The suspect was identified as 31-year-old Cole Tomas Allen. He was charged on Monday with attempting to assassinate the president. The suspect was tackled by agents near a staircase which leads down into a ballroom of the Washington Hilton hotel.

Inside the ballroom, the annual White House correspondents' dinner was just getting underway. Hundreds of journalists and public figures were in attendance.

Just as previous assassination attempts have captured the imaginations of social media users, this latest threat to Donald Trump’s life spawned a deluge of fake images, unsubstantiated claims and outright conspiracy theories.

The following fact-checks were analysed by members of Eurovision News Spotlight.

Journalist accused of stealing bottle of wine

One video that received over 10 million views on various platforms showed a female journalist allegedly ‘stealing’ two bottles of wine as she was leaving the ballroom after the shooting.

The video prompted lots of discourse on social media, including false allegations about the woman’s identity (like one that said she was the Ukrainian ambassador). However, the woman is indeed a journalist and there is no evidence that this was a theft.

SVT identified the journalist and spoke to her colleague. They reported: “The dinner is normally paid for by the guests or their organisations, and the woman’s colleague told SVT that the wine had been paid for by the company they work for, and that their bosses urged them to bring what they had paid for.”

The videos also showed many others picking up bottles of wine along with their belongings as they prepared to leave the venue.

SVT Verifierar: Five viral claims after the shooting at the gala dinner

Leavitt’s comments taken out of context

One of the claims that circulated on social media was that White House Press Secretary Karoline Leavitt predicted the attempted attack before it happened, when she said “there will be some shots fired tonight in the room”.

But context is everything. Leavitt was actually referring to Trump’s speech, and the barbs he was expected to throw out in the room full of journalists.

In a pre-dinner interview with Fox News, she said: “[Donald Trump] is ready to rumble. I will tell you, this speech tonight will be classic Donald J. Trump. It’ll be funny, it’ll be entertaining. There will be some shots fired tonight in the room.”

‘Shots fired’ is an idiom that is often used to describe a sharp insult or a diss. It’s purely coincidental that it was the term she used ahead of an attempted shooting.

There was another Karoline Leavitt-involved theory. A short clip from Fox News was shared around, in which journalist Aishah Hasnie said that Leavitt’s husband had warned her at the event to be careful. The clip was cut short, with the Fox host confirming that it “sounds like we lost Aishah’s phone”.

Theorists claimed that this was evidence that the attack was known about beforehand. However, Hasnie later confirmed that her calls were dropping “because there is barely any service in that ballroom”.

She added: “To finish the story, he was telling me to be careful with my own safety because the world is crazy. Which is what my own father and other people have also said to me recently. He was expressing his concern for my safety. I was going to say - before I lost my signal - that it was unfortunate that only a short time later, this all happened.”

ZDF heute: Shots fired at Trump gala - conspiracy theories are now circulating

Video of the running suspect was created with AI

A video circulating on social media was presented as if it were real footage of a suspect running past a metal detector while several guards pointed their weapons at him.

However, the footage is fake and was generated using artificial intelligence, although based on real security camera footage from the Hilton hotel. A frame-by-frame analysis revealed errors typical of AI — like an agent’s hat and jacket changing mid-clip, and gibberish text on police officers’ jackets.

Additionally, the recording circulating on social media showed the CapCut AI watermark in the upper left corner. An X user claimed to have created the video using AI, saying: “I enhanced the security footage from last nights assassination attempt using AI. The footage was extremely low quality and it seems AI made up some things to fill in the gaps, but gives a better view of what took place,” they said.

VerificaRTVE: Hoaxes and conspiracy theories about the attempted attack against Trump at the White House Correspondents’ Dinner

The mystery of the man with the piece of paper

A lot of online speculation centred on the man who, shortly before the attempted shooting, showed a piece of paper with something written on it to Donald Trump, Melania Trump, White House Press Secretary Karoline Leavitt, and president of the White House Correspondents’ Association, Weijia Jiang.

In multiple videos, the group was seen reacting to whatever was shown on the paper, seconds before they heard the shots outside the room. Guesswork by social media users surmised that this man was announcing the attack, or that he was giving a secret signal by holding up a card.

However, the man is Oz Pearlman, a mentalist who was there to entertain guests. He has since described the mind-reading trick he was performing at the time — the reveal of Karoline Leavitt’s baby name. She is due to give birth in the coming weeks.

Other, manipulated versions of the image of Pearlman holding the piece of paper showed various writings on the page.

3Cat Info: The third attempt to attack Trump fuels conspiracy theories

Conspiracy theories about ‘false flag operation’

Some internet users on both sides of the political spectrum believe that the shooting at the White House Correspondents' dinner could have been a staged event intended to advance the interests of the American president.

CBC’s French-language broadcaster Radio-Canada reported that the theories had even reached the political class. Democratic Representative Jasmine Crockett of Texas posted on Threads: “Has there ever been a president have this many close ‘attempts’ on their life? Maybe it’s lax gun laws, maybe it’s lack of mental health funding, or maybe it’s fake… who knows …”

There are multiple strands of the conspiracy theory claiming that the incident was staged, including that it was an attempt to boost Trump’s popularity amid his war with Iran — which has been unpopular with parts of his base — or that it was a bid to secure his planned ballroom at the White House.

There’s no evidence that the attempted shooting was fake, but since the weekend, the Trump administration has been citing the security risks highlighted by the incident to further the project, which has up to now faced considerable legal obstacles.

Early this week, in the wake of the shooting, Republicans made a fresh push to secure public funding for the ballroom, and Donald Trump himself commented that the ballroom is needed to hold large-scale events with heightened security.

All of these new ‘false flag’ claims can be added to the pantheon of conspiracy theories about the various assassination attempts on Donald Trump. The 2024 attempt on his life in Butler, Pennsylvania, still looms large almost two years later for those who believe, without evidence, that it was a setup.

Radio-Canada: Shooting at the correspondents’ dinner: conspiracy theories flood the web

As the war between the Iran and the U.S. and Israel dragged near the seven-week mark, there were some signs of the sides returning to the negotiating table. But on the internet, another battle was as active as ever.

Trump and others in his circle are no strangers to posting highly political and even AI-generated content on social media. Now, Iran is retaliating with AI ‘slopaganda’ — a portmanteau of ‘AI slop’, high-volume content created by generative tools, and propaganda — with Iranian embassies around the world taking their cue from Trump’s style of posting to mock the American leader and reach out a hand to other countries in the West.

The posts offer an insight into the narratives being pushed by Iran in a bid to discredit the U.S. Many of them feature references to disgraced financier Jeffrey Epstein, who died in 2019 but remains at the centre of a series of high-profile sexual abuse allegations. Other recent posts referring to Trump’s depiction of himself as Jesus show the speed at which Iran is able to respond to the domestic talking points in the U.S.

Since the beginning of the war, the AI ‘slop’ being pushed out across Iranian networks has had strong religious overtones, often depicting Trump and Netanyahu taking orders from the devil and the Iranian leaders bathed in celestial light.

Are the accounts real?

The patchy and sometimes non-existent verification system on X nowadays means that any account purporting to be official must be checked and confirmed as authentic.

Many of the accounts posting as Iranian embassies are not verified, or carry a blue verification badge, which can be bought by anyone on X.

However, the Iranian Ministry for Foreign Affairs has a webpage that lists all of the embassies and their corresponding X (formerly Twitter) accounts. The list confirms the authenticity of the accounts analysed here.

The theme of Epstein

Much of the Iranian pro-regime content since the beginning of the war has heavily featured talking points about Donald Trump’s alleged links to Jeffrey Epstein and the broader theme of the Epstein files. The Iranian embassies have been resharing a lot of this content.

On April 16, the Embassy of Iran in Bulgaria shared an AI-generated video depicting Israeli Prime Minister Benjamin Netanyahu holding the Epstein files and urging Trump to dance on command. It appeared to suggest without evidence that Netanyahu was leveraging Epstein-related blackmail to force Trump to fight its war in Iran — a popular motif tying together a range of conspiracy theories across these two major stories.

The footage goes on to show Trump saying “I cannot do this anymore” before he is seen walking through red liquid in a ‘Graveyard of Americans in Iran’. A logo on the footage showed that it was not a direct original, but rather a reshare of a video by self-described ‘AI visual Artist’ Mujtaba Arts. Their account features several other similarly-themed videos.

The Iranian embassy in Tajikistan shared another Epstein-related AI video two days earlier, following a similar horror-blackmail theme. It showed Jeffrey Epstein’s head hovering over Trump’s shoulder and telling him: “Don’t fight it, Donny. We’ve been bonded since the ‘90s.”

It goes on to imagine that Jeffrey Epstein is controlling Trump and ultimately possessing his body, at which point he calls ‘Bibi’ and promises him “everything”. In this story, it is again Benjamin Netanyahu who is depicted — without evidence — as the holder of “tapes” that could ruin Trump.

Google’s AI detector SynthID picked up watermarks throughout this footage, indicating that it was at least partially made using Google’s AI tools.

The video bears a logo for an account called TheForbiddenClothes, which posts AI-generated meme content about geopolitics and current events, and also sells merch featuring the same artwork. Much of their recent posts have focused on the relationship between Trump and Netanyahu, and the account recently also posted that the moon landing was “faked”.

Divisions over Trump’s Jesus image, papal feud

Donald Trump was widely criticised even among his own supporters for a recent post on Truth Social which featured an AI-generated image of himself depicted as Jesus healing someone in a hospital bed.

Defending himself, Trump insisted that he thought it showed him as a doctor. The post was later deleted, although the president shared a new AI image of Jesus embracing him later the same week.

Some Christian followers of Trump were already being pulled in opposite directions; the Jesus posts came as the U.S. president and his administration were engaging in a war of words with Pope Leo XIV, the American-born leader of the Catholic Church who Trump is accusing of being too liberal and “weak on crime”.

The religious flavour to Trump’s latest targets drew backlash at home and in Europe. One of Trump’s closest EU allies, Italian Prime Minister Giorgia Meloni, had already refused to back the U.S.’ war efforts in Iran, and then called the president’s attacks on the pope “unacceptable”. In response, Trump called her “unacceptable”.

As other European leaders broke with Washington over the war on Iran, and amid internal criticism from some quarters of the MAGA movement, it was a moment of particular disunity in the West.

The Iranian regime ecosystem has been quick to respond to these talking points. One video posted by the Iranian embassy in Tajikistan animated the Truth Social Jesus image, showing Jesus flying down behind Trump and striking him violently, sending him bloodied and flying downward into hell. The voiceover said: “Your reckoning has come.” The post racked up an enormous 23.4 million views in just over two days.

The Iranian establishment has also backed the pope amid his tensions with Trump. The parliament speaker Mohammad Bagher Qalibaf wrote in a post on X: “Honoring Pope Leo’s fearless stand!”, adding: “@Pontifex leadership inspires millions – thank you for this light!”

The embassies were no different. On April 17, the embassy in Belarus posted a screenshot from Al Jazeera with the headline: “The pope has shown the world how to stand up to Trump.”

As the rift widened between the U.S. and Italy, and Trump threats that the U.S. would not be there for its European ally if Iran were ever to strike, Iranian regime accounts began posting about their love of the Mediterranean country.

The Iran Embassy in Thailand posted on X: “Why would we hurt Italy? We love Italian people, soccer, and food and we love Rome, Rimini, Pisa, Milan, Venice, Sardegna, Florence, Naples, Genova, Turin Sicily, and everything in between.”

The Thai account was particularly active, tweeting rebukes to the White House’s posts and resharing memes from across the pro-regime ecosystem.

Meme warfare

There are also more general memes about the U.S. president being shared by the embassy network, including other content by third parties that have no links to the Iranian regime.

A video posted by the Iranian embassy in South Africa featured Trump in a Desireless ‘Voyage Voyage’ parody, singing a song called ‘Blockade’. The video originally came from a German AI comedy creator called Snicklink.

Snicklink replied to the Iranian embassy post with a new AI-generated skit of Trump, in which Trump says: “You people are not supposed to publish my video.”

Separately, in a play on an old tweet containing a typo by Donald Trump in 2017, a post by the Iranian embassy in Thailand on April 13 simply said: “A wise man once said, ‘Open the strait or I will covfefe’. Thank you for your attention to this matter.”

Political messaging

Some of the messages appear to be targeted at the American public, playing into concerns about spiralling costs amid the war.

A post by the Embassy of Iran in Thailand included an image that looked like a ‘Trump 2028’ campaign logo. Instead, it said: “Trump $20.28 per gallon”. The caption read: “Are you ready folks?”

It was not an original creation: the same image was circulating in March on American social media.

And for the U.S. viewers, the messaging and meme tone in which it’s being delivered appears to be effective. A viral reshare of the post joked that “Trump should lift sanctions on Iran so Dems can hire them as their campaign messaging consultants”.

Iranian government working with content creators

Much of the content being shared by Iranian embassies appears to be reshares of third-party material made by pro-Iranian regime creators.

Among the most famous videos in this propaganda battle are the Lego skits, featuring characters depicted as Lego figurines, sometimes with a musical track in the background. The videos are produced and released by an account called Explosive Media. The Explosive Media videos have been shared by the embassies, as well as going organically viral on social media from Explosive Media’s own channels.

A BBC News interview released earlier this week with one of the creators of the Lego videos, known only as Mr Explosive, revealed for the first time that the Iranian regime is a “customer” that has commissioned the small team for a number of projects. In previous interviews, the outlet had said it was “fully independent”.

As with much of the other Iranian output, the videos focus on specific political and religious themes. The Epstein files feature heavily, as do specific incidents like Iranian military strikes on areas around the Gulf. The videos often fail to depict the situation accurately, but that has not stemmed their popularity in the English-speaking world.

An internet blackout is still affecting the majority of Iranians. However, Mr Explosive told the BBC that he is able to use “journalist internet” granted by the government. This description tallies with other reports, including from NetBlocks which monitors the blackout, that regime figures and ‘whitelisted’ influencers are allowed to access social media freely.

Claus Valling Pedersen, a researcher in Iranian culture at the University of Copenhagen, told Denmark’s national broadcaster that the decision to use Lego was probably strategic, as they have an innocence that fits the message of ‘good versus evil’. The iconic Danish bricks have as much brand recognition in Iran as they do anywhere else.

Danish news outlets including Spotlight member DR have contacted Lego for a comment, but they did not respond.

YouTube banned Explosive Media’s YouTube account, prompting the Iranian Ministry of Foreign Affairs spokesperson Esmaeil Baqaei to post on X: “In a land that proudly hosts Pixar, DreamWorks Animation, and The Walt Disney Company, an independent animated YouTube channel — which had organically grown by depicting U.S. aggression & warmongering, and garnered millions of viewers — was abruptly shut down!!”

He did not mention that the channel is not entirely independent, and counts the Iranian government as a client.

A new Lego video showed the speed at which the creators are able to react to new events. It poked fun at U.S. Secretary of Defense Pete Hegseth’s onstage prayer, which was actually a passage from Pulp Fiction, a day earlier.

• BBC News: We spoke to the man making viral Lego-style AI videos for Iran. Experts say it’s powerful propaganda

• DR: Danish toys at the centre of Iranian propaganda

Long-running themes repackaged

Iranian journalist and Eurovision News Spotlight contributor said the wider themes dealt with in pro-government content are nothing new, although they have been repackaged for the modern social media audience.

“Iran’s anti-imperialist image or language is not something that Iran has come up with in the past weeks or months. This is something that Iran has identified with since day one of the Islamic revolution,” she said.

“For someone like myself who grew up in Iran and studied there, the language and the message is exactly the same as we’ve heard and seen over decades. It’s just through more relatable images.”

So why are these messages gaining such a foothold in the West now? Aminolahi said that appetite has been building due to recent world events.

“There’s a momentum for leftist, anti-imperialist ideas. Mainly they became louder and more demanding from world leaders after Israel’s campaign in Gaza. Suddenly Iran found a lot of common language with those voices. The audience is already there, it’s just how to package that message.”

“I don’t think Iran has spent a lot of time on tailoring the message. Frankly, the message is very similar to what we’ve seen inside Iran for decades. It’s just the packaging that has changed a little bit.”

Aminolahi said that the success of these videos goes way beyond their creativity and comedic value for people who don’t like Donald Trump; they also appeal due to confirmation bias.

“It resonates because of a lot of factors. A lot of people want to believe that the message they have in mind — let’s say, these anti-imperialist voices that are gaining this momentum — they have no means to understand or they don’t want to understand, for example, human rights abuses in Iran.”

“The idea that ‘this resonates with me, this validates what I think, so this must be the truth’ — that plays a role because of many different world events.”

The world watched in awe on Monday, March 6, as four Artemis II astronauts on board NASA’s Orion capsule — named Integrity — flew further than any humans have ever gone before, travelling around the dark side of the moon before beginning their return back to earth.

It was NASA’s first lunar flyby in more than 50 years, and despite no moon landing, it marked yet another ‘giant leap’ for space travel and humanity’s understanding of the lunar surface.

The extraordinary story sparked a huge public appetite for videos showing every aspect of the mission, from breathtaking imagery of outer space to details about quotidian life aboard a space capsule — like how to use the toilet.

While NASA and the onboard crew have shared lots of content about the expedition, the nature of the travel and breaks in connectivity has meant that there were times during the mission where little new visual material was available, creating the perfect breeding ground for false material to pop up.

On top of that, the moon has remained a staple in the world of modern conspiracy theories. Ever since the first moon landing, false claims have abounded that it was all a sham filmed inside a soundstage.

AI slop adds to widespread misinformation

The term ‘AI slop’ was coined in recent years to describe the high volumes of low-effort synthetic content, created to capitalise on the attention economy. As with all news stories in 2026, there was plenty of slop in circulation during the Artemis II mission.

One video made claims of proving that the mission was entirely staged. It showed the astronauts floating on wires and sitting inside a capsule in front of a green screen. One of the posts (archived) that included this video, which racked up more than a million views, was captioned: “Stop believing these tricksters.”

The footage was created using Google’s AI tools, the company’s SynthID watermark check tool confirmed.

Away from the conspiracy theory world, artificially-generated materials have also been affecting the photography world. Astrophotographer Damian Peach, posting on X, wrote that he had encountered “countless fake” images claiming to be from the Artemis II mission.

He wrote: “Social media is fast becoming a platform where deceptional grift is allowed to run unchecked. Many of these posts have bigger engagement figures than the actual real images from the mission which is incredibly sad.”

Former British MP shares conspiracy theory content

Former British MP Andrew Bridgen shared with his 361,000 followers a pair of side-by-side images (archived) claiming to be from the Apollo 8 mission in 1968 and the Artemis II mission in 2026. The images are almost indistinguishable.

In the caption, he wrote: “It’s a remarkable coincidence that the Earth was exactly the same orientation to the moon with exactly the same cloud coverage when these two pictures were taken 68 years apart. Am I now a coincidence theorist ?”

There are a number of issues with the claims. Firstly, the image on the left is not from the Apollo 8 mission, but an edited version based on an original photo from the Apollo 11 mission in 1969 — the first human landing on the moon. Visual analysis of the cloud pattern and visible landmasses on the Earth show that it is a match. The real version is available on NASA’s website.

The image on the right of the collage is clearly the same image as that on the left, but zoomed in and edited to include an apparent window frame around the edges. While the collage seems to be based on the real NASA photograph from 1969, Google’s SynthID can detect an AI watermark across most of the image, further explaining any differences between the two versions and the original.

None of these images match any of those captured during the recent Artemis II mission.

AI spliced video draws on real pictures

A viral video showed the four crew members of the Artemis II mission cheering and waving at the camera, before it pans to the window, where the Earth was visible in the distance.

A post on X featuring the video that racked up over a million views posed the question: “If there were 4 astronauts on the Artemis II mission, who was filming? Did the camera make that movement, ending in a close-up on Earth, because of zero gravity?”

The X user raises a valid question, despite the fact that the footage is very sophisticated and nothing immediately appears amiss.

The truth reveals a far more sophisticated approach to AI-manipulated content than the types of entirely AI-generated videos we have often analysed in the past.

OSINT analyst Tal Hagin, who frequently posts analysis of online content to his social media account, shared his assessment that the video is an AI-spliced item drawing on two real pieces of content: NASA’s footage of the astronauts waving and a still image of the Earth seen outside the window of the space shuttle.

AI splicing is where artificial intelligence is used to arrange and join different videos together into one sequence. In this case, the first section draws from a real video, while the second scene showing the Earth outside originally came from a still image. The evidence suggests that the middle section — the pan between the astronauts and the window — was entirely AI-generated and created to join the two shots together.

• Read Tal Hagin’s full X thread analysis here.

Moon hoaxes circulating since 1969

Despite all the advances the world has made in space travel over the last century, there are still many who don’t believe that humans really landed on the moon in 1969.

On July 20 of that year, NASA astronaut Neil Armstrong became the first human to set foot on the lunar surface during the Apollo 11 mission. The misinformation surrounding that mission, as well as discourse around the assassination of JFK earlier the same decade, formed the roots of the modern American conspiracy culture that still endures today.

There are several details of the original moon landing that have continued to come under scrutiny by conspiracy-minded sceptics. Why was the U.S. flag planted on the moon waving despite no wind nor air? How were the astronauts able to leave footprints on the lunar surface when it is so dry? Why are there no stars in the images the 1969 crew brought back to Earth? And are the shadows of the astronauts inconsistent in the images of them on the moon?

These suspicions and more have been debunked hundreds of times since the conspiracy theories were formed. Still, they recirculate every time there is a new space mission, especially one involving the moon. For instance, the questions about the lack of stars emerged once again this week.

Many of the theories stem from a lack of understanding about the atmosphere and minerals on the moon. The more limited capabilities of cameras — as well as how varied light sources affect their function — offer more explanations about some of the most commonly asked questions.

The swift improvement in AI technology is a gift for moon misinformation on two fronts: it’s ideal for those who wish to make and spread fakes, while conspiracy theorists can sow the seed of doubt with claims that any agency or official person could themselves be using AI.

Whatever the cause of the scepticism surrounding visits to the moon, it’s clear that nearly 60 years on from the first lunar landing, the desire to question or challenge this greatest of human feats is alive and well.

Read more member stories about the Artemis II mission:

• RTVE: Man's arrival on the Moon in 1969: hoaxes and falsehoods that have circulated ever since

• RTVE: Artificial intelligence and disinformation about the Artemis II mission: it's real, not a recreation

• 3CAT: We reached the Moon: from denialism to evidence of the most unusual journey

• 3CAT: A chroma key or images made with AI: false rumours spread about the Artemis mission

SOURCES

• Bbc.com. (2026). Watch: How will the Artemis astronauts go to the toilet in space? [online] [Accessed 7 Apr. 2026].

• Flannery, M. (2024). Series of images showing ‘faked’ moon landing were AI-generated. [online] Spotlight.ebu.ch. [Accessed 7 Apr. 2026].

• X (formerly Twitter). (2026). Available at: If there were 4 astronauts on the Artemis II mission, who was filming? [Accessed 8 Apr. 2026].

• X (formerly Twitter). NASA (2026). Available at: "We can see the Moon out of the docking hatch right now. It's a beautiful sight." [Accessed 8 Apr. 2026].

• NASA. (2026). Artemis II Looking Back at Earth - NASA. [online] [Accessed 8 Apr. 2026].

• Portero, M., Navarro Sorolla, M. (2026). Llegada del hombre a la Luna en 1969: bulos y falsedades que circulan desde entonces. RTVE.es. [online] [Accessed 8 Apr. 2026].

• X (formerly Twitter). (2026). Available at: A sample of the countless fake AI generated images claiming to be from the Artemis II mission. [Accessed 9 Apr. 2026].

• X (formerly Twitter). (2026). Available at: “All this Fake NASA 💩 with AI and CGI and green screens. Stop believing these tricksters” Accessed 9 Apr. 2026].

• X (formerly Twitter). (2026). Available at: “Not one star. 60 years of technological progress with cameras… And not one star. I’ve heard all the explanations for this. None make any sense.” [Accessed 9 Apr. 2026].

• X (formerly Twitter). (2026). Available at: It’s a remarkable coincidence that the Earth was exactly the same orientation to the moon with exactly the same cloud coverage when these two pictures were taken 68 years apart. Am I now a coincidence theorist ? [Accessed 9 Apr. 2026].

• NASA. (2023). Apollo 11 Mission image - View of moon limb,with Earth on the horizon,Mare Smythii Region - NASA. [online] Available at: [Accessed 9 Apr. 2026].

In this episode of the Eurovision News Podcast, host Giles Gibson brings you a snapshot of the first few days of the US-Israeli War with Iran, from the perspective of three foreign correspondents who were in Israel when the conflict started.

Veteran BBC foreign correspondent and presenter Clive Myrie explains how he presents the news from a hotel balcony as air raid sirens ring out; SBS News correspondent Ben Lewis talks about the challenges of working solo in a warzone; and ARD radio reporter Jan-Christoph Kitzler, who’s based in Tel Aviv, also breaks down how the initial hours of the war played out in Israel.

Alex Cadier and Eric Feijten describe how they stay safe, try to cover the story with empathy and how they have developed a personal connection with Ukraine.

We also hear about the crucial role of “fixers” and the increasingly heavy burden on local journalists, who have been living with the conflict, day in, day out, for four years now.

U.S. President Donald Trump shared a video on his Truth Social account at 8:50 p.m. on Monday (U.S. Eastern Time). The clip was posted without any caption, but came as the U.S. had reportedly struck a location in the central Iranian city of Isfahan.

The nighttime footage shows several explosions and a mushroom cloud in the sky. The official quoted by the WSJ confirmed that the video captured the overnight U.S. strikes in Isfahan.

Verifying the strike

The nature of the video does not allow for independent verification, and there is little available visual information to allow for geolocation.

However, no examples of older use of the clip were found by Eurovision News Spotlight, helping to establish that the incident shown in the video was in fact recent.

Accounts that frequently share footage from eyewitnesses inside Iran had also posted about the bombing in Isfahan overnight. A higher quality version of the same clip posted by Trump was shared by @mamlekate on X almost 50 minutes before the Truth Social post went out.

Vahid, a prominent online activist who has been documenting the protest movements and war in Iran with footage sent directly to him, also shared a few different clips showing explosions. One video showed a mushroom cloud with illuminated explosions to its right — which appeared to match the scene in the video shared by Trump and @mamlekate.

Finding the location

Attempts have been made to geolocate the ammunition depot hit by the strike, with social media users suggesting it occurred in the southwest part of Isfahan.

Other circulating videos described as showing the Isfahan strikes can add insight about the general location. Another video on social media, described as showing the overnight explosions in Isfahan and shot from another angle, showed a mosque in the foreground.

The mosque appears to be a visual match for Mosalla Mosque, which has a curved ceiling, a large dome, and a series of columns at either end of the structure, which can be seen on Google Maps.

That mosque, while more central, is also in south Isfahan. The angle from which we are seeing the explosions also suggest they were lighting up the sky further south, which is the general location of a mountain ridge that could match that seen in Trump’s video and other views identified by OSINT social media users.

Despite these clues pointing to southwest Isfahan as being the location of the strikes, Eurovision News Spotlight was still unable to pinpoint the exact location at the time of writing.

Trump’s use of social media

Although U.S. President Donald Trump shared the clip, there is sufficient evidence to suggest that neither he nor any U.S. employees are the owners of the video, which is likely to have been filmed by an eyewitness, circulated on social media, and was later shared with Trump.

Traditionally, media releases by a figure like the U.S. president would automatically be considered as confirmation or verification of an incident. However, much of that has changed under Donald Trump, who, since entering politics, has become known for his relaxed use of social media.

The U.S. president has long pushed the limits between the real and the unreal, often using AI-generated memes to mock his critics or present his vision for the U.S. — or at times the world.

There have been repeated instances of the president posting questionable or outright false claims and content, which is important context for how to approach the verification of a new, uncaptioned video of such apparent importance.

In this case, an official had to be asked whether the material was genuine, which gives a sense of how news outlets are approaching the president’s no-context musings and content reshares.

CLAIM: Videos purported to show damage and missile impacts in Israel amid its war with Iran. Unverified rumours accompanied them about the purported deaths of high-profile Israelis.
BACKGROUND: Little information about the impact of Iranian attacks in Israel was emerging, and the country is known to have a strong air defence system and a military censor.
METHOD: Reverse image searches revealed videos to be old and unrelated to the war. No official communication was released to confirm the deaths of any high-profile figures.
RATING: Videos being shared claiming to show damage and fires in Israel were false.

As the U.S. and Israel’s war against Iran entered its second week, unverified rumours began circulating on social media that Israel has been hit harder than had previously been thought.

The speculation came amid continued Iranian drone and missile attacks on Israel as well as countries in the Gulf region. While evidence of significant damage was emerging from Iran, where the U.S. and Israel were striking, there was little indication that the Iranian attacks against Israel were having as much of an impact.

Since the start of the war with Iran on February 28, the Israeli Institute for National Security Studies — an independent think thank affiliated with Tel Aviv university — puts the deaths in Israel at 14, 12 of whom were civilians and two soldiers. More than 2,600 people have been injured in Israel so far, the institute reported.

Israel’s Iron Dome air defence system is known to be among the world’s most effective. The Israeli military was posting frequent alerts that were being sent to phones across the country, warning residents to retire to bomb shelters amid incoming attacks.

There are international journalists in Israel and news reports are coming out of the country, but all journalists and members of the public are subject to a military censor. The rules for the censor relate to the prohibition of broadcasting material that could pose a national security threat or reveal sensitive information.

A report by CNN, which operates in Israel, outlined that the rules are “particularly sensitive during wartime”, adding: “The military censor has made clear that broadcasting any images that reveal the location of interceptor missiles or military sites hit by enemy projectiles is forbidden, especially in live broadcasts.”

While Israel is not the only country to impose restrictions on news media during a war, it is perhaps this system that has fanned widespread rumours that there has been far more damage in the country than has been openly revealed.

Rumours of political figures’ homes under attack

This week, one of the big themes on social media has related to this suspected undisclosed damage. Some of the posts have gone further, with claims that senior political figures and their families have been targeted in the attacks.

One video that circulated widely across multiple accounts on English social media and on Farsi and Arabic language channels showed a house on fire, with captions saying that Benjamin Netanyahu’s brother Iddo Netanyahu had been killed after Iranian missile strikes on his family home.

The video is old and unrelated to the current war. A reverse image search revealed it was posted on Facebook on February 10, with a caption that it showed Park Place in Galloway, New Jersey. From there, the house is easy to geolocate on Google Maps.

Videos from recent years are frequently shared with claims they shows new events, but occasionally very old footage is used for disinformation. On March 9, a video that is almost 25 years old was shared with claims it showed Benjamin Netanyahu’s house after a drone and hypersonic missile attack (post archived here).

The footage actually showed sparks and smoke pouring from New York’s World Trade Center after the 9/11 terror attacks in 2001.

Another wide-reaching hoax involved claims that Itamar Ben-Gvir, the Israeli Minister of National Security, had been killed or injured. Some posts across social media even spread rumours that Israeli Prime Minister Benjamin Netanyahu had been killed. No official statement was released to address the rumours, nor had any trusted news sources reported on any harm to Ben-Gvir or the Netanyahus.

Benjamin Netanyahu has frequently appeared in the media since these claims emerged, and has been releasing video statements via his official channels.

Some of the claims included more detail, such as that Ben-Gvir had purportedly been involved in a ‘car crash’ but that it was a cover-up for an Iranian missile strike on his home. This post outlining that claim had 1.3 million views alone, while another — by the same uploader as the house fire example — had 3 million views.

The car crash theory did not come from nowhere; in 2024, Ben-Gvir was injured in an accident that saw his car flip over. When searching posts on X about Ben-Gvir’s purported ‘death’, old posts relating to that car crash appeared in search results.

Late on March 10, after hours of viral claims about his alleged death, Itamar Ben-Gvir posted on X “I'm alive,” and directed an expletive towards those who claimed otherwise.

Other alleged damage in Israel

There were also more general false claims that images and videos showed damage and fires in Israel.

A video circulating late on Sunday night and throughout Monday showed a gigantic fire engulfing a building on a city street, and was captioned: “Firefighting efforts continue in Tel Aviv, aglow from Iranian missiles.”

The footage was real, but it actually showed flames erupting from a historic train station building in Glasgow, Scotland on March 8. A huge fire engulfed the station after originating in a nearby vape shop, making headlines around the same time as the claims emerged.

Another dramatic video showing flames ripping through a building block was captioned as showing “Israel’s capital, Tel Aviv, has been destroyed by an Iranian attack”. A video post on X elaborated, saying early on March 10: “Tonight Tel Aviv has received the impact of hundreds of high-payload missiles (+1000kg) The consequence is that the city is in flames and without power Israel threatens 5 years in prison for anyone who records these images.”

@lipes232LOKAL UPDATE -- Malam yang mencekam di Tel Aviv. Sirine meraung tak henti-henti di seluruh penjuru kota saat ratusan rudal Iran mencoba menembus sistem pertahanan udara. Langit yang biasanya penuh lampu gedung, kini berubah jadi arena intersepsi rudal yang mengerikan. Lalu lintas lumpuh, warga berlarian mencari bunker perlindungan, dan suara ledakan menggelegar di atas gedung-gedung tinggi. Situasi benar-benar di luar kendali. Apakah sistem pertahanan udara mampu menahan gelombang serangan berikutnya? Al Jazeera #LokalFeeds

Tiktok failed to load.

Enable 3rd party cookies or use another browser

Despite high viewership and supportive comments on TikTok, this was another falsely captioned video. Eurovision News Spotlight found snippets of the same video that predates the war, like this version uploaded to Instagram on January 31.

Many more examples of miscaptioned or false images, some AI-generated, showed destroyed urban landscapes and flames rising from alleged strikes, and were shared with captions suggesting they showed places in Israel.

With the conflict now moving past its initial stages and both sides claiming wins, any declarations of disproportionate damage that are not being reported by trusted sources deserve extra scrutiny.

SOURCES

• Askew, J. (2024). What are Israel’s air defences? And why are they so effective? [online] euronews. [Accessed 10 Mar. 2026].

• Liebermann, O. (2026). How international news outlets report under Israel’s military censor during wartime. [online] CNN. [Accessed 10 Mar. 2026].

• X (formerly Twitter). (2026). Available at: “The IDF identified that a short while ago, missiles were launched from Iran toward the territory of the State of Israel…” [Accessed 10 Mar. 2026].

• X (formerly Twitter). (2026). Available at: Benjamin Netanyahu’s brother Iddo Netanyahu has lost his life after Iranian missile strikes on Netanyahu’s family home. [Accessed 10 Mar. 2026].

• Facebook.com. (2016). Facebook. [online] Available at: Happening Now: Park Place, Galloway, NJ [Accessed 10 Mar. 2026].

• Spender, T. (2024). Ben-Gvir, Israeli far-right minister, in car accident. [online] Bbc.com. [Accessed 10 Mar. 2026].

• X (formerly Twitter). (2026). Available at: BREAKING NEWS ‘israeli’ media unconfirmed reports Itamar Ben Gvir involved in ‘car crash’ when he has actually been killed in an Iranian missile strike on his home. [Accessed 10 Mar. 2026].

• X (formerly Twitter). (2026). Available at: So the Israeli media reports Itamar Ben‑Gvir died in a “car crash,” while in fact he’s been obliterated by an Iranian missile strike on his home..... [Accessed 10 Mar. 2026].

• X (formerly Twitter). (2026). Available at: Firefighting efforts continue in Tel Aviv, aglow from Iranian missiles. [Accessed 10 Mar. 2026].

• Geddes, J. (2026). Huge fire at Glasgow Central Station prompts evacuations as building collapses. [online] Bbc.com. [Accessed 10 Mar. 2026].

• Tiktok.com. (2026). Available at: LOKAL UPDATE -- A tense night in Tel Aviv. Sirens wailed incessantly throughout the city as hundreds of Iranian missiles tried to penetrate air defense systems. TikTok - Make Your Day. [Accessed 10 Mar. 2026].

• X (formerly Twitter). (2026). Available at: Tonight Tel Aviv has received the impact of hundreds of high-payload missiles (+1000kg)… [Accessed 10 Mar. 2026].

• Instagram. (2017). Available at: @mohamedsadaka109: #حريق_الزرايب. [online] [Accessed 10 Mar. 2026].

• Youtube.com. (2026). Available at: Prime Minister Netanyahu and Finance Minister Smotrich in a statement to the media [Accessed 11 Mar. 2026].

• Youtube.com. (2026). Available at: Scott Myers’ WTC Footage (Enhanced Video/Audio & Doubled FPS) [Accessed 11 Mar. 2026].

• INSS. (2026). Dashboard: The Military Campaign Against Iran | INSS. [online] [Accessed 11 Mar. 2026].

On the war’s first day, Iran’s Supreme Leader, Ayatollah Ali Khamenei was assassinated along with other key figures from his regime. While the initial attacks were concentrated in Iran and early retaliations targeted U.S. and Israel-related sites in the Middle East, the conflict quickly widened — with Israel focusing on Lebanon and Iran targeting Gulf states. The impact was soon felt in locations across the region and even further afield.

Just five days in, the impact of AI-generated content and false claims circulating on social media was already being keenly felt. False material was being shared as real, and real images were being incorrectly flagged as false.

US and Israeli attack on Iran unleashes flood of fakes

The accelerating quality of AI models and the proliferation of AI-generated material in recent months created the perfect conditions for any new war to become a key target for fake material, muddying the waters of what we can trust coming out of a conflict zone.

BBC Verify’s Shayan Sardarizadeh, who has been following and live-posting throughout the war to debunk fakes and verify real footage, said early on March 4 that “this war might have already broken the record for the highest number of AI-generated videos and images that have gone viral during a conflict”.

His daily threads compiling the war misinformation have covered aspects across the whole region. One viral clip claimed to show the aftermath of a drone attack on the U.S. embassy in Riyadh, Saudi Arabia, but in reality it showed an earlier, unrelated car accident in Riyadh. That clip was reshared by high-profile accounts, helping to further spread the false claim.

Even official accounts require close inspection, particularly in times of war. The official account for Israeli Prime Minister Benjamin Netanyahu posted a 72-second video on social media in which he appeared to speak Farsi, the official language of Iran.

In the clip, Netanyahu directly addressed the citizens of Iran, calling on them to soon “take to the streets” and “finish the job” of overthrowing the regime. The image was real, but the audio was AI-generated, VerificaRTVE found. Netanyahu doesn’t actually speak Farsi, and there are some errors with the lip-sync in the footage.

Many other Eurovision News Spotlight members have extensively covered the false content that has been spreading about this new war:

• franceinfo: Beware of fake images circulating about the war in the Middle East

• SRF: Fake news surrounding the Iran war

• VerificaRTVE: Fake news, photos and videos of the US and Israeli attack on Iran

• BBC Verify: Debunking AI fake images and disinformation about US-Israel war with Iran

• VRT nws: How badly was Dubai affected by Iranian attacks? The Burj Khalifa was not hit

Verifying deadly attack on school in Iran

Among the stories that sparked the biggest reaction of the first weekend of the war was the deadly attack on an elementary school in Iran, which killed at least 168 people, many of them children.

The school in Minab was the subject of three airstrikes, according to the town’s mayor cited in news reports. The outrage over the deaths at the school represented a flash point for anti-war activism in the U.S. The origin of the attack remains unknown and no party has yet claimed responsibility.

Collaboration between Eurovision News Spotlight members made geolocation of the school site possible. Satellite imagery of the area showed that the school is near two Revolutionary Guard buildings identifiable by signs in Farsi, Carlos Baraibar from 3Cat Info wrote. Eyewitness videos that were circulating after the attack allowed journalists to further confirm the area.

The incident also prompted misinformation, which in one case was even amplified by X’s built-in AI tool, Grok. For VerificaRTVE, Montserrat Rigall wrote about claims that RTVE and other news outlets had published a fake image to depict the destruction. The image was actually real, and contrary to claims, had no relation to a 2021 attack in Kabul, Afghanistan.

Social media users asking Grok to verify the image relied on its incorrect response that the image was old. “For hours, Grok insisted on its mistake and even called the media reports a hoax, while accepting messages from disinformation accounts that did not provide any evidence or rely on any source”.

Another fact-check published by Mario Pérez Galindo of VerificaRTVE highlighted a fake image of a blood-spattered schoolbag that was published by the Iranian embassy in Austria. Google’s SynthID detector tool confirmed that it was created with Google AI.

For VRT nws, Daan Nicolay, Tom Buytaert and Bram Vandendriessche compiled an article detailing a number of other instances of misinformation circulating about the attack, including a claim that Iran’s Revolutionary Guard took responsibility for the incident. No official source had made such a statement at that time. Many social media users also speculated that it would be unlikely for so many children to be at the school on a Saturday, but Saturday is indeed a school day in Iran.

Dubai fascination as UAE dragged into conflict

On Western social media feeds, there has been a particular focus on Dubai as it was sucked into the war via retaliatory Iranian strikes. The modern Emirati city is a major ‘expat’ hub and is home to hundreds of thousands of Europeans.

As the first strikes came down on Dubai, a wave of content spread online showing rockets hitting the Burj Khalifa and the airport burning. It was not immediately obvious which images were real.

For VRT nws, Bram Vandendriessche unpicked the web of videos. A terminal at Dubai airport was indeed struck, but some images were fake. A dramatic video of a rocket hitting the Burj Khalifa and causing a massive explosion was created using AI — “and clearly a slightly older AI model”, Vandendriessche writes. “The debris and smoke plume look like something out of a cartoon, and every element in the video is less detailed than in reality.” Adding to the confusion, there were also real videos circulating showing smoke near the skyscraper.

Eyewitness information coming out of the United Arab Emirates about the situation on the ground was unhelpful in quelling the confusion. We already knew that Dubai, which is a hotspot for influencers, had been affected by explosions, and tourists were sheltering in the parking garages of hotels due to nearby blasts. European governments were also arranging evacuation flights for citizens, illustrating the gravity of the situation.

Despite this, many Dubai influencers appeared to be posting the same message: that Dubai is safe and that people feel even safer there than they would at home in Europe. DW News covered the story, including the questions from outsiders about whether influencers were being paid for spreading a coordinated message.

Some well-known Germans were also posting to say that they had deleted material because they weren’t sure what they were ‘allowed’ to post. The UAE has strict rules on what people can publish on social media, and influencers in Dubai “must also follow strict content rules” and avoid posting content that could harm public order or the reputation of the state.

OSINT analysis shows war quickly expanding

After the initial strikes in Iran, the conflict quickly ballooned across the entire region. Amid fake videos and a difficulty in ascertaining the true impact, OSINT analysts were able to identify some of the early impacts, like a slowdown in oil tanker movements around the Strait of Hormuz and airspaces closing around the Middle East.

For RTÉ Clarity, Kate McDonald analysed satellite imagery released by Vantor which showed fresh damage linked to the escalating conflict. Images captured on March 2 showed damage at Iran’s Natanz nuclear facility, at drone facilities in western Iran, at Zahedan airbase in Iran, and at the Ras Tanura oil refinery in Saudi Arabia, among others.

With the true scale of the impact yet to be revealed, OSINT analysis is one of the most reliable ways for the outside world to understand how this war is unfolding, and what areas may be coming into focus as the conflict develops.

Fuelled by viral AI-generated videos thrusting therians into the spotlight, fears mount that far-right influencers are exploiting the sudden interest in this community that is rooted in a small Internet subculture in order to ridicule and discredit marginalised identities and bolster anti-gender rhetoric.

Mass anxieties about an Internet craze spur local action in Guatemala

In Latin America, a few influencers’ have helped propel the topic offline and into real life, making news headlines that spread as far as Spain and remote Guatemala. Their campaign have been fuelled by AI videos garnering millions of views.

TikTok and Instagram videos of young people walking on all fours in public spaces have gone viral and have raised concerns among some politicians. Some are asking whether this is an AI-generated phenomenon, pure fantasy exploited by far-right advocates or a wider disinformation campaign.

The noise around this small community has even raised concern in the remote city of Huehuetenango, in the highlands of western Guatemala, where local authorities published a statement on Facebook on Monday, February 23, prohibiting gatherings of therians in a public square. Concerned by breaches of moral codes, they warned that “activities, exhibitions or gatherings” require authorisation from the municipality, it said.

“In this regard, activities linked to groups identified as “Therian” or other demonstrations without the corresponding permit are prohibited,” the statement read.

“Actions that disturb public order or violate moral standards and good customs in Guatemala will not be permitted.”

The ban was mentioned in a TikTok video captioned “Therians have arrived in Guatemala” and featured alleged TV news reports about this small subculture in public spaces. Ominous clips boast similar captions in other countries such as “Therians have arrived in Spain”.

Fake accounts and AI manipulation distort outside perspective

In one instance, TikTok and Instagram accounts purporting to belong to a Colombian teenager called Emanuel shared a series of videos of therians crouching on all fours at a shopping mall, with captions reading: “Therians have arrived in Colombia”. In one clip viewed more than 22 million times, a woman shouts that therians frightened her dog. Aside from therian content, the account also posts videos of the boy cooking alongside a guinea pig wearing a sombrero, demonstrating the use of AI.

In several AI-generated videos of fake therian protests, shared on Instagram by an account called Jaranor Films describing itself as a digital content creator, Spanish police are seen arresting people wearing wolf and fox masks. In one such video (archived here), a woman wearing deer ears and makeup shouts at a police officer in Spanish, “Respect our rights, respect that we are animals”, before he sprays her eyes with an orange bottle. Several glitches, audio and visual inconsistencies – such as distorted text on a banner – appear in the videos, confirming they are AI-generated.

A text distortion on a banner in the background of one video purported to have been filmed in Spain is an evident sign of AI use.

What is not clear, however, is why these accounts have emerged now or who is behind it.

A trend made in Latin American social media… and moving into politics?

Spanish Member of the European Parliament Irene Montero, in a video posted last week, blamed Argentine President Javier Milei of politically engineering the Internet frenzy around therians. She said Milei was blowing up what is neither a widespread trend nor a cause for societal concern but simply a way to fuel hate speech against transgender people.

Remarks made by Milei in a 2023 interview resurfaced in recent weeks in which he discussed gender identity and said: “If you want to see yourself as a puma, that’s fine, in fact, I’ll call you a puma if you want, but don’t force it on me.”

His comments were picked up by alternatrive online news websites in Latin America and shared on social media with claims it was said as part of a recent public statement.

In Spain, Google searches for therians rose sharply last week, peaking on February 20, according to Google Trends. Worldwide data showed a clear Spanish-language trend, with therian-related searches spiking. The number of searches with the key terms “que es un therian” and “therian que es” (meaning, “what is a therian?”) rose by +1,350% in February, compared to the previous month.

Internet searches on Google in Spain for the key term “therian” over the past month. Source: Google Trends.

Internet searches on Google in Spain for the key term “therian” over the last five years. Source: Google Trends.

Internet searches on Google worldwide for the key term “therian” over the last five years. Source: Google Trends.

In Spain, a rally billed as planned by therians drew thousands of people in Barcelona though most appeared to be curiosity-seekers with some far-right activists from the Vox party also setting up tents nearby. Very few actually geared out in animal outfits turned up. Meanwhile, unverified reports claimed violent confrontations took place. All in all, the event stood out for the estimated 4,000 people that came out to laugh at the therians and film videos.

Do therians actually exist?

According to a sociological study, the term “therian” was first employed in the 1990s, with usage picking up more significantly in the early 2000s.

On Reddit, the forum “r/therians”, created in 2010, claims around 28 000 members, describing itself as “a friendly community support group for therians, otherkin, allies, and anyone else who wants to learn more about the subject of therianthropy and therians themselves”. Otherkin refers to those identifying as fantastical creatures such as vampires, werewolves and elves.

A moderator of the Subreddit forum last week posted about the news out of Latin America. “The social media focus on our therian siblings in South America is far from positive right now,” they wrote and described the group as a “safe space”. Noting an influx of new members, they warned users not to share their location or country of residence publicly.

One anonymous user wrote only last week: “It’s so hard now to find recent therian posts that isn’t from people who aren’t from the community”.

Backlash from transgender people

The sudden spotlight on therians has angered many within the LGBTQ community. Some transgender activists say that while they are harmless, therians should not compare themselves or identify as LGBTQ people, as they are a form of spirituality, rather than a gender identity.

“Therians are more of a new cultural identity or a form of spiritual identity, but they have no validity in psychology, medicine, anthropology, or any serious science,” Camila D. Aurora, a transgender influencer who discusses social issues on her channels, said in a video earlier this month.

For her, contrary to transgender individuals, therians have no psychological basis.

“They weren’t born this way; animal dysphoria doesn’t exist, nor does anything like that. And it’s very annoying when they say that if the identity of trans people is valid, then the identity of Therians is too.” By contrast, she said, transgender people have earned rights “because all the sciences that have studied us converge on our validity.”

Final thoughts

While people who identify as therians do seem to exist, the current focus on them in social media circles seems to be driven by AI and magnified beyond its actual scope by curious onlookers and those seeking to sow divisions by promoting ‘anti-woke’ narratives.

SOURCES

Baldwin, Clive; Ripley, Lauren. Available at: “Exploring Other-Than-Human Identity: A Narrative Approach to Otherkin, Therianthropes, and Vampires”. Qualitative Sociology Review: 2.

El Español (2026) Available at: La moda ‘therian’ llega a Castilla y León: jóvenes caminan a cuatro patas, ladran y se sienten animales. [Accessed 27 Feb. 2026].

Google Trends (n.d.) Available at: Search term: “therian” (Spain, past 30 days). [Accessed 27 Feb. 2026].

Instagram. (2017). Available at: Camila D. Aurora ☠️ on Instagram: ‘Que hay de los THERIAN? #therian #camiladaurora’. [Accessed 2 Mar. 2026].

Instagram. (2017). Available at: Jaranor Films on Instagram: ‘Manifestante podemos therian’. [online] [Accessed 2 Mar. 2026].

Instagram. (2017). Available at: Jaranor Films on Instagram: ‘Unidad canina de Policía captura a therian y es enjaulada’. [online] [Accessed 2 Mar. 2026].

Instagram. (2017). Available at: Jaranor Films on Instagram: ‘Policía Nacional unidad canina captura Therian’. [online] [Accessed 2 Mar. 2026].

Instagram. (2017). Available at: Jaranor Films on Instagram: ‘Perro ataca a therian’. [online] [Accessed 2 Mar. 2026].

Instagram. (2017). Available at: AJ+ Español on Instagram: ‘Ser therian y ser persona trans no son experiencias comparables.⁣ #Otherkin #Identidades #Subcultura⁣ ⁣’. [online] [Accessed 2 Mar. 2026].

Reddit (n.d.) Available at: Hello i wanna talk in details about what make… [Accessed 27 Feb. 2026].

Reddit (n.d.) Available at: I think im a therian.[Accessed 27 Feb. 2026].

Reddit (n.d.) Available at: I told her im a therian. [Accessed 27 Feb. 2026].

Reddit (n.d.) Available at: Its so hard now to find recent therian posts that… [Accessed 27 Feb. 2026].

Reddit (n.d.) Available at: My 11 yo told me she is a therian by handing me… [Accessed 27 Feb. 2026].

Reddit (n.d.) Available at: My sister came out to me as a therian. [Accessed 27 Feb. 2026].

Reddit (n.d.) Available at: Recent news from Latin America and how that… [Accessed 27 Feb. 2026].

Reddit (n.d.) Available at: What do u think caused ur therian identity? [Accessed 27 Feb. 2026].

Reddit (n.d.) Available at: What do u think caused ur therian identity? [Accessed 27 Feb. 2026].

Therian Wilderness Forum (n.d.) Available at: Therian Wilderness. [Accessed 27 Feb. 2026].

Youtube.com. (2026). Available at: ALTERCADOS EN ENCUENTRO «THERIAN» EN BARCELONA [Accessed 27 Feb. 2026].

However, the constant stream of news coming out of Milano-Cortina also includes AI-generated images and misleading claims, creating viral misinformation narratives around the event.

Ukrainian athletes among the most targeted by false claims

Social media users have been sharing posts (archived here and here) containing pictures purportedly showing Hungarian cross-country skiing athlete, Adam Konya, waving with a sticker on his glove reading “WE’RE ALL FED UP WITH ‘U’”.

Users claimed that Konya’s gesture was a stance against Ukrainian athletes that showed solidarity with skeleton athlete Vladyslav Heraskevych, who was disqualified after wearing a helmet honoring dead compatriots.

However, the images were detected via SynthID as being partially digitally manipulated. Some evidence includes the text on the glove appearing very sharp and lacking natural distortion and the tape looking digitally overlaid rather than physically attached to the glove.

A Google Lens reverse search revealed that the original photo was shared on the official Team Hungary Facebook page. The picture was taken during a cross-country ski competition on February 8, in Tesero, and features Konya waving and showing the glove without the sticker.

Another video (archived here) featuring CBC News chief correspondent Adrienne Arsenault became viral on social media after being altered with AI, spreading misinformation about Ukrainian athletes at the Olympic village.

For example, X user @provemewrong411 shared the video on February 12, garnering over 62,000 views and with the caption, “Ukrainian athletes in Milan were placed as far away as possible from other participants. According to reports attributed to the Canadian TV channel, Ukrainian athletes at the Olympics were deliberately accommodated separately from others. This decision was reportedly made because Ukrainian athletes behaved inappropriately and caused conflicts with other athletes at the previous Olympic Games in Paris”.

CBC’s fact-check team published a debunk on this claim explaining how, 16 seconds into the video, the original clip was replaced by an AI-generated one, as confirmed by comparing the manipulated video with the original one posted on the CBC News official TikTok account on February 4.

Moreover, there are no reports or statements suggesting that Ukrainian athletes were accused of misbehavior during the 2024 Paris Olympics.

AI-generated Russian flags at the Olympics

Italian X user @SAntonio10273 posted an image (archived here) on February 10, purportedly showing a woman in the stands at the Olympics, holding a large Russian flag, with the caption, “Russia has finally arrived at the Olympics in Italy”.

The image was detected via SynthID as being made or manipulated with Google AI software.

Russian and Belarusian athletes are competing in the 2026 Winter Olympics as Individual Neutral Athletes (AIN) without national flags, symbols, or uniforms, and utilizing the AIN’s flag and anthem. Moreover, the International Olympic Committee has banned the Russian flag at the 2026 Olympic Games.

A skier was misrepresented as a Princess campaigning against the U.S.

Social media users also shared a picture (archived here) of Swedish skier Frida Karlsson, currently involved in the Winter Olympics, falsely claiming it showed Swedish Princess Frida.

For example, X user @drhossamsamy65, shared the picture (archived here) on February 8, 2026, with the caption, “Swedish Princess Frida, calls trump a Psyco creep, and that Europe should ban all American products. She also invites Canada to join the EU”. The picture had garnered over 77,000 views as of February 16.

There is no record that Karlsson made comments on Trump or on Canada joining the EU. Moreover, on the official site of the Swedish Royal Court there is no record of a princess called Frida.

SOURCES

CBC. (2026). Available at: Fact check: Fake CBC video on Ukrainian athletes at Olympics. [online] [Accessed 16 Feb. 2026].

Facebook.com. (2016). Facebook. [online] Available at: Team Hungary [Accessed 16 Feb. 2026].

Tiktok.com. (2026). TikTok [online] Available at: Team Canada’s home [Accessed 16 Feb. 2026].

Olympics.com. (2025). Available at: Individual Neutral Athletes to compete at Milano Cortina 2026 Olympic Winter Games under same conditions as for Paris 2024. [online] [Accessed 16 Feb. 2026].

Instagram.com. (2017). Available at: Frida Karlsson (@fridakarlsson) • Instagram photos and videos. [online] [Accessed 16 Feb. 2026].

Kungahuset.se. (2016). Available at: Royal House. [online] [Accessed 16 Feb. 2026].

X (formerly Twitter). (2026). Available at: Lo sciatore ungherese Adam Konya [Accessed 16 Feb. 2026].

X (formerly Twitter). (2026). Available at: A magyar sífutó, Kónya Ádám [Accessed 16 Feb. 2026].

X (formerly Twitter). (2026). Available at: Absolutely everyone has had enough of the Ukranazis. [Accessed 16 Feb. 2026].

X (formerly Twitter). (2026). Available at: .. 𝗢𝗟𝗜𝗠𝗣𝗜𝗔𝗗𝗜 𝗜𝗡𝗩𝗘𝗥𝗡𝗔𝗟𝗜 𝗠𝗜𝗟𝗔𝗡𝗢 𝗖𝗢𝗥𝗧𝗜𝗡𝗔 𝟮𝟬𝟮𝟲. [Accessed 16 Feb. 2026].

X (formerly Twitter). (2026). Available at: Swedish Princess Frida, calls trump [Accessed 16 Feb. 2026].

X (formerly Twitter). (2026). Available at: Swedish Princess Frida, calls [Accessed 16 Feb. 2026].

‌

‌

‌

‌‌

‌

‌

‌

‌

‌

‌

⚡ The 30-second brief

• The debunk: Forensic analysis confirms viral images of Zohran Mamdani and Mira Nair with Jeffrey Epstein are AI-generated deepfakes originally posted by a parody account.

• New tech: A new AI-powered tool designed to detect and alert users to malicious, manipulated content across major social platforms.

• The intelligence stack: Using Overpass Turbo to filter and find specific landmarks or infrastructure around the world.

🔦 In the Spotlight

• Fact-check: The release of a new tranche of files related to convicted paedophile Jeffrey Epstein sparked an avalanche of social media discussion that brought with it plenty of misinformation. Fakes included images of a young Zohran Mamdani with his mother in the company of the financier, as well as doctored email screenshots purportedly between Elon Musk and Ghislaine Maxwell. BBC Verify tracked the story in its live coverage.

• Monitoring: We covered the rising tensions between the U.S. and Iran last week, but the situation ramped up further on Tuesday when the U.S. shot down an Iranian drone that it said was approaching the USS Abraham Lincoln in the Arabian Sea. See our OSINT guide for tips on how to follow this story.

🖋️ The Lead: AI-generated images fabricate Epstein connection

In the wake of the latest release of Jeffrey Epstein documents, viral images surfaced appearing to show New York City Mayor Zohran Mamdani and his mother, director Mira Nair, alongside Epstein. However, forensic analysis by VRT NWS, BBC Verify, and France24 confirmed these images are AI-generated deepfakes.

Key Findings

• Source of disinformation: The images feature a “DFF” watermark, traced to the X account @DumbFckFinder, a self-described parody profile that shares AI memes. Despite their satirical origin, the images are being weaponized by political opponents. (VRT)

• Technical verification: Using Google’s tool confirmed that the images were generated using its AI models. No authentic photographs of Mamdani or Nair with Epstein exist in the official case files. (Shayan Sardarizadeh)

• The grain of truth: Mira Nair’s name appears only once in the millions of released pages—not as a co-conspirator, but in a 2009 email regarding a film afterparty for Amelia. There is no evidence of a personal relationship or meeting. (France 24)

Epstein file resources

📍Epstein Library | United States Department of Justice: The website is a repository of millions of documents, images, and videos collected by the FBI and DOJ over decades of investigations.

📍FBI Records: The Vault — Jeffrey Epstein: A repository of declassified and released documents concerning Jeffrey Epstein.

📍Jmail: A website simulating the user interface of Jeffrey Epstein’s inbox and Drive in a searchable format.

— Maria and Derek

⚙️ The intelligence stack

🔍 Overpass turbo
While many journalists use basic satellite imagery, Overpass Turbo allows for a "query-based" approach to geolocation that is essential for verifying footage from conflict zones or remote areas where landmarks are sparse.

Instead of manually scanning Google Earth, you can use a simple script to find the exact intersection of specific features (e.g., a “mosque” within 100 meters of a “pharmacy” and a “school”).

How to use it:

• Go to overpass-turbo.eu.

• Type a query like:

/*
This query looks for surveillance cameras 
within 50m of a supermarket.
*/
[out:json][timeout:25];

// 1. Find all supermarkets in the current map view
node["shop"="supermarket"]({{bbox}})->.supermarkets;

// 2. Find surveillance cameras near those supermarkets
node(around.supermarkets:50)["man_made"="surveillance"]->.cameras;

// 3. Output the results
(.cameras;);
out body;
>;
out skel qt;

This script searches for all surveillance cameras (man_made=surveillance) located within 50 meters of a supermarket (shop=supermarket). This is highly effective for locating potential CCTV sources for a specific incident.

• Zoom into your target city and hit Run.

💡 Quick tip: If you find the manual Overpass QL code too cumbersome to write, the Wizard is your best friend. The Wizard translates “human-readable” terms into functional queries so you don’t have to worry about brackets or semicolons.

📍GEOINT: Learn how to turn satellite imagery into an empirical audit trail (Eurovision News Spotlight)

📍Satellite metadata: An OpenC3 COSMOS plugin for tracking satellites using the KeepTrack Space API. This plugin provides real-time satellite position tracking and orbital element data. (Clay Genki Kramp)

📍Temporal Analysis Engine: Extract and visualize temporal metadata from any URL. Discover creation dates, modification history, and hidden timestamps. (Roelof T.)

📍Company OSINT: The Coalition of Cyber Investigators discuss some of the ways that OSINT can help manage the risk of blind spots when you have operations in less mature markets. (Coalition of Cyber Investigators)

📍Deepfake Guard: New AI-powered tool designed to detect and alert users to malicious, manipulated content across major social platforms (Avast)

📍OSINT at home: 6 free satellite imagery tools every investigator should know ()

📍U.S. Armada: An OSINT intelligence guide to the naval build-up near Iran (Eurovision News Spotlight)

📍Reconya: Real-time network device discovery and monitoring ()

📡 Signal analysis

In the 15th edition of the Spotlight Review, EBU members joined Maria Flannery to discuss the long-running problem of scam advertisements running on Facebook and the difficulties in verifying content from Iran’s recent protest movement.

Tim Verheyden (VRT) discussed a recent documentary that aired on the Belgian broadcaster’s investigative Pano programme, detailing a Europe-wide problem of industrialised scamming that has seen victims lose out on hundreds of thousands of euro.

Eva Wackenreuther (ORF) detailed how their investigation began in Austria after one of their newscasters was the subject of a deepfake ad on Facebook.

Before we go…

AI unlocks hundreds of cosmic anomalies in Hubble archive

Astronomers using an AI-assisted tool called AnomalyMatch discovered a "hamburger-shaped" planet-forming disk in the Hubble Archive. It's a classic example of automated anomaly detection surfacing something humans missed for 35 years because we weren't looking for "fast food" in deep space.

1. Introduction and context

Satellite imagery has become one of the most powerful tools in any investigative journalist’s arsenal. Whether documenting the expansion of illegal mining in the Amazon, tracking the growth of detention camps, or verifying the destruction of civilian infrastructure in conflict zones, geospatial intelligence (GEOINT) provides an empirical eye in the sky that is difficult for governments or corporations to refute.

🔍 1.1. The investigative need

Traditional reporting often relies on witness testimony or leaked documents, both of which can be challenged. Satellite imagery provides objective, time-stamped physical evidence. It allows journalists to monitor remote or hostile locations where ground access is impossible, providing a longitudinal view of change that reveals patterns of intent and impact over months or years.

1.2. Learning outcomes

• Master multi-platform integration: Combine Google Earth Pro’s historical archives with Sentinel Hub’s multispectral data.

• Conduct temporal analysis: Identify and document physical changes over specific timeframes.

• Verify ground truth: Cross-reference satellite visual data with OpenStreetMap (OSM) vector data for naming and functional identification.

• Maintain evidentiary standards: Create a verifiable audit trail of geospatial findings for publication.

1.3. Case study hook

Imagine investigating an industrial “buffer zone” where residents claim a factory is encroaching on protected wetlands. By layering 2015 imagery over 2025 data, a journalist can calculate the exact square footage of lost vegetation and pinpoint the date construction began, even if official records are missing or altered.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• Optical vs. multispectral imagery: Optical imagery is what the human eye sees (RGB); multispectral imagery captures wavelengths such as infrared, useful for detecting healthy vegetation or heat signatures.

• Spatial resolution: The detail level (e.g., 30cm/pixel in high-res vs. 10m/pixel in Sentinel).

• Temporal resolution: How often a satellite captures an image of the same spot.

• Orthorectification: The process of removing geometric distortions caused by terrain and camera tilt to ensure the map is “flat” and measurable.

⚖️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy

While satellite imagery captures public spaces, journalists should exercise caution when zooming into private residences. The “stop at the login” rule in GEOINT applies to attempts to access private, non-commercial surveillance feeds or other hacked footage. Stick to commercially available or public-domain orbital data.

2.2.2. Legal considerations

Publicly disseminating high-resolution imagery of sensitive military installations may violate national security laws in certain jurisdictions.

🛑 Disclaimer: This tutorial is for educational purposes. Always consult with your newsroom’s legal department before publishing imagery that could be deemed “classified” by a nation or when navigating copyright licenses of commercial imagery providers like Vantor (formerly Maxar) or Planet.

🛠️ 3. Applied methodology: step-by-step practical implementation

3.1. Required tools & setup

• Google Earth Pro (Desktop): Essential for its “Historical Imagery” slider.

• Sentinel Hub/EO Browser: For free, weekly updates at lower resolution but high spectral variety.

• OpenStreetMap (OSM): To identify buildings, roads, and land use designations.

• QGIS (Optional): For advanced layering and professional cartography.

👷‍♀️ 3.2. Practical execution (The “How”)

Scenario 1: Auditing illegal land clearing

1. Locate the target: Enter coordinates into Google Earth Pro.

2. Activate history: Click the “Clock” icon in the top toolbar to reveal the timeline slider.

3. Compare eras: Move the slider to the earliest available high-res date (e.g., 2010) and the most recent (2024).

4. Spectral verification: Open Sentinel Hub EO Browser for the same coordinates to check the NDVI (Normalized Difference Vegetation Index). A drop in NDVI confirms the “green” seen in old photos is gone, ruling out seasonal changes.

Investigative query table

💾 3.3. Data preservation and chain of custody

To ensure your evidence holds up in court or a formal rebuttal:

1. Capture metadata: Always take a screenshot of the entire interface, including the coordinates, capture date, and satellite provider (e.g., “Image © 2024 Airbus”).

2. Log the source: Record the exact URL and sensor ID (e.g., Sentinel-2 L2A).

3. Hash the files: Once you save your final comparison image, generate a SHA-256 hash immediately.

   • Command (Mac/Linux): shasum -a 256 image.png

   • Windows: CertUtil -hashfile image.png SHA256

4. Archive: Save the original files in a “Write-Once” environment or a secured cloud drive with version history.

🧠 4. Verification and analysis for reporting

4.1. Corroboration strategy

Never rely on a single image. Cross-reference your satellite findings with:

• Ground-level imagery: Use Mapillary or Google Street View to see if the “white box” on the satellite is indeed a warehouse.

• Social media geolocated posts: Search for Instagram or TikTok posts from that coordinate to find video evidence from eyewitnesses.

4.2. Linking data to narrative

🤖 4.3. AI assistance in analysis

Journalists can use AI/LLMs to parse large amounts of metadata or caption text associated with imagery:

• Entity extraction: Use AI to cluster and identify key dates and infrastructure types across dozens of imagery logs.

• Multimodal analysis: For more advanced workflows, refer to the framework in The OSINT prompt for AI-powered image geolocation by Spotlight, which details how to structure prompts to assist in place identification while maintaining investigative diligence.

• Translation: Use LLMs to translate local land-use permits or planning documents obtained from foreign government portals.

⚠️ Warning: AI can “hallucinate” geographical facts. Never ask an LLM to “tell you what is in this satellite image” and use the result as your primary fact. AI may misidentify a shadow as a building or a cloud as a smoke plume. Human verification of every pixel is vital.

🚀 5. Practice and resources

5.1. Practice exercise

The challenge: Locate the “Tesla Gigafactory Berlin-Brandenburg” in Google Earth Pro. Use the historical slider to find the exact month that major forest clearing began. Use OpenStreetMap to identify which water bodies may have been affected by the nearby construction.

5.2. Advanced resources

• Global Forest Watch: An essential tool for monitoring real-time deforestation alerts and historical tree cover loss using Landsat and Sentinel data.

• SkyTruth: Specializes in using satellite imagery to track environmental incidents, such as oil spills and illegal mining, often providing expert-verified datasets.

• Google Earth Engine: For large-scale planetary data analysis and processing of multi-petabyte geospatial datasets.

• Sentinel Hub EO Browser: Free access to multispectral satellite data with pre-built visualization scripts (NDVI, False Color, etc.).

• Vantor: A professional geospatial platform for advanced asset monitoring and risk assessment, useful for enterprise-level investigative tracking.

• Spotlight tutorials: Repository for the latest AI-assisted OSINT techniques and prompt engineering for journalists.

✅ 6. Key takeaways and investigative principles

• Context is king: A change in the landscape is only an investigation if you can link it to a person, company, or policy.

• Trust but verify: Use multispectral data (such as infrared) to confirm what your eyes see in RGB.

• Historical depth: Always look back at least 5-10 years to understand the land's natural state.

• Chain of custody: An image without a timestamp, coordinate, and hash is just a picture, not evidence.

• Resolution awareness: Understand the limits of your data; don’t over-interpret a blurry pixel.

👁️ Coming next week…

Tracking aviation and maritime assets

Using open-source trackers (e.g., FlightRadar24, MarineTraffic) to track aircraft and ships. Cross-referencing live transponder data with ownership registries to expose the movement and identity of global aviation and maritime assets.

U.S. President Donald Trump announced this week that a “massive armada” was heading to Iran. It came amid threats that he would use military power against the Iranian regime, which is currently violently cracking down on a protest movement that began late last year.

In a post on Truth Social on Wednesday, January 28, Trump said: “A massive Armada is heading to Iran. It is moving quickly, with great power, enthusiasm, and purpose. It is a larger fleet, headed by the great Aircraft Carrier Abraham Lincoln, than that sent to Venezuela.”

The USS Abraham Lincoln is a Nimitz-class ‘supercarrier’, which can carry up to 90 aircraft (warplanes and helicopters) and has an unlimited range due to the fact that it is nuclear-powered.

The carrier strike group, led by the USS Lincoln but including a number of other ships like guided-missile destroyers, is “currently deployed to the Middle East to promote regional security and stability”, according to U.S. Central Command in a post on January 26.

Among the vessels travelling with the USS Abraham Lincoln are the USS Spruance, the USS Frank E. Petersen Jr., and the USS Michael Murphy.

As tensions between the U.S. and Iran rise and bring the looming threat of a sudden escalation, this comprehensive intelligence guide provides hyperlinked tools and technical data required for an OSINT investigation.

1. Battle card

A. US naval & air strike force (CSG-3)

• Flagship: USS Abraham Lincoln (CVN-72) – Confirmed operating in the Arabian Sea as of January 26.

• Carrier Air Wing 9 (CVW-9): Includes F-35C Lightning II (VMFA-314) and EA-18G Growler (Electronic Jamming).

• Escort Fleet (DESRON 21):

  • USS Frank E. Petersen Jr. (DDG-121): Acting as Air Defense Commander; conducted live-fire exercises January 23.

  • USS Spruance (DDG-111): Screening destroyer in the Arabian Sea.

  • USS Michael Murphy (DDG-112): Part of CSG-3 strike force.

  • USS Delbert D. Black (DDG-119): Update January 30: Crossed into the Red Sea January 29; positioned near Eilat.

• Support: EA-37B Compass Call II (Serial 17-5579) deployed for high-end electronic suppression.

B. Iranian counter-measures

• IRIS Shahid Bagheri: Iran’s “Drone Carrier” (C110-4) anchored ~5 km south of Bandar Abbas as of January 27.

• IRINS Makran: Forward base ship positioned to support asymmetric drone/missile swarms.

2. Real-time monitoring dashboard

3. Technical identifiers: CSG-3 strike force

Vessels often disable AIS, but their embarked aviation assets (Seahawks/Ospreys) transmit hex codes.

A. Surface combatant identifiers

B. High-interest ICAO Hex codes (CVW-9)

• Stealth strike (F-35C): AE648A through AE649F (VMFA-314).

• Electronic warfare (EA-18G): AE4E5D, AE4E62 (VAQ-133).

• Carrier early warning (E-2D): AE5B34, AE5B35, AE5B37 (VAW-117).

• Logistics (CMV-22B): AE633E, AE634A (The “Mailmen” revealing carrier position).

4. Import ready: Potential target watchlist

Save as a .CSV file and import into Google Earth Pro.

Name,Latitude,Longitude,Description,Category
Natanz_Pickaxe_Mtn,33.7250,51.7250,New southern site (Kolang Gaz La); fortified Jan 2026,Nuclear
Fordow_Plant,34.8842,50.9981,Subterranean enrichment site deep in mountain,Nuclear
Isfahan_UCF,32.6500,51.6667,Uranium Conversion Facility; targeted in June 2025,Nuclear
Mehrabad_Base,35.6892,51.3134,IRGC Air Logistics Hub; F-14 station,Military
Bandar_Abbas,27.0603,56.1282,Naval/Drone Hub; current Shahid Bagheri anchor point,Military
Parchin_Taleghan_2,35.5333,51.7519,Site being encased in concrete "sarcophagus" (Jan 24),Military
Khorramabad_Silos,33.5813,48.1815,Imam Ali Missile Base; underground silo cluster,Military

5. Farsi investigative directory (Dorks)

Accidental explosions:

site:irna.ir OR site:farsnews.ir "انفجار" OR "حادثه" after:2026-01-25

Air defense drills:

site:isna.ir "رزمایش" OR "تست پدافند" after:2026-01-29

GPS/signal disturbance:

intext:"اختلال جی‌پی‌اس" OR "سیگنال" site:ict.gov.ir

6. Digital forensics and verification

• Chronolocation (SunCalc): On January 30, shadows in Tehran must be long and point north-east. Noon solar altitude: ~28.3°.

• Keyframe Analysis (InVID & WeVerify): Used to detect recycled footage from the June 2025 “12-Day War.”

• Thermal Confirmation: Cross-reference any reports with NASA FIRMS to detect thermal anomalies at nuclear/military coordinates.

A. Primary source intelligence (Social & Messaging)

• Telegram monitoring: Utilize TGStat or Telemetr to scrape hyper-local district channels. Focus on “neighbourhood-watch” metadata over state-run narratives.

• Censorship circumvention: Cross-reference NetBlocks and Cloudflare Radar to identify regional connectivity drops in cities like Isfahan or Karaj.

• Verification of ‘old’ footage: Use Google Lens to fragment video keyframes for reverse-image searching against historical archives.

B. Geospatial verification

• Shadow analysis (Chronolocation): Calculate time/date via SunCalc or use PeakVisor to align mountain silhouettes with video backgrounds.

• Industrial/nuclear markers: Monitor Natanz and Fordow for geological changes.

• Commercial imagery: Access Planet Labs (3m resolution) or Sentinel Hub EO Browser for post-strike burn scars or thermal anomalies.

Below is the specialised JavaScript Evalscript (Version 3) designed for the Sentinel Hub EO Browser. This script isolates high-heat signatures (potential strikes or facility vent surges) and flags physical terrain changes (burn scars or new spoil piles).

// VERSION=3
// Operational ARMADA: Thermal Anomaly & Burn Scar Detector
// Purpose: Identify high-heat vent signatures and structural damage

function setup() {
  return {
    input: ["B02", "B03", "B04", "B08", "B11", "B12", "dataMask"],
    output: { bands: 3 }
  };
}

function evaluatePixel(sample) {
  // 1. Normalized Burn Ratio (NBR) for surface scarring
  let nbr = (sample.B08 - sample.B12) / (sample.B08 + sample.B12);
  
  // 2. SWIR Intensity for Active Heat (B12 & B11)
  // These bands are highly sensitive to high-temperature thermal anomalies
  let heatIntensity = (sample.B12 + sample.B11) / 2;
  
  // 3. Logic: If SWIR (heat) is high, highlight in vivid RED/ORANGE
  // Thresholds calibrated for 2026 winter-arid Iranian desert conditions
  if (sample.B12 > 0.4 && sample.B11 > 0.35) {
      return [1, 0.2, 0]; // Active Thermal Anomaly (Vivid Orange)
  }
  
  // 4. Logic: If NBR is significantly low, color dark BROWN (Fresh Burn/Spoil)
  if (nbr < -0.2) {
      return [0.4, 0.2, 0.1]; // Surface Scarring
  }

  // 5. Default: False Color (B12, B11, B04) for structural clarity
  // Good for spotting new concrete or excavation patterns
  let val = [2.5 * sample.B12, 2.5 * sample.B11, 2.5 * sample.B04];
  return val;
}

C. Technical lead: Asset tracking

• Aviation: Track unlisted military movement via ADS-B Exchange (filtering for “blocked” or “UHB” signals).

• Maritime: Monitor “dark” vessels in the Strait of Hormuz using MarineTraffic or VesselFinder.

• Bunker buster assessment: Apply the Sandia Penetration Equation to estimate the effectiveness of munitions such as the GBU-57 MOP against Iranian limestone or reinforced concrete.

D. Investigative red flags

• Thermal hotspots: Map “gas cylinder explosion” denials against NASA FIRMS (Fire Information for Resource Management System) to confirm high-temperature anomalies at military coordinates.

• Official narrative tracking: Compare real-time reports against IRNA (Islamic Republic News Agency) and Fars News to identify “routine drill” patterns.

7. B-Roll & visual verification guide

Priority: Distinguish between current ‘Armada’ manoeuvres and archived footage from the June 2025 12-Day War.

A. High-probability ‘zombie’ footage (Flags)

The following clips are currently circulating on Telegram/X but are NOT from January 30, 2026. Flag these if seen in newsroom feeds:

• “Carrier in the Strait”: Footage of a carrier passing a rocky coastline with green vegetation. (Likely 2019/2021 transit; January 2026 conditions are arid/hazy).

• “Isfahan explosions”: Night-vision footage showing orange sky-bursts. (Confirmed as June 2025 AD drills over the UCF).

• “F-35 launch”: Clips from USS Carl Vinson (CVN-70). (Verify hull number 72 on the flight deck for the Lincoln).

B. OSINT geolocation lead: “The Armada”

If footage emerges of the U.S. fleet from the Iranian coast, use these landmarks for triangulation:

• Hormuz Island: Distinctive red soil/cliffs. If visible in the background of Iranian fast-boat footage, the vessel is within 12nm of the coast.

• Musandam Peninsula: If Omani mountain peaks are visible to the South, the fleet is in the Strait of Hormuz traffic separation scheme.

Sources

• ADS-B Exchange (2026) Aviation tracking and hex code database (Accessed: 30 January 2026).

• Bowler, D., Flannery, M. and Aminolahi, M. (2026) ‘How to decode Iranian state media: A field guide for newsrooms and OSINT researchers’, The Agile Newsroom [Substack], 12 January (Accessed: 30 January 2026).

• Cloudflare (2026) Cloudflare Radar: Iran Connectivity and Traffic (Accessed: 30 January 2026).

• InVID & WeVerify (2026) InVID & WeVerify verification plugin [Software] (Accessed: 30 January 2026).

• MarineTraffic (2026) Maritime vessel tracking: Strait of Hormuz (Accessed: 30 January 2026).

• NASA FIRMS (2026) Fire Information for Resource Management System: Thermal anomalies Iran (Accessed: 30 January 2026).

• NetBlocks (2026) Internet governance and connectivity tracking: Iran (Accessed: 30 January 2026).

• Planet Labs (2026) Planet Explorer: High-resolution satellite imagery (Accessed: 30 January 2026).

• Sentinel Hub (2026) EO Browser: Multi-spectral satellite monitoring (Accessed: 30 January 2026).

• SunCalc (2026) SunCalc: Sunlight phases and shadow analysis for Tehran (Accessed: 30 January 2026).

• TGStat (2026) Telegram channel analytics and scraping tool (Accessed: 30 January 2026).

Tim Verheyden (VRT) discussed a recent documentary that aired on the Belgian broadcaster’s investigative Pano programme, detailing a Europe-wide problem of industrialised scamming that has seen victims lose out on hundreds of thousands of euro. The investigation led them to Serbia, where a whistleblower from a call centre detailed the system behind these deceptive AI ads.

(ORF) detailed how their investigation began in Austria, when one of their own newscasters was the subject of a deepfake ad on Facebook. Further investigation revealed a wide network of bot accounts running ads around Europe in different languages to sell bogus supplements and medication, localised with regional trusted news presenters and national versions of a ‘doctor’ advising patients on topics like Covid-19. While some of these ads were taken down, many remain online to this day.

The EBU’s advised members on how to monitor and verify events in Iran, where a nationwide protest movement starting in late 2025 was stalled by an unprecedented government crackdown, the full impact of which is still unknown. As well as a case study detailing how she verified scenes at an overflowing morgue in Tehran, she also gave practical tips and resources to monitor Iran, which is experiencing a nationwide internet blackout that has hampered efforts to report on the country.

Upcoming Spotlight Reviews

• February 26, 2026 - 11 CET

• March 26, 2026 - 11 CET

• April 30, 2026 - 11 CET

• May 28, 2026 - 11 CET

• June 25, 2026 - 11 CET

If you would like to participate as a speaker in an upcoming Spotlight Fact-Check & OSINT Review, please email bowler@ebu.ch.

⚡ The 30-second brief

• The debunk: Sync-verification of eyewitness footage in Minneapolis refuted “domestic terror” claims, proving Alex Pretti was holding a phone, not a weapon, when shot.

• New tech: Emerging research into “collaborative malicious AI agents” reveals how automated swarms now coordinate to fabricate social consensus in real-time.

• OSINT stack: Bypassing Telegram’s search friction using Google Dorks (site:t.me) to extract cached messages and hidden forensic leads.

🔦 In the Spotlight

• Fact-check: Spotlight members were swiftly working to verify different angles of the shooting of Alex Pretti on a Minneapolis street in broad daylight on Saturday. Read a full breakdown by Spain’s RTVE and watch a TV segment by BBC Verify. And while much of the circulating material was real, there were also AI-retouched images being shared. Read more by SRF and 3CatInfo, or listen to this ORF report (German).

• Monitoring: The internet blackout in Iran was still hampering Iranians’ efforts to get videos online, and many of what did emerge showed the scenes in early January when the government began a brutal crackdown. Spotlight members have been looking for new material to help us understand what is happening inside the country, where rights group HRANA is reporting that it has confirmed over 6,000 deaths. They are still investigating a potential 17,000 more deaths.

🖋️ The Lead: Video verification at heart of U.S. ‘inflection point’

The shooting dead of an American citizen by federal agents in Minneapolis at the weekend further stoked anger in the city and sparked outrage across the U.S. Alex Pretti, a 37-year-old nurse, was killed during a confrontation between immigration agents and civilians.

Secretary of Homeland Security, Kristi Noem, accused Pretti of “domestic terrorism”. Other discourse, including from Noem, centred around claims that Pretti brandished a weapon and was about to attack officers. It quickly emerged that Pretti was a legal gun-owner in a state where carrying such weapons is allowed.

Crucially, the video evidence did not back up the ‘domestic terror’ claims. Spotlight members verified multiple clips from the scene, showing Alex Pretti filming with his phone in his hand. After being tackled to the ground, an officer appears to pull Pretti’s gun from his waistband, removing the civilian’s gun from the altercation. Then, Pretti is shot in the back; ten shots ring out in a five-second video.

The result was what Governor Tim Walz called an “inflection point” for America. Now, the U.S. administration has indicated that it may change course in Minnesota, less than three weeks after the killing of Renee Good, a case in which swift video verification also played a key role.

— Maria

⚙️ The intelligence stack

🔍 Advanced search operators for Telegram
Telegram’s native search is notoriously limited, often hiding critical eyewitness media or niche channels from direct view.

💡 Quick tip: When investigating breaking news or monitoring extremist groups, don’t rely on the app’s internal search. Instead, use a targeted dork on a search engine to surface messages, files, and channel invites that haven’t been indexed elsewhere.

The Syntax: site:t.me "keyword" - "view in telegram"

• Why it works: By excluding the phrase “view in telegram,” you filter out the standard channel landing pages and force the search engine to index the actual message content and preview text.

• The OSINT Edge: This approach often reveals “private” channel links or deleted message previews that are still cached in search engine results.

📍Forensic smartphone verification: Master the "zoom-in" lens to reconstruct high-stakes use-of-force events (Nieman Lab)

📍Automated fact-checking: Implementing Google APIs and ClaimReview schema to accelerate OSINT workflows (via Eurovision News Spotlight)

📍Countering AI bot swarms: Forensic strategies for detecting "collaborative malicious AI agents" designed to mimic human consensus (The Guardian)

📍Cross-platform identity stitching: Linking accounts via photo reuse and username structures (ShadowDragon)

📍Climate misinformation forensics: Technical requirements of the new EU Declaration on deceptive climate change narratives (European Commission)

📡 Signal analysis

OSINT Industries has published a new case study detailing how investigators used OSINT and social media footprinting to intercept a tiger cub trafficked for illegal sale.

This investigation provides a rare, technical look at how digital forensics can be applied to wildlife crime, using real-time intelligence to trace supply chains and unmask the coordinators of high-value animal trafficking networks. (via OSINT Industries)

Before we go…

Schweizer Radio und Fernsehen (SRF) is hosting a dedicated “Fact or Fake?” theme week from January 26 to 30, 2026, with reports, investigations, and fact checks on current issues in politics, business, and society.

The broadcaster is inviting the public to submit suspicious media via WhatsApp or web forms for expert verification and investigative reporting.

1. Introduction and context

The speed of disinformation campaigns often outpaces traditional reporting cycles. For investigative journalists, the ability to rapidly identify whether a viral claim has already been debunked or to ensure their own investigations are discoverable by global fact-checking databases is becoming increasingly important. Automated fact-checking tools act as a “force multiplier,” allowing newsrooms to scan thousands of claims against verified databases in seconds.

🔍 1.1. The investigative need

In the early stages of breaking news, recycled misinformation is a primary trap. Journalists need automated systems to:

• Prevent redundant work: Avoid spending time debunking a video or image that has already been proven to be from a different year, location, or generated by AI by other news or fact-checking organisations, including members of the Eurovision News Spotlight Fact-Checking and OSINT Network.

• Monitor narrative trends: Track how a specific false claim evolves across different regions and languages.

• Enhance digital authority: By using structured data like ClaimReview, newsrooms can ensure their verified findings are prioritized by search engines, and now by AI assistants.

1.2. Learning outcomes

• Query the Google Fact Check Explorer API to automate claim verification.

• Implement ClaimReview and MediaReview schema to make investigations machine-readable.

• Integrate third-party fact-checking APIs and collaborative networks into OSINT workflows.

• Establish a secure chain of custody for digital debunks.

1.3. Case study hook

Imagine a viral photo circulating on social media appearing to show a high-ranking official in an incriminating or highly unusual situation. Before launching a deep-dive forensic analysis, an automated query across global fact-checking databases and reverse-image search reveals that the exact image was identified as “AI-Generated/Deepfake” by a news agency in a different region weeks ago.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• ClaimReview: A standardized schema (tags) used to identify a fact-check article for search engines.

• MediaReview: An emerging schema specifically for tagging manipulated or misrepresented images and videos.

• API (Application Programming Interface): A bridge that allows your software to “talk” to a database of fact-checks directly.

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy

• The “stop at the login” rule: Automated tools must only access public-facing APIs. Never use automated scripts to bypass paywalls or private group settings (e.g., closed Telegram channels) without explicit legal and ethical clearance.

• Sensitivity: Fact-checking private individuals requires a higher threshold of public interest than checking public figures.

2.2.2. Legal considerations

🛑 Disclaimer: This tutorial does not constitute legal advice. Investigative techniques involving automated data retrieval may intersect with Computer Fraud and Abuse Acts (CFAA) or GDPR. Always consult your organization’s legal department before deploying large-scale automated scrapers or API integrations.

🛠️ 3. Applied methodology: step-by-step practical implementation

3.1. Required tools & setup

• Google Cloud Console Account: To generate an API key for Fact Check tools.

• Python (Optional) or Postman: For making API requests.

• Fact Check Markup Tool: To generate ClaimReview code without manual programming.

• Collaborative Access: Membership in networks like Eurovision News Spotlight for verified information.

👷‍♀️ 3.2. Practical execution (The “How”)

Scenario A: Automated auditing of viral claims

To check a list of suspicious keywords or entities against global debunks, use the Google FactCheck Claim Search API.

Table 1: API Query Parameters for Investigative Value

Scenario B: Implementing ClaimReview for your investigation

When publishing a debunk, you must “tag” it so automated systems can find it.

1. Access the Markup Tool: Go to the Google Fact Check Markup Tool.

2. Enter Claim Details: Input the specific claim, the author of the claim (e.g., a specific politician), and your rating (False, Misleading, etc.).

3. Embed JSON-LD: Copy the generated code into the <head> of your article.

💾 3.3. Data preservation and chain of custody

Automated results disappear or change. You must:

1. Archive the API Response: Save the raw JSON output of your API query.

2. Snapshot the Source: Use Hunchly or Archive.today to capture the original claim and the debunking article.

3. Hash the Evidence: Generate a SHA-256 hash for any images or documents you are debunking.

🧠 4. Verification and analysis for reporting

4.1. Corroboration strategy

Never rely on a single automated debunk. Cross-reference an API finding with:

1. Primary-source audit: If the API says a video is from 2018, find the original from 2018.

2. Metadata verification: Use InVID/WeVerify to check if the video’s upload date aligns with the fact-check.

4.2. Linking data to narrative

🤖 4.3. AI assistance in analysis

Journalists can use LLMs to process large volumes of fact-check data:

• Clustering: Upload a CSV of 500 API results and ask the AI to “Identify the top 3 recurring narratives and the most frequent sources of these claims.”

• Summarization: Use AI to summarize foreign-language debunks found via the API.

⚠️ Warning: AI can hallucinate fact-check ratings. Always click the source link provided in the API response to verify the actual rating. Do not upload confidential source documents or whistleblower data to public AI models as this data is used for training and voids source protection.

🚀 5. Practice and resources

5.1. Practice exercise

1. Go to the Fact Check Explorer.

2. Search for a current viral topic (e.g., “Climate change 15 minute cities”).

3. Identify a debunk from a country other than your own.

4. Find the original “Claim Appearance” URL mentioned in that debunk and use a reverse image search to see if it is still active on other platforms.

5.2. Advanced resources

• Eurovision News Spotlight: A collaborative EBU network providing forensic OSINT analysis, Field Notes, and technical tutorials for public service media, investigative journalists and the public.

• Google Fact Check API Docs: Full technical documentation for developers.

• Schema.org ClaimReview: The official technical definition of the markup.

• Duke Reporters’ Lab: A global database of active fact-checking organizations.

✅ 6. Key takeaways and investigative principles

• Automate early: Run API queries at the start of an investigation to avoid redundant effort.

• Trust verified networks: Leverage the expertise of the Eurovision News Spotlight network for complex cross-border claims.

• Machine-readability is key: Use ClaimReview so your hard work is indexed by algorithms.

• Context is king: An automated rating doesn’t explain the “why”.

• Human-in-the-loop: Always fact-check the automated fact-checkers.

👁️ Coming next week…

Advanced GEOINT: Satellite imagery & temporal analysis
Master the forensic fusion of Google Earth, Sentinel Hub, and OSM to detect, map, and verify environmental and infrastructural change over time.

⚡ The 30-second brief

• The debunk: Debunking the hoaxes surrounding the Adamuz train disaster

• New tech: WebRecon for comprehensive crawling, data extraction, and analysis

• OSINT stack: Reconnaissance tools for data extraction and vibecoding

🔦 In the Spotlight

• Fact-check: AI-generated images of the wreckage were circulating after a deadly train crash in southern Spain. Read the full breakdown from Spain’s VerificaRTVE and 3CatInfo.

• Monitoring: Donald Trump’s continued threats to seize control of Greenland sent European leaders into a tailspin. Denmark and other allied countries sent troops to Greenland to participate in military exercises. With the situation escalating politically, we are monitoring for opportunities to add intelligence through open-source investigations.

🖋️ The Lead: Debunking the hoaxes surrounding the Adamuz train disaster

A crash between two high-speed trains on January 18 in Adamuz, Córdoba, left at least 41 people dead and injured more than 100 people. Once emergency services began to process the scene, official images began to emerge showing the extreme wreckage that was left along the track in the wake of the collision.

Getting a clear assessment of the situation on the ground was complicated by the spread of AI-generated images among the genuine footage. And it wasn’t just images: false claims were also circulating before investigators had even had time to make a full assessment of the circumstances surrounding the crash.

Debunking the fakes:

• Two widely circulated images were found to be AI-generated by comparison against existing official footage from the scene, showing that the trains were not positioned exactly as they were in reality. (One of these AI pictures was even used by a newspaper in its coverage of the crash.)

• A fake message circulated asking the public to help at the scene of the crash, and to come wearing high-visibility vests. The Regional Government of Andalusia confirmed that this was a hoax, and asked civilians not to come to the site.

• Posts claimed that Spain gave €247 million to improve Morocco’s railway network, but that was misleading. In reality, Spain did give Morocco (and Uzbekistan) funding, but in the form of repayable loans. In Morocco’s case, the loan was subject to a Spanish company being awarded a contract for the job.

• Social media posts claimed the trains were speeding, but the national railway company RENFE said the trains were travelling at 205 km/h and 210 km/h, on a section of track with a 250 km/h speed limit.

— Maria

⚙️ The intelligence stack

🔍 WebRecon
WebRecon is an advanced web reconnaissance tool designed for cybersecurity professionals, penetration testers, and security researchers. It automates the process of gathering intelligence from target websites through comprehensive crawling, data extraction, and analysis.

💡 Quick tip: When conducting initial reconnaissance on a high-interest target, avoid triggering security alerts (like WAF blocks) by running a shallow, filtered scan through a proxy.

The Command:

python3 WebRecon.py [TARGET_URL] --max-depth 1 --no-images --proxy socks5://127.0.0.1:9050

📍 Data discovery via vibecoding: Using AI to find hidden data sources (via )

📍Mastering the SIFT method: A practical manual on using lateral reading and search operators to verify digital leads and protect the chain of custody. (via Eurovision News Spotlight)

📍Suspect and car investigations: A technical walkthrough detailing the methodology for linking isolated data points—specifically suspect identities and vehicle movements. (via UK OSINT Community)

📍Kling AI: Generating a synthetic person using Kling’s new motion control engine (via Emmanuelle Saliba)

📍Domain search: Domain data for research purposes without any fee or paywall (via ip.thc.org)

📡 Signal analysis

Why Grok restrictions won’t stop society’s latest AI scourge
Kate McDonald explores how X’s new geoblocking and image-editing restrictions for Grok fail to address the root issue, as “Spicy Mode” and standalone app access continue to facilitate the generation of non-consensual deepfakes. (via RTE Clarity)

Before we go…

UNESCO has published the second edition of Story-Based Inquiry: A Manual for Investigative Journalists, offering a comprehensive update of its 2009 global reference handbook.

This fully updated second edition brings new research, innovative practices and insights from global investigations. (via UNESCO)

The videos are serene: an elderly East Asian monk, often in an orange robe, sitting cross legged in a perfectly manicured garden or inside a temple. Sometimes he has a book in front of him, and in all of the clips, he imparts a piece of advice or inspiration.

“The sooner you learn this, the lighter your life will feel. Most of your suffering does not come from what is happening. It comes from the resistance to what is. You fight the moment,” he says in one of his recent videos.

In another: “I see how tired you are. Not just in the body but in the place where the heart holds everything together. You have been carrying more than you show.” Sometimes, he refers to viewers as “my child”.

The sentiments are positive and generalized, but draw on Eastern traditions — particularly Buddhism, based on the clothing and statues seen in the background of some of the videos.

So far, nothing seems amiss. Except: Yang Mun is not real.

All of his videos are entirely AI-generated, created with Google software, as confirmed by Google’s own AI detector, SynthID.

Yang Mun is mostly popular on Instagram, where two profiles have 2.5 million and 1 million followers respectively. On Facebook, a page for Yang Mun has 1.4 million followers.

There is an ‘AI info’ tag on the posts, but this does not appear prominently and does not give further details on the type of transformation that has taken place with AI. For example, a genuine image or video that has been retouched with AI may also carry this tag.

Meta’s current policy relies on uploaders to voluntarily disclose their use of AI, which critics argue allows synthetic content to bypass detection systems.

The website for Yang Mun addresses AI concerns in its FAQ section. Under the question “Who is Yang Mun?”, the website says: “Yang Mun is a wellness philosophy inspired by Eastern teachings, offering practical guidance for emotional balance, nervous system calm and mindful living.”

“Is Yang Mun real?” is answered with: “Yes. Yang Mun represents a real wellness philosophy and authentic teachings. Voice enhancement tools are used only to make the message clearer and accessible to people around the world.” But SynthID clearly shows that the visuals are entirely watermarked as Google-made AI — and more than just “voice enhancement tools” have been used.

Furthermore, another page of the website features a different version of the FAQs. Under “Is Yang Mun a real teacher?”, the website states: “Yes. His work is based on years of practice with ancient Eastern principles and modern wellness psychology.” This contradicts findings from Google’s SynthID, which identifies the visuals as AI-generated.

Valuable income stream for creator

The huge numbers of followers accumulated by the Yang Mun brand suggest that many are not aware that he is AI-generated. Others may not care; his sentiments are motivational, inspirational, and relatively vague.

But this deceptive content represents a significant income stream for the creators. As well as any potential income from social views alone, a series of e-books — Time to Heal, Healing the Modern Soul, The Way Back to Stillness, and 30-Day Healing Journey — are available on the Yang Mun website for between US$10 and $50 before tax.

According to the website, more than 7,000 people have bought one of the e-books so far, and hundreds more have purportedly bought the more expensive package. The information on what is included in the package is vague, and users are immediately prompted to ‘Get Instant Access’ for a total US$61.45. The nature of the e-book content remains unverified, although the production speed of the brand aligns with AI generation patterns.

We checked the profiles of some of the few people who ‘reviewed’ the e-book on the purchase page. Most did not have profile pictures, but one reviewer who gave the books a five-star rating had a highly polished image with some irregularities in the skin, hair and eyes. HiveModeration, a third-party AI-detection platform, rated that picture as 99.9% likely to contain AI-generated or deepfake content.

There is no clear information on the website about who is behind the Yang Mun brand, but online searches throw up some indications. An article described as a ‘paid press release’ was published on Yahoo!Finance on December 9, 2025, and extolled the virtues of this “movement reaching millions worldwide” while urging readers to purchase a Yang Mun book.

It was released by Shalev.H Marketing. A search for this marketing firm brings up nothing but other paid content promoting Yang Mun. However, it appears to be a reference to Shalev Hani, who describes himself on LinkedIn as a “Digital Creator & AI Storyteller” based in Israel.

His LinkedIn page says that he “crafts AI-powered video content that enables brands and apps to scale effectively”, adding that he has “contributed to campaigns that collectively achieved over 330 million views across platforms”.

There is no mention of Yang Mun on the LinkedIn page now. However, a cached version of Hani's LinkedIn profile, indexed by Google and still appearing in search results this week, still lists him as the creator of Yang Mun.

Eurovision News Spotlight contacted Shalev Hani for confirmation. In a response, he wrote: “I’m not the right person to comment publicly on the nature or background of the Yang Mun character”, and added that he did not want to participate in media discussions on the project.

There was no evidence that anyone with medical or spiritual qualifications has anything to do with the project.

Religions and influencer industry facing AI challenge

AI is now a feature of almost every facet of the online sphere, but the subgenre of AI offering spiritual or mental health advice poses particular ethical questions. Popular discussions on the topic so far have mainly focused on the impact of AI chatbots; for example, in 2025, a group of leading psychologists in the UK warned that ChatGPT was offering dangerous advice to mentally ill people.

Mainstream religions are also grappling with the developments in AI. In 2024, an AI “priest” called Father Justin designed to answer faith questions sparked backlash and led to his ‘defrocking’ and the removal of all references to him being a priest.

A BBC article in October titled “People are using AI to talk to God” quoted a research fellow at the University of Oxford, the Reverend Dr. Lyndon Drake, as saying “AI chatbots might indeed challenge the status of religious leaders”, but he warned that “interpretations of sacred texts have often been contested” and chatbots mirror the biases of their training material.

In the content creator world, AI influencers are threatening to upend the influencer industry at large, which is worth hundreds of billions of dollars. Human influencers cannot possibly keep up with the output that is possible with an AI influencer, whose videos may only take minutes to generate.

For years, verification experts have contended with fake and AI-generated images from war zones and major news stories. Now, even the lifestyle content we were once drawn to for its relatability could be lost in a wave of increasingly undetectable synthetic content.

SOURCES

• Instagram.com. (2017). Yang Mun (@yangmunus) • Instagram photos and videos. [online] [Accessed 20 Jan. 2026].

• Instagram.com. (2017). Yang mun (@itsyangmuns) • Instagram photos and videos. [online] [Accessed 20 Jan. 2026].

• ‌Yang Mun. (2026). About Yang Mun – Ancient Wisdom for Modern Healing. [online] [Accessed 20 Jan. 2026].

• Yang Mun. (2025). 30-Day Healing Journey | Yang Mun. [online] [Accessed 20 Jan. 2026].

• Shalev.H Marketing (2025). Who Is Yang Mun? The Movement Reaching Millions Worldwide. [online] Yahoo Finance. [Accessed 20 Jan. 2026].

• Hall, R. (2025). ChatGPT-5 offers dangerous advice to mentally ill people, psychologists warn. [online] the Guardian. [Accessed 20 Jan. 2026].

• Christian, G. (2024). AI ‘priest’ sparks more backlash than belief. [online] National Catholic Reporter. [Accessed 20 Jan. 2026].

• Arora, S. (2025). People are using AI to talk to God. [online] Bbc.com. [Accessed 20 Jan. 2026].

• Venkatraman, S. (2025). Both of these influencers are successful - but only one is human. [online] Bbc.com. [Accessed 20 Jan. 2026].

• Hivemoderation.com. (2026). Hive Moderation. [online] [Accessed 20 Jan. 2026].

1. Introduction and context

🔍 1.1. The investigative need

In an era of coordinated disinformation and “pink slime” news sites, journalists cannot take digital content at face value. Traditional vertical reading (staying within a website to judge its credibility) is easily gamed by professional UI/UX design. Investigative OSINT requires lateral reading: moving away from a source to see what the rest of the web says about it. This skill is the “first responder” phase of any investigation, preventing the spread of falsehoods before they enter the reporting stream.

1.2. Learning outcomes

• Implement the four-step SIFT methodology to classify incoming digital leads.

• Execute lateral reading techniques using advanced search operators to bypass a source’s self-presentation.

• Evaluate the institutional “reputation trail” of unfamiliar organizations or individuals.

• Trace original reporting or media assets back to their primary context to identify manipulation.

📋 1.3. Case study hook

Imagine receiving a leaked “scientific study” from a think tank you’ve never heard of, claiming a specific chemical in a local river is harmless. Before analyzing the data, you must determine if the think tank is a neutral academic body or a front for the chemical corporation—a task that requires looking around the site, not just at it.

💡 2. Foundational theory and ethical-legal framework

2.1. Key terminology

• Lateral reading: The practice of opening multiple tabs to research the source, author, and claims of a piece of content while ignoring the content itself initially.

• Vertical reading: Analyzing a single webpage from top to bottom (looking at “About” pages, logos, and aesthetics), which is often misleading in OSINT.

• SIFT (The four moves): A mnemonic (memory aid) for:

  • Stop

  • Investigate the source

  • Find better coverage

  • Trace claims back to the original context

• Circular reporting: When source A publishes misinformation, source B parrots it, and source A then cites source B as “corroboration”.

⚠️ 2.2. Ethical and legal boundaries

2.2.1. Consent & privacy

Verification often involves investigating individuals. Journalists must distinguish between public interest (verifying a public official’s claim) and harassment. Never use verification tools to dox private citizens who have no bearing on the public interest.

2.2.2. Legal considerations

While lateral reading involves public searches, stay within the “stop at the login” rule. Using unauthorized access to private databases to verify a source can lead to legal liability and the “fruit of the poisonous tree” doctrine, making the evidence unusable.

🛑 Disclaimer: Always consult your newsroom’s legal department regarding the use of leaked materials.

🛠️ 3. Applied methodology: step-by-step practical implementation

3.1. Required tools & setup

• Multi-tab browser environment: A dedicated browser profile (e.g., on Firefox or Brave) to prevent cookie contamination.

• Search operators: Mastery of Google/DuckDuckGo dorks.

• Archiving tools: Archive.today or the Wayback Machine extension.

• Whois Lookup: DomainTools or ICANN Lookup.

👷‍♀️ 3.2. Practical execution (The “How”)

Move 1: Stop (The classification)

When you feel a strong emotional reaction (outrage, validation) to a source, stop. Do not share or cite it. Ask: “Do I know this source? Is it reputable?”

Move 2: Investigate the source (Lateral reading)

Do not click the “About Us” page. Instead, use these queries to see what others say:

Move 3: Find better coverage

Search for the core claim, not the source’s headline. Look for “consensus” or reporting from established news wires (AP, Reuters, AFP).

Move 4: Trace claims to the original context

If a post quotes a document, find the full PDF. If a video shows a “clash,” use Reverse Image Search (Google Lens/Yandex) to find the full-length video and verify the date/location.

💾 3.3. Data preservation and chain of custody

Every step of the verification process should be documented.

1. Archiving: Use Archive.today to create a permanent snapshot of the source and the lateral evidence you found.

2. Hashing: For downloaded documents, generate a SHA-256 hash immediately.

   Terminal Command: shasum -a 256 document.pdf

3. Logging: Keep a simple spreadsheet log: [Timestamp] | [Action] | [URL] | [Outcome/Result].

🧠 4. Verification and analysis for reporting

4.1. Corroboration strategy

A finding is only “verified” if it passes the Rule of Three:

1. Technical evidence: (e.g., Whois data shows the site was created yesterday).

2. Lateral evidence: (e.g., A media watchdog identifies the owner as a known operative).

3. Primary context: (e.g., The original video source proves the clip was filmed in 2019, not today).

4.2. Linking data to narrative

🤖 4.3. AI assistance in analysis

AI can speed up the “Find Better Coverage” phase:

• Summarization: Feed long, complex reports into a local LLM to extract the primary claims.

• Entity extraction: Use AI to list all organizations mentioned in a series of leaked emails.

• Clustering: Group 100+ articles by “narrative similarity” to identify the origin of a rumour.

⚠️ Warning: AI models frequently hallucinate “reputable sources” or mix up dates. Don’t include a fact in a story simply because an AI confirmed it. Don’t upload confidential source documents to public AI models (like ChatGPT) as this may compromise your source and leak the data into the model’s training set.

🚀 5. Practice and resources

5.1. Practice exercise

The “Pop-Up” Challenge: Go to NewsGuard or a local fact-checking site and find a site labelled “Unreliable.” Spend 10 minutes performing Move 2 (Investigate the source) using lateral reading. Try to find the true owner or funding source without ever relying on the site’s own “About” page.

5.2. Advanced resources

• Google Hacking Database (GHDB): Advanced queries for finding exposed data.

• GIJN Resource Center: Global Investigative Journalism Network’s guides on specialized reporting.

• OSINT Framework: A visual directory of tools for different types of data collection.

• Maltego: A graphical link analysis tool for mapping relationships between pieces of information.

✅ 6. Key takeaways and investigative principles

• Ignore the UI: Professional design does not equal credibility.

• Leave the site: The truth about a source is rarely found on the source itself.

• Search for consensus: Established facts should have a trail across multiple reputable outlets.

• Trace to the root: Always seek the raw data, the original video, or the primary document.

• Archive everything: Digital evidence is volatile; capture it before it’s deleted.

👁️ Coming next week…

Automated Fact-Checking Tools and APIs
Streamline your verification workflow by learning how to harness open APIs and ClaimReview data to access thousands of existing debunks.