-
ArchiveGenocide’s Trojan malware is now open source
The gore and tragedyslop merchants of ArchiveGenocide are back. This time they are not posting heavily edited videos from the Gaza War. They are posting a Python script. ArchiveGenocide claims to have built a tool to detect “12,100 traces of Israeli spyware” on your devices. They are asking you to download it, run it, and…
-
Indoctrination 101: Pro-IRGC school ceremony in Turkey
A video from a memorial event in Turkey in late April is going viral again after showing children on stage tearing images of Donald Trump and Benjamin Netanyahu, along with American and Israeli flags. The ceremony was held in memory of the alleged victims from the Minab school incident in Iran. Reports indicate that the…
-
Propaganda & Online Echo Chambers
In the modern world, radicalization no longer depends on face-to-face contact. It happens through screens. Extremist groups such as Hamas and their sympathizers have turned the internet into a powerful tool for persuasion, spreading lies and emotional manipulation at a scale once impossible. Social media platforms, online forums, and encrypted apps have become breeding grounds…
-
How We Shut Down AI-Driven Deception Operations – part 3
💬 Bulk Commenting & Social Amplification Alongside their long-form articles, the threat actors used ChatGPT to generate batches of coordinated social media replies in both English and Persian. ⚙️ The Workflow 🤖 Automation and Tracking While the operators’ internal reports referenced a mix of manual and automated posting, we found no evidence that any automation…
-
How We Shut Down AI-Driven Deception Operations – part 2
Beyond using AI for updating reports, operators occasionally leveraged the model to design and craft operational texts. Specifically, they sought assistance in ensuring their fabrications used the precise accents, vocabulary, and institutional styles of various target countries. This activity represented a minor fraction of their total workload, likely because the operation involved at least one…
-
How We Shut Down AI-Driven Deception Operations – part 1
We’ve disrupted two sophisticated, high-reach influence operations from Russia and Iran that used our AI models to power “false front” deception networks. Over the last 2.5 years, we’ve tracked and reported on how threat actors exploit AI for cyberattacks, scams, and covert influence operations (IO). These two recent campaigns stand out for their scale, complexity,…
