We’ve disrupted two sophisticated, high-reach influence operations from Russia and Iran that used our AI models to power “false front” deception networks.
Over the last 2.5 years, we’ve tracked and reported on how threat actors exploit AI for cyberattacks, scams, and covert influence operations (IO). These two recent campaigns stand out for their scale, complexity, and ability to breach mainstream media.
The Operations
- Iran: Created a network of seven fake “journalist” personas to pitch long-form articles to global media outlets and generate social media comments on US-Iran relations.
- Russia: Co-opted unwitting locals in Latin America to run a fake physical “think tank,” while generating “leaked” documents and audio scripts.
Both groups used AI to draft articles, social media chatter, and internal reports—often using deceitful metrics to exaggerate their own effectiveness to their handlers.
Key Takeaways
- Old Tactics, New Tools: These operations mimic classic, pre-AI deception campaigns (like the notorious 2016 “Alice Donovan” and 2020 “PeaceData” fronts) but use AI to streamline workflows.
- Unprecedented Reach: On the 1-to-6 IO Breakout Scale, the Russian operation reached Category 5—the highest-impact operation we have ever disrupted. The Iranian operation reached Category 4.
- The Media Strategy: Rather than relying solely on social media bots, both operations successfully landed content in mainstream media. Our data across 30 disrupted operations confirms that targeting real news outlets remains the highest-impact strategy for threat actors.
By sharing these findings, we aim to expose these vulnerabilities and help industry peers, regulators, and society defend against AI-driven deception.
AI-powered “false fronts” grant threat actors greater scale, fluency, and editorial ability to deceive editors and audiences. However, exposing these hidden networks forces them to collapse.
By analyzing 30 operations exposed since early 2024, categorized below by their core distribution method and 1-to-6 Breakout Scale impact, we aim to make future disruptions easier.
Russia: Operation “Dark Clark” (Category 5)
We banned a cluster of Russian ChatGPT accounts operating via VPNs. This network targeted Latin America to undermine Ukraine and influence local politics, particularly in Argentina and Bolivia.
1. The Strategy: Unwitting Co-optation
The actors operated via a fake persona named “Mia Clark” to control a physical, ground-level think tank in Latin America called the Social Research Center (SRC). The operators handled hiring, firing, and payroll. Evidence indicates the local employees had no idea they were working for Russian intelligence. This is the most complex front identity we have ever disrupted.
2. AI Use: Internal Reporting over Content Creation
Surprisingly, the operators primarily used ChatGPT to draft tactical internal reports to their superiors rather than to generate consumer content. In these reports, they detailed their campaigns and used questionable metrics to exaggerate their effectiveness.
Their prompts heavily focused on translating and tracking public reporting around “Politology” (or “La Compania”), a reported successor to the Wagner Group.
3. High-Impact Deceptions
Dark Clark achieved unprecedented penetration, sparking real-world fact-checks, government denials, and international friction:
- Argentina: Internal reports tied the group to previously exposed “Politology” campaigns, including a fake story about President Javier Milei buying luxury dog collars, and paying locals to paint anti-Milei graffiti.
- Peru & Poland (May 2026): The group spoofed a Peruvian education authority email, tricking local schools into celebrating a controversial Ukrainian nationalist figure. They then leaked the school photos to Polish and Peruvian media, successfully weaponizing historical tensions between Ukraine and Poland to spark outrage from a European Parliament member.
- Ecuador (June 2026): The group used a fake email to trick Ecuadorian schools into pledging allegiance to President Daniel Noboa and Blackwater founder Erik Prince, successfully forcing a nationwide government denial.
Faked Media & Crisis Exploitation
- Bolivia Water Crisis: During late-May anti-government protests, the group circulated a fake audio clip claiming the state water company (EPSAS) would cut off water to La Paz and declare a state of emergency. EPSAS issued an official nationwide denial.
- Other Fabricated Content: Internal reports claimed they spread a fake TikTok video in April 2026 mimicking a Ukrainian Consul, a June audio clip warning of bank withdrawal limits in Bolivia, a faked letter threatening fuel restrictions, and a January hoax alleging a Brazilian model was trafficked and killed in Kyiv.
Deceiving Their Own Superiors
The operators frequently used ChatGPT to identify real-world events they could falsely take credit for to impress their handlers.
- Argentina: They claimed they seeded the specific Falkland/Malvinas arguments used by Argentina’s Foreign Minister at the UN. In reality, these arguments have been part of Argentina’s official diplomatic stance for decades.
- Brazil: They claimed credit for Brazilian media coverage of a captured foreign fighter who warned others not to join the war. In truth, the media was simply quoting the captive’s own public video.
The Mechanics of the “Research Platform”
The group operated a front called the Social Research Center (SRC), ostensibly focusing on the Indian diaspora in Latin America.
- Unwitting Employees: The operators managed hiring, payroll, and tasks via a fake online persona named “Mia Clark.” Local staff operated in good faith, entirely unaware they were working for Russian intelligence.
- Content Production: The staff produced over 60 highly detailed, original research papers—covering topics like BRICS public opinion and the Brazilian economy. This indicates a long-term strategy to build a credible, durable front.
- Technical Blunders: The operation struggled with social media distribution due to cross-border login conflicts. For instance, their X account showed a German VPN location but connected via the Russian App Store, while an Instagram admin was tracked to Venezuela.
- Left: The SRC X account, revealing a transparency setting connected via the Russian Federation App Store.
- Right: The SRC Instagram account, showing an admin location in Venezuela.
- LinkedIn Operations: Internal reports highlight the group’s struggles on LinkedIn, where they deployed loops of fake accounts to inflate their corporate page’s credibility. While the page eventually claimed a headcount of 200–500 staff and amassed 961 followers, only two linked employee profiles existed.
This is just Part 1 of our investigation—stay tuned for Parts 2 and 3, dropping in a few days.
