#FactCheck- AI-Generated Video Falsely Claims Iran Attack on Apple, Microsoft in Israel
Executive Summary:
Amid the ongoing conflict in West Asia involving the United States, Israel and Iran, a video is being widely circulated on social media with the claim that Iran attacked the headquarters of tech giants Apple and Microsoft in Israel. The clip shows a building engulfed in flames, with firefighters attempting to douse the fire. However, research by the CyberPeace found that the viral video is AI-generated and is being falsely linked to the ongoing conflict to spread misinformation.
Claim:
An Instagram user ‘bharat_updatenews’ shared the video on March 19, 2026, claiming that Iran had launched an attack on major tech company headquarters, including Apple and Microsoft, in Israel. The post suggested that the incident had raised serious security concerns and was being widely reported by international media.
Link: https://www.instagram.com/bharat_updatenews/reel/DWEUhLEAKaw
Fact Check:
To verify the claim, we extracted keyframes from the viral video and conducted a reverse search using Google Lens. During this process, we found the same video on a TikTok account named ‘dailyupdate122’, where it had been uploaded on March 15, 2026.
The video on this account was clearly labelled as “AI-generated media.” The account also featured several other AI-generated videos, raising doubts about the authenticity of the viral clip. Following this, we analysed the video using the AI detection tool Hive Moderation. The results indicated that the video is nearly 100 percent AI-generated. The tool further suggested with over 98 percent probability that the clip may have been created using OpenAI’s Sora or a similar AI video generation model.
Conclusion:
The viral claim that Iran attacked Apple and Microsoft headquarters in Israel is false. The video circulating online is AI-generated and has no connection to the ongoing conflict in West Asia.
Related Blogs
Executive Summary:
Recently PAN-OS software of Palo Alto Networks was discovered with the critical vulnerability CVE-2024-3400. It is the software used to power all their networks in the next generation firewalls. This vulnerability is a common injection vulnerability which provides access to unauthenticated attackers to execute random code having root privileges on the attacked system. This has been exploited actively by threat actors, leaving many organizations at risk for severe cyberattacks. This report helps to understand the exploitation, detection, mitigations and recommendations for this vulnerability.
Understanding The CVE-2024-3400 Vulnerability:
CVE-2024-3400 impacts the particular version of PAN-OS and a certain configuration susceptible to this kind of a security issue. It is a command injection, which exists in the GlobalProtect module of the PAN-OS software. The vulnerability can be exploited by an unauthorized user to run any code on the firewall having root privileges. This targets Active Directory database (ntds.dit), important data (DPAPI), and Windows event logs (Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx) and also login data, cookies, and local state data for Chrome and Microsoft Edge from specific targets leading attackers to capture the browser master key and steal sensitive information of the organization.
The CVE-2024-3400 has been provided with a critical severity rating of 10.0. The following two weaknesses make this CVE highly severe:
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-20: Improper Input Validation.
Impacted Products:
The affected version of PAN-OS by CVE-2024-3400 are-
Only the versions 10.2, 11.0, and 11.1, setup with GlobalProtect Gateway or GlobalProtect Portal are exploited by this vulnerability. Whereas the Cloud NGFW, Panorama appliances and Prisma Access are not affected.
Detecting Potential Exploitation:
Palo Alto Networks has confirmed that they are aware of the exploitation of this particular vulnerability by threat actors. In a recent publication they have given acknowledgement to Volexity for identifying the vulnerability. There is an increasing number of organizations that face severe and immediate risk by this exploitation. Third parties also have released the proof of concept for the vulnerability.
The suggestions were provided by Palo Alto Networks to detect this critical vulnerability. To detect this vulnerability, the following command shall be run on the command-line interface of PAN-OS device:
grep pattern "failed to unmarshal session(.\+.\/" mp-log gpsvc.log*
This command looks through device logs for specific entries related to vulnerability.
These log entries should contain a long, random-looking code called a GUID (Globally Unique Identifier) between the words "session(" and ")". If an attacker has tried to exploit the vulnerability, this section might contain a file path or malicious code instead of a GUID.
Presence of such entries in your logs, could be a sign of a potential attack to hack your device which may look like:
- failed to unmarshal session(../../some/path)
A normal, harmless log entry would look like this:
- failed to unmarshal session(01234567-89ab-cdef-1234-567890abcdef)
Further investigations and actions shall be needed to secure the system in case the GUID entries were not found and suspicious.
Mitigation and Recommendations:
Mitigation of the risks posed by the critical CVE-2024-3400 vulnerability, can be accomplished by the following recommended steps:
- Immediately update Software: This vulnerability is fixed in software releases namely PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, PAN-OS 11.1.2-h3, and all higher versions. Updating software to these versions will protect your systems fully against potential exploitation.
- Leverage Hotfixes: Palo Alto Networks has released hotfixes for commonly deployed maintenance releases of PAN-OS 10.2, 11.0, and 11.1 for the users who cannot upgrade to the latest versions immediately. These hotfixes do provide a temporary solution while you prepare for the full upgrade.
- Enable Threat Prevention: Incase of available Threat Prevention subscription, enable Threat IDs 95187, 95189, and 95191 to block attacks targeting the CVE-2024-3400 vulnerability. These Threat IDs are available in Applications and Threats content version 8836-8695 and later.
- Apply Vulnerability Protection: Ensure that vulnerability protection has been applied in the GlobalProtect interface to prevent the exploitation on the device. It can be implemented using these instructions.
- Monitor Advisory Updates: Regularly checking for the updates to the official advisory of Palo Alto Networks. This helps to stay up to date of the new releases of the guidance and threat prevention IDs of CVE-2024-3400.
- Disable Device Telemetry – Optional: It is suggested to disable the device telemetry as an additional precautionary measure.
- Remediation: If there is an active exploitation observed, follow the steps mentioned in this Knowledge Base article by Palo Alto Networks.
Implementation of the above mitigation measures and recommendations would be in a position to greatly reduce the risk of exploitation you might face from a cyber attack targeting the CVE-2024-3400 vulnerability in Palo Alto Networks' PAN-OS software.
Conclusion:
The immediate response should be taken against the offensive use of the critical CVE-2024-3400 vulnerability found in the PAN-OS platform of Palo Alto Networks. Organizations should actively respond by implementing the suggested mitigation measures such as upgrading to the patched versions, enabling threat prevention and applying vulnerability protection to immediately protect from this vulnerability. Regular monitoring, implementing security defense mechanisms and security audits are the necessary measures that help to combat emerging threats and save critical resources.
Introduction
Attacks by cybercriminals targeting national critical infrastructure are increasing at an unsettling rate. Such attacks have the potential to do severe damage by upsetting transportation networks, utilities, financial services, and other vital infrastructure. The physical and digital systems that underpin a nation's economy are known as critical infrastructure thus if they were to be disrupted, there would be serious risks to the economy and public health and safety. Establishing proper cybersecurity measures and protecting those digital systems from possible threats or cyberattacks is necessary. Both public and private sector assets are included in these essential infrastructure categories.
Nationwide alert:
Recently one of the biggest hacker organizations has warned of an upcoming cyberattack on the critical infrastructure and websites in India, causing a countrywide alert. A gang of hackers from Indonesia and Pakistan, celebrating 4,000 members, announced a planned “Cyber Party” on 11 December 2023. The event’s claimed goal is to compromise and disrupt India's digital infrastructure. They disclosed this information on their Telegram channel.
This hacker organization holds a record of launching extensive cyberattacks; in the past, it sent out a "red notice" that was intended to target 12,000 websites run by the Indian government. They have previously attacked other nations, such as Israel, Sweden, and the United States. Their reasons are varied and might include anything from assaults on certain groups to religious disagreements.
The gang has also been acclaimed for hacking into a New York City police agency, obtaining health and social media data from Israel, and exposing information from Swedish social media users. These alarming events show how urgently strong and all-encompassing cybersecurity measures are needed, not only in India but throughout the world.
Effect(s) on India
1. Central Agencies Are Alert, Expect Health Sector Attacks: The cyberinfrastructure of the health sector has been a common target of assaults, particularly in the aftermath of the COVID-19 epidemic, which has authorities particularly concerned. Relevant ministries have received notifications from central authorities advising them to take precautions against unwanted access. The security of digital infrastructure is seriously challenged by the constantly changing panorama of cyber-attacks, according to those who are aware of the warning and threat.
2. National security concerns: Because of the interconnectedness of critical national infrastructure, a cyberattack may have an impact on national security. Attacks against defense networks, intelligence organizations health infrastructure, or military systems, for instance, might make it more difficult for the nation to respond to threats from outside.
3. Concerns for Public Safety and Health: Cyberattacks on healthcare systems run the risk of compromising patient data, stopping medical procedures, and even endangering the general public's health. This might have potentially fatal results in urgent circumstances.
4. Data Breach and Privacy Issues: Stealing confidential data is a common component of cybersecurity assaults. A breach of critical infrastructure systems might result in sensitive data, including personal information, being misused and accessed without authorization, raising privacy issues.
Preventive and protective measures
1. The plan for responding to incidents: Make sure a clear incident response strategy is in place, with a focus on healthcare systems, and that it is especially designed to handle cyber-attacks on critical infrastructure.
2. Better Tracking: Observing vital networks, systems, and data flows more closely, especially in the healthcare industry. Using cutting-edge threat detection technologies to spot odd or questionable activity.
3. Critical System Isolation: Cutting off vital healthcare systems from the wider network to reduce the chance of attackers moving laterally.
4. Continual Backups: Make sure that backup copies of important data and systems are kept in a safe, isolated location by regularly backing them up. In the event of a ransomware attack or data breach, this makes recovery easier.
5. Update and patch systems: Make sure that all operating systems and apps utilized in the infrastructure of the healthcare industry are updated with the most recent security updates.
6. Protocols for Communication: In the case of a cyber-incident, establishing explicit communication mechanisms to guarantee that pertinent parties are notified as soon as possible. This covers correspondence with law enforcement, the public, and other members of the healthcare industry as needed.
Conclusion
Urgent preventative actions are essential in response to an impending cyber threat revealed by a large hacker organization that is targeting India's key infrastructure, specifically the healthcare sector. The interconnectedness of this infrastructure puts public safety, privacy, and national security in danger. A crucial defensive approach is formed by the proactive measures mentioned, which include communication protocols, system isolation, improved monitoring, incident response preparation, and frequent backups. The dangers underline the necessity of international collaboration in tackling cybersecurity issues and the requirement for shared responsibility of everyone to safeguard digital networks. To reduce risks and guarantee the resilience of vital national infrastructure in the face of changing cyber threats, authorities must continue to develop and adapt their cybersecurity tactics.
References:
- https://www.cnbctv18.com/technology/exclusive--nationwide-alert-sounded-as-hacker-group-plans-cyber-party-to-attack-indias-critical-digital-infra-18520021.htm
- https://www.the420.in/ndian-authorities-high-alert-hacker-groups-threaten-cyber-assault/
- https://www.cnbctv18.com/technology/exclusive--nationwide-alert-sounded-as-hacker-group-plans-cyber-party-to-attack-indias-critical-digital-infra-18520021.htm#:~:text=By%20News18.com%20Dec%208,%3A58%20AM%20IST%20(Published)&text=A%20nationwide%20alert%20has%20been,Indian%20websites%20and%20critical%20infrastructure
- https://verveindustrial.com/resources/blog/critical-infrastructure-cyber-security/
Executive Summary
Following a recent protest at Delhi’s Jantar Mantar, members of the self-styled “Cockroach Janata Party” also staged a demonstration in Pune, Maharashtra, demanding the resignation of Union Education Minister Dharmendra Pradhan. Amid this backdrop, a photograph has gone viral on social media purportedly showing the party’s founder, Abhijeet Dipke, posing with Prime Minister Narendra Modi. CyberPeace Research Wing research found that the image is not genuine. The photograph has been created using Artificial Intelligence (AI) and does not depict a real meeting between the two individuals.
Claim
An X user, “subhash Kumar sharma,” shared the viral image on June 8, 2026, with the caption: “This is the real face of the Cockroach... the rest you all understand. They were begging for Pradhan’s resignation at Jantar Mantar… did they get it or not?” The archived and original links to the post can be seen below:
https://x.com/sharmass27/status/2063691212662686102?s=20
Fact Check
To verify the claim, we conducted a reverse image search using Google. However, we did not find any credible news reports related to the viral photograph. We also searched using relevant keywords, but no reliable information supporting the claim was found. We then examined the official X account of Abhijeet Dipke, founder of the “Cockroach Janata Party.” No post, photograph, or information related to any meeting with Prime Minister Narendra Modi was found on his account.
https://x.com/abhijeet_dipke?lang=en
The absence of any credible evidence led us to suspect that the image may have been generated using AI. To further verify its authenticity, we analyzed the image using AI-detection tools. The first tool, Hive Moderation, indicated a nearly 99 percent probability that the image was AI-generated. The analysis also suggested signs consistent with content produced by generative AI models.
We then examined the image using another AI-detection platform, Sightengine. Its analysis likewise indicated a 99 percent likelihood that the image was AI-generated and showed characteristics commonly associated with AI-created visuals.
Conclusion
Our research found that the claim accompanying the viral image is false. The photograph purportedly showing Prime Minister Narendra Modi with Cockroach Janata Party founder Abhijeet Dipke is not real. The image has been generated using Artificial Intelligence and does not represent an actual meeting or event.
