#FactCheck-2013 Video of Attack on Bulgarian Politician Falsely Shared as Recent Assault on Benjamin Netanyahu
Executive Summary
In the October 2026 general elections in Israel, no political party secured a clear majority. Benjamin Netanyahu will remain the caretaker prime minister until a new government is formed. Meanwhile, a video showing an attack on a man is going viral on social media. In the video, a man can be seen delivering a speech on stage when another person approaches him with a gun and attacks him. The video is being shared with the claim that it shows a recent alleged attack on Benjamin Netanyahu.
CyberPeace Research found that the viral video has no connection to Benjamin Netanyahu. In fact, the video shows an attack on a Bulgarian politician in January 2013. The old and unrelated video is now being shared with a false claim.
Claim:
Facebook user ‘Newscap | News That Matters’ shared the video on October 29, 2026, with the caption: “Breaking: A very dangerous attack on Netanyahu in Tel Aviv. It looks like he has sustained serious injuries, and a plane is being sent to take him to the US.”
https://www.facebook.com/reel/28109165918756398
Fact Check
To verify the authenticity of the viral claim, we first extracted several keyframes from the video and searched for them using Google Lens. During this process, we found the viral video on the YouTube channel of a UK-based account, ‘Onlooker UK’. The video was uploaded on January 19, 2013.
According to the information provided with the video, Ahmed Dogan, leader of Bulgaria’s ethnic Turkish party, the Movement for Rights and Freedoms (MRF), was delivering a speech on stage when a man attempted to attack him and pointed a gun at him. However, security guards immediately apprehended the attacker.
https://www.youtube.com/watch?v=-t0ASapgPMM
Based on the information obtained, we conducted a Google search using relevant keywords. We found a news report related to the incident, published on the Reuters website on January 19, 2013. According to the report, police said that the attacker had been arrested and was a resident of Burgas, a city on Bulgaria’s Black Sea coast. The man was also carrying two knives.
Conclusion
Our research found that the video being circulated with the claim of an alleged attack on Benjamin Netanyahu is old and unrelated. It actually shows an attack on a Bulgarian politician in January 2013.
Related Blogs
Introduction
Phishing as a Service (PhaaS) platform 'LabHost' has been a significant player in cybercrime targeting North American banks, particularly financial institutes in Canada. LabHost offers turnkey phishing kits, infrastructure for hosting pages, email content generation, and campaign overview services to cybercriminals in exchange for a monthly subscription. The platform's popularity surged after introducing custom phishing kits for Canadian banks in the first half of 2023.Fortra reports that LabHost has overtaken Frappo, cybercriminals' previous favorite PhaaS platform, and is now the primary driving force behind most phishing attacks targeting Canadian bank customers.
In the digital realm, where the barriers to entry for nefarious activities are crumbling, and the tools of the trade are being packaged and sold with the same customer service one might expect from a legitimate software company. This is the world of Phishing-as-a-Service (PhaaS), and at the forefront of this ominous trend is LabHost, a platform that has been instrumental in escalating attacks on North American banks, with a particular focus on Canadian financial institutions.
LabHost is not a newcomer to the cybercrime scene, but its ascent to infamy was catalyzed by the introduction of custom phishing kits tailored for Canadian banks in the first half of 2023. The platform operates on a subscription model, offering turnkey solutions that include phishing kits, infrastructure for hosting malicious pages, email content generation, and campaign overview services. For a monthly fee, cybercriminals are handed the keys to a kingdom of deception and theft.
Emergence of Labhost
The rise of LabHost has been meticulously chronicled by various cyber security firms which reports that LabHost has dethroned the previously favored PhaaS platform, Frappo. LabHost has become the primary driving force behind the majority of phishing attacks targeting customers of Canadian banks. Despite suffering a disruptive outage in early October 2023, LabHost has rebounded with vigor, orchestrating several hundreds of attacks per month.
Their investigation into LabHost's operations reveals a tiered membership system: Standard, Premium, and World, with monthly fees of $179, $249, and $300, respectively. Each tier offers an escalating scope of targets, from Canadian banks to 70 institutions worldwide, excluding North America. The phishing templates provided by LabHost are not limited to financial entities; they also encompass online services like Spotify, postal delivery services like DHL, and regional telecommunication service providers.
LabRat
The true ingenuity of LabHost lies in its integration with 'LabRat,' a real-time phishing management tool that enables cybercriminals to monitor and control an active phishing attack. This tool is a linchpin in man-in-the-middle style attacks, designed to capture two-factor authentication codes, validate credentials, and bypass additional security measures. In essence, LabRat is the puppeteer's strings, allowing the phisher to manipulate the attack with precision and evade the safeguards that are the bulwarks of our digital fortresses.
LabSend
In the aftermath of its October disruption, LabHost unveiled 'LabSend,' an SMS spamming tool that embeds links to LabHost phishing pages in text messages. This tool orchestrates a symphony of automated smishing campaigns, randomizing portions of text messages to slip past the vigilant eyes of spam detection systems. Once the SMS lure is cast, LabSend responds to victims with customizable message templates, a Machiavellian touch to an already insidious scheme.
The Proliferation of PhaaS
The proliferation of PhaaS platforms like LabHost, 'Greatness,' and 'RobinBanks' has democratized cybercrime, lowering the threshold for entry and enabling even the most unskilled hackers to launch sophisticated attacks. These platforms are the catalysts for an exponential increase in the pool of threat actors, thereby magnifying the impact of cybersecurity on a global scale.
The ease with which these services can be accessed and utilized belies the complexity and skill traditionally required to execute successful phishing campaigns. Stephanie Carruthers, who leads an IBM X-Force phishing research project, notes that crafting a single phishing email can consume upwards of 16 hours, not accounting for the time and resources needed to establish the infrastructure for sending the email and harvesting credentials.
PhaaS platforms like LabHost have commoditized this process, offering a buffet of malevolent tools that can be customized and deployed with a few clicks. The implications are stark: the security measures that businesses and individuals have come to rely on, such as multi-factor authentication (MFA), are no longer impenetrable. PhaaS platforms have engineered ways to circumvent these defenses, rendering them vulnerable to exploitation.
Emerging Cyber Defense
In the face of this escalating threat, a multi-faceted defense strategy is imperative. Cybersecurity solutions like SpamTitan employ advanced AI and machine learning to identify and block phishing threats, while end-user training platforms like SafeTitan provide ongoing education to help individuals recognize and respond to phishing attempts. However, with phishing kits now capable of bypassing MFA,it is clear that more robust solutions, such as phishing-resistant MFA based on FIDO/WebAuthn authentication or Public Key Infrastructure (PKI), are necessary to thwart these advanced attacks.
Conclusion
The emergence of PhaaS platforms represents a significant shift in the landscape of cybercrime, one that requires a vigilant and sophisticated response. As we navigate this treacherous terrain, it is incumbent upon us to fortify our defenses, educate our users, and remain ever-watchful of the evolving tactics of cyber adversaries.
References
- https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/labhost-cybercrime-service-lets-anyone-phish-canadian-bank-users/amp/
- https://www.techtimes.com/articles/302130/20240228/phishing-platform-labhost-allows-cybercriminals-target-banks-canada.htm
- https://www.spamtitan.com/blog/phishing-as-a-service-threat/
- https://timesofindia.indiatimes.com/gadgets-news/five-government-provided-botnet-and-malware-cleaning-tools/articleshow/107951686.cms
Executive Summary
A video purportedly showing a glacier breaking apart while being filmed from a helicopter is being shared on social media with the claim that a Chinese helicopter has reached the site where a glacier broke apart, triggering floods in Nepal. A research by the Research Wing of the CyberPeace found that the video is actually from Alaska, USA. It was uploaded on Instagram and YouTube by an American pilot, Leigh Kotes, before the recent floods in Nepal, and is unrelated to the incident.
Claim
The video is being shared on X with a caption claiming: “A Chinese helicopter reached the glacier region where water released after the glacier broke apart caused massive destruction in Nepal. Such an event is known as a Glacial Lake Outburst Flood (GLOF).”
https://x.com/ashokshera94/status/2092820484811538681
Fact Check
To verify the viral video claiming that a Chinese helicopter reached the site of the glacier break after the floods in Nepal, we conducted a reverse image search using keyframes from the clip. During the search, we found a video featuring the same visuals uploaded on a YouTube account named “Heli Pilot Leigh” on January 16, 2025. The location mentioned with the video identified it as Alaska, USA.
https://www.youtube.com/shorts/floh1LkZT7o
We also found several videos featuring scenes similar to those in the viral video on Ligh Kotes’ YouTube account. Among them, a nearly two-minute-long video uploaded on January 16, 2025, also contains visuals similar to those seen in the viral clip. Recorded from a helicopter, the video shows Ligh extending her mobile phone outside the helicopter to capture footage of water rushing out at high speed following the breaking of a glacier. https://www.youtube.com/watch?v=5vQP5HlyMMY
Additionally, our research found that the Columbia Glacier featured in Ligh’s video is located near Valdez, Alaska.
https://www.alaska.org/detail/columbia-glacier
Conclusion
The evidence gathered during our research makes it clear that the viral video, which is being shared with the claim that a Chinese helicopter reached the site of a glacier collapse following floods in Nepal, is actually from the Columbia Glacier in Alaska, USA. The video was recorded by an American pilot, Ligh Kotes.
Executive Summary:
A recent claim going around on social media that a child created sand sculptures of cricket legend Mahendra Singh Dhoni, has been proven false by the CyberPeace Research Team. The team discovered that the images were actually produced using an AI tool. Evident from the unusual details like extra fingers and unnatural characteristics in the sculptures, the Research Team discerned the likelihood of artificial creation. This suspicion was further substantiated by AI detection tools. This incident underscores the need to fact-check information before posting, as misinformation can quickly go viral on social media. It is advised everyone to carefully assess content to stop the spread of false information.
Claims:
The claim is that the photographs published on social media show sand sculptures of cricketer Mahendra Singh Dhoni made by a child.
Fact Check:
Upon receiving the posts, we carefully examined the images. The collage of 4 pictures has many anomalies which are the clear sign of AI generated images.
In the first image the left hand of the sand sculpture has 6 fingers and in the word INDIA, ‘A’ is not properly aligned i.e not in the same line as other letters. In the second image, the finger of the boy is missing and the sand sculpture has 4 fingers in its front foot and has 3 legs. In the third image the slipper of the boy is not visible whereas some part of the slipper is visible, and in the fourth image the hand of the boy is not looking like a hand. These are some of the major discrepancies clearly visible in the images.
We then checked using an AI Image detection tool named ‘Hive’ image detection, Hive detected the image as 100.0% AI generated.
We then checked it in another AI image detection named ContentAtScale AI image detection, and it found to be 98% AI generated.
From this we concluded that the Image is AI generated and has no connection with the claim made in the viral social media posts. We have also previously debunked AI Generated artwork of sand sculpture of Indian Cricketer Virat Kohli which had the same types of anomalies as those seen in this case.
Conclusion:
Taking into consideration the distortions spotted in the images and the result of AI detection tools, it can be concluded that the claim of the pictures representing the child's sand sculptures of cricketer Mahendra Singh Dhoni is false. The pictures are created with Artificial Intelligence. It is important to check and authenticate the content before posting it to social media websites.
- Claim: The frame of pictures shared on social media contains child's sand sculptures of cricket player Mahendra Singh Dhoni.
- Claimed on: X (formerly known as Twitter), Instagram, Facebook, YouTube
- Fact Check: Fake & Misleading
