses of aircraft and personnel continue to surface, sustaining the same narrative.

The Iran-Israel War: An Unrelated Conflict, Repurposed

When the Iran-Israel conflict flared up again in June 2025, anti-Iran narratives written from a pro-Israel Indian angle spread quickly across social media. Fabricated claims alleged Indians had been caught spying for Israel, and deepfakes showed senior Indian defense and foreign affairs officials publicly backing Israel and mocking Pakistan-Iran ties.

Other claims relied on recycled footage stripped of context. An unrelated, accidental fire was presented as Iran supporters torching an India-Israel drone production facility in Delhi, and older footage of a petrol pump fire was recirculated as evidence of an oil crisis causing unrest in India. In one case, the shooting at the White House Correspondents’ Dinner was framed as a joint India-Israel operation meant to derail US-Iran peace talks.

Pakistan-Afghanistan Clashes: India Cast as Proxy Sponsor

When armed clashes broke out between Pakistan and Afghanistan in October 2025, pro-Pakistan disinformation actors recast India as a sponsor of terrorism running proxy warfare against Pakistan. The claims accused India of funding and arming the Taliban, smuggling drones into Afghanistan, and deploying Indian troops on Afghan soil to fight against Pakistani forces.

Two deepfakes carried the same theme. One showed Indian Prime Minister Narendra Modi purportedly calling Afghanistan his “servant,” and the other showed the country’s Defense Minister, Rajnath Singh, calling for the Taliban and the right-wing Hindu nationalist volunteer group Rashtriya Swayamsevak Sangh (RSS) to join an alliance against Pakistan.

Fabricated intelligence reports and leaked documents allegedly showed anti-Pakistan actors, including the Tehreek-e-Taliban Pakistan (TTP), the Taliban, and insurgent groups in Khyber Pakhtunkhwa (KPK), operating as proxies of an “Indian deep state.” The narrative outlasted the conflict itself.

Following the de-escalation, claims about Indian state-sponsored terrorism continued to surface regularly. An AI-generated video purporting to show an Indus River dam destroyed by Indian airstrikes drove a viral ‘weaponization of water’ theme. Related claims alleged India was ready to restore the Indus Water Treaty, suspended since the Pahalgam attack, in exchange for Pakistan reopening its airspace to India’s unprofitable aviation industry. Recycled footage with false context, covering supposed ceasefire violations, drone incursions across the Line of Control, and attacks by India-linked militants, continues to circulate online.

Manufacturing Military Weakness

These narratives target the competence of the Indian Armed Forces broadly, rather than events tied to any single conflict. False claims of terrorist attacks causing soldier fatalities in J&K resurface around sensitive events such as the Amarnath Yatra pilgrimage, timed to suggest Indian security forces cannot protect pilgrims. In one recent example, footage from a US Immigration and Customs Enforcement operation was misrepresented as the abduction of the J&K Police Chief by militants.

The Indian Armed Forces faces a version of the same tactic, with civilian aircraft crashes mislabeled as military ones and framed as evidence that such accidents have become routine. A separate claim alleges Chinese occupation of Indian territory in Ladakh and Arunachal Pradesh, casting doubt on the Army’s ability to defend its own borders. Earlier claims took a different angle, alleging internal friction stemming from soldier resignations over oppressive working conditions and corruption among senior personnel.

Fabricating Diplomatic Isolation

Every major geopolitical event, multilateral forum, or bilateral deal creates a fresh opening for claims that undermine India’s diplomatic standing while elevating Pakistan’s. Some claims invent entire developments outright, including infant deaths from Indian medicines sent as humanitarian aid to Afghanistan, a US suspension of its strategic partnership with India, Russia rejecting an Indian submarine deal, French President Emmanuel Macron claiming India “begged” France for a missile deal, the Shanghai Cooperation Organization (SCO) rejecting India’s bid to link Pakistan to the Pahalgam attack, and the EU refusing to designate Pakistan a terrorist state at India’s request.

A separate strand of claims points to alleged hostility specifically toward India. This includes mass deportations of Indians by Qatar and Türkiye and Indian spies working for Israel getting caught, allegedly leading to India’s expulsion from the Chabahar Port project.

Bangladesh has also been included in the campaign, with fabricated claims that Dhaka rejected an Indian intelligence unit and deepfakes of Bangladesh’s former Prime Minister Sheikh Hasina voicing support for Modi’s Bharatiya Janata Party (BJP) and the RSS.

Cracks in Command: A Fabricated Political-Military Divide

A parallel line of claims manufactures divisions within India’s political, military, and civilian leadership. Deepfakes after Operation Sindoor showed journalists Palki Sharma and Ravish Kumar and actress Aishwarya Rai Bachchan purportedly questioning Prime Minister Modi about aircraft losses and criticizing his handling of diplomacy.

Similar deepfakes appeared to show J&K Chief Minister Omar Abdullah criticizing government policy and Home Minister Amit Shah blaming PM Modi and National Security Advisor Ajit Doval for failures during Operation Sindoor. Other claims targeted the military directly, ranging from a deepfake of then-Army Chief General Upendra Dwivedi purportedly resigning over disagreements about Operation Sindoor to unrelated footage of an Army-Police press conference labeled as an Army walkout over unmet funding demands.

A recent deepfake extended the pattern to a state-level controversy, falsely depicting the Amritsar Police Commissioner resigning over alleged human rights violations against Sikhs and announcing intentions to join the Khalistan movement.

Countering Disinformation

Alice’s Emerging Trend Detection team has tracked over 280 fabricated claims aimed at India’s diplomatic and military standing since Operation Sindoor triggered the surge 16 months ago, all originating from Pakistan-based users. Independent fact-checkers typically debunk these claims within hours, while mainstream media and official responses take longer, often days.

India’s government has set up its own fact-checking channels, including ones run by the Ministry of External Affairs and the Indian Army. Most accounts running these campaigns are restricted within India, which limits their reach among Indian audiences but leaves them fully accessible internationally. That asymmetry works against India, allowing the campaigns to keep shaping how foreign audiences see the country even as domestic exposure remains low. A debunk does not undo the initial impression, since early exposure to a fabricated claim lingers, deepens India–Pakistan polarization, and aims to gradually shift how audiences abroad understand India.

Alice’s intelligence experts track these campaigns as they emerge, identifying the recycled footage, synthetic media, and coordinated amplification behind them before they reach users at scale, giving platforms, frontier AI labs, and governments lead time to prepare before a narrative goes viral. If your platform or organization faces similar cross-border disinformation risks, learn more about our Intelligence offerings here or speak with an expert here.

Disinformation Beyond Borders — Part 1: Pakistani Online Narratives on India’s Defense and… was originally published in Intelligence @ Alice on Medium, where people are continuing the conversation by highlighting and responding to this story.

Since ongoing hostilities between the US and Iran escalated in early 2026, the Strait of Hormuz has remained one of the world’s most contested waterways. A sustained US naval blockade, stalled negotiations, and recurring strikes on Iranian infrastructure have kept commercial shipping disrupted and the risk of further military escalation elevated.

Uncertainty is a defining characteristic of any conflict, and is especially potent across vast expanses of water where the fog of war is often at its thickest. And yet, the global adoption of social media and the relentless pace of the 24-hour news cycle have resulted in a constant demand for real-time updates on the status of commercial and military vessels affected by the conflict.

During periods of heightened tension, the Strait of Hormuz is one of the most misinformation-dense theaters Alice’s Rapid Alert Team tracks, but this is far from being the only body of water periodically flooded with falsehoods. A review of Alice’s intelligence collected between 2023 and 2026 reveals that the maritime domain in general is especially prone to misinformation.

Looking back over three years of data, the Rapid Alert Team identified three recurrent patterns in maritime misinformation:

1. A singular maritime event typically generates multiple false narratives onto which different audiences project pre-existing grievances.
2. Recycled, real footage from an unrelated ship, incident, or year is the default form of fabricated “evidence,” often relaundered across multiple, separate narrative cycles.
3. Fully synthetic, AI-generated content is a rapidly maturing technique, escalating from fabricated scenes to deepfaked trusted messengers.

One Event, Many False Explanations

Real, verifiable maritime incidents rarely attract one false explanation. Instead, several narratives tend to emerge simultaneously, each shaped by a different audience’s pre-existing worldview. These competing narratives typically emerge before any official investigation concludes, and that investigative silence is itself weaponized as “proof” of a cover-up. The pattern reveals more about the audience doing the projecting than about the event itself.

One such example occurred on 26 March 2024, when the MV Dali cargo ship crashed into Baltimore’s Francis Scott Key Bridge, killing six construction workers repairing potholes on the roadway above. The Dali was pinned in place for nearly two months, and the Patapsco River shipping channel was rendered inaccessible due to debris. It was eventually determined that the vessel lost electrical power and propulsion multiple times and drifted off course, causing it to collide with a main support pier of the bridge.

However, within a two-week window, at least four conspiracy theories emerged claiming to explain the cause of the incident, targeting separate ideologically distinct audiences. According to one, Israel deliberately caused the collapse in retaliation for the US abstaining (not vetoing) a UN Security Council Gaza ceasefire vote the day prior. Other online users claimed that the Cybersecurity and Infrastructure Security Agency (CISA) had hacked the Dali and deliberately crashed it into the bridge, as evidence of a wider domestic deep-state conspiracy.

Other false narratives were vaguer, alleging that “enemy action” caused the disaster. In contrast, an AI-generated video featuring racist and xenophobic caricatures pinned the blame on the Indian crew members, ignoring that two local US pilots were responsible for navigating the vessel, alongside the 22 Indian crew who operated the Singaporean-flagged ship.

A similar pattern unfolded around the USS Gerald R. Ford in early 2026, as the carrier operated near Iran amid the deployment of the US’s largest military presence in the Middle East since 2003. Reports emerged of genuine plumbing problems on board, and on 12 March 2026, a fire broke out in the ship’s laundry facilities. Neither issue affected the vessel’s operational status or its role in the standoff with Iran.

Within roughly a month, three separate narratives had built on this same small, real problem. One claimed the carrier had been disabled by sewage flooding so severe that the US was forced to abandon plans to strike Iran, illustrated with footage that actually showed an unrelated clogged sewer system. A second claimed the crew was refusing orders to attack Iran over the onboard conditions, framing a maintenance issue as a mutiny. A third, arriving as the laundry fire became public, used an AI-generated video to recast that fire as damage from an Iranian missile strike.

Each version took the same minor, verified fact and pushed it toward a different conclusion: the ship is disabled, the crew has turned on its orders, or the ship has already been hit. None of the three needed the others to be true, and each reached its audience well before the Ford’s status had actually changed. What began as a plumbing complaint became, depending on which corner of the internet found it first, a withdrawal, a mutiny, or a missile strike.

Old Footage, New Lies

Recycling real footage remains the most common method used to fabricate “evidence” for a false maritime claim. A genuine clip, taken from a different ship, a different ocean, or a different year, carries an authenticity that’s hard to fake and hard for the average viewer to check in the moment. In nearly every example the Rapid Alert Team tracked, the underlying event being exploited was real. It was the attached footage that was not.

This pattern recurred throughout the Red Sea and the Strait of Hormuz, where the same trick worked again and again: a real strike, paired with footage of someone else’s disaster. When Houthi rebels seized the Israeli-linked Galaxy Leader in November 2023, an image spread claiming to show the ship loaded with military equipment, when it actually depicted a separate Emirati boat seized a year earlier. Two months later, when Houthi forces struck the US-owned Gibraltar Eagle, causing no significant damage per US Central Command, footage of a burning vessel circulated in its place, this time the X-Press Pearl, on fire off Sri Lanka.

Older and more distant footage kept the pattern going. A claim that Houthis had sunk a British cargo ship used footage of the Stellar Banner, which actually sank off Brazil back in 2020. And as tensions between the US and Iran escalated in May 2026, a video claiming to show a tanker “successfully” surviving an Iranian attack in the Strait of Hormuz turned out to be a Lloyd’s Maritime Institute training clip of an unrelated collision, filmed months earlier.

The same mechanism reached into the military domain. In March 2026, an image claiming to show the USS Abraham Lincoln struck by Iranian missiles was, in fact, a photo from 1967, showing repairs to the USS Forrestal after an accidental rocket strike off Vietnam. That photo had already done service once before, recycled in 2024 to support an unrelated claim about Houthi damage to a US carrier. The same footage, in other words, wasn’t just mislabeled. It was reused across two entirely separate conflicts, two years apart, whenever a narrative needed a damaged American warship to point to.

AI-Generated Footage and Fabricated Sources

True synthetic fabrication was the rarest technique the Rapid Alert Team observed, but it was also the one evolving fastest. The earliest cases simply staged a fabricated scene. The most recent ones fabricated something harder to question: a trusted messenger delivering the news.

That progression is visible across a single, tight period in 2026. In March, an AI-generated video claimed to show the USS Abraham Lincoln sinking after an Iranian missile strike, despite US Central Command confirming the carrier remained fully operational throughout. Days later, a fully rendered explosion at a cargo port appeared online, claiming to show an Iranian strike on Tel Aviv. The port itself doesn’t exist at the location shown, and the video spread across five language communities within days.

The clearest sign of where this is heading, though, was a deepfaked video of journalist Rachel Maddow, appearing to confirm on air that Iran had successfully struck the Lincoln. She never made the statement. Unlike the other cases, this one wasn’t fabricating a scene for the viewer to judge for themselves. It was fabricating the judgment, borrowing a real person’s credibility to vouch for a claim that never happened. As the technique matures, the more consequential shift may not be better fake footage of a purported incident itself, but better fake authority behind it.

Implications

Across all three patterns, the same dynamic repeats. Water itself does the work that other domains need fabrication for. A ship losing power, a fire in a laundry room, a vessel sinking in disputed waters, these are already remote, already hard to independently verify, and already wrapped in the kind of ambiguity that few other environments offer so readily. The maritime domain does not demand especially convincing fabrication to sustain a false narrative. It needs only the right conditions, and the sea supplies those on its own.

The maritime domain is worth watching closely as fabrication techniques evolve. Recycled footage remains the dominant tool because the ocean is full of ships that look enough alike, and incidents recent enough to feel current, that a clip from the wrong war can pass for the right one. AI-generated content is now closing that gap further, and as the Maddow deepfake shows, the fabrication is moving up a level, from the vessel itself to the person the public trusts to explain what happened to it.

For platforms and institutions operating in this space, the lesson isn’t just about catching individual fakes. It’s that maritime incidents will keep generating these openings by default, and the response has to move at the same speed as the water closes back over whatever actually happened.

If your platform is facing similar risks during fast-moving events, Alice’s intelligence experts can help you identify and mitigate them early. Learn more about our Intelligence offerings here, or speak with an expert here.

Murky Waters: Misinformation in the Maritime Domain was originally published in Intelligence @ Alice on Medium, where people are continuing the conversation by highlighting and responding to this story.