#FactCheck: AI-Generated Video Falsely Shows Captain Smith Machhar’s Image Displayed on Burj Khalifa

Introduction

The advent of frontier AI has significantly widened the range of actors who can launch cyberattacks, extending beyond state actors with immense capabilities or organized professional cybercriminal rings. In its most critical advisory, CIAD-2026-0020, titled "Defending against frontier AI-driven cyber risks," which was released on April 26, 2026, the Indian Computer Emergency Response Team (CERT-In) officially stated that AI can now carry out autonomous cyber activities of unprecedented scale and speed. The advisory highlights that these frontier AI models can perform automated reconnaissance, phishing, malware creation, vulnerability identification, and social engineering with minimal human involvement, thus "lowering the barrier to orchestrating complex cyber attacks." The risks that such AI models pose are not restricted to state actors and corporate entities anymore and also extend to MSMEs, public organizations, and individuals.

‍

India’s Escalating Cybercrisis

The Indian digital economy has been developing at a very fast pace, but the same cannot be said about its cybersecurity. Having a base of over 850 million internet users and a digital payment sector that records a massive 22,495 crore in monthly transaction volumes, coupled with the fastest-growing cloud sector in the world, India continues to remain a lucrative prey for cybercriminals. There were over 265 million attempts reported in the last year, 2025, alone, where close to 46% of all incidents detected were in enterprises with fewer than 1,000 employees, a very grave reality for MSMEs. MHA confirmed there were 28.15 lakh reported cybercrime complaints in 2025 as compared to 2024, with a jump of 24%. In this worsening environment the advisory is a breakthrough in Indian cyber governance. Where previously advisories covered only conventional threats like phishing and malware, the new warning names frontier agentic AI systems as autonomous multipliers of threats, capable of conducting operations at scale and speed with significantly reduced human oversight.

‍

What is “Frontier AI” and why does it matter?

CERT-In’s decision to adopt the term "Frontier AI" is deliberate and meaningful. The advisory’s scope is a new category of agentic AI, which moves well beyond traditional chatbot-style AI, having the capacity to reason, plan, perform multiple actions in a single task autonomously, and carry out complicated tasks with minimal or no human guidance. CERT-In highlights that these tools now possess the capabilities that were "previously carried out by a coordinated team of skilled cybersecurity professionals." The advisory clearly flags the risk that these advanced models have the capability to generate malicious code, conduct network scans, probe systems for vulnerabilities, and even orchestrate intricate multi-stage cyberattacks in a single session. Their capacity to analyse a vast number of source code libraries to identify vulnerabilities, even unknown zero-day ones, and then develop proof-of-concept exploits at high speed. This means that the historical lead time to turn a vulnerability discovery into an exploit tool has reduced from weeks to just hours.

‍

Six Core Threat Vectors identified by CERT-In

1. AI-driven Automatic Zero-Day Discovery: AI-based solutions discover zero-day vulnerabilities and automatically create exploits in minutes, reducing the time taken by defenders.
2. AI-driven Autonomous Reconnaissance: AI-driven agents scan cloud infra, APIs, and enterprise networks and outline attack vectors.
3. AI-driven phishing & deepfakes: Multilingual, highly targeted phishing emails, deepfake audio, and deepfake voice/video calls bring sophistication to social engineering.
4. Deepfake Financial Fraud: AI creates deepfake executives for high-value money transfers. For example, reports have indicated crore-level fund loss cases in India.
5. AI-powered Autonomous Attack Chains: Advanced AI models are able to automatically perform multiple malicious stages like privilege escalation, lateral movement, data exfiltration, and data extraction.
6. Cascading failures of interconnected systems: A single AI-supported security breach can have catastrophic domino effects on connected digital systems and critical infrastructures.

‍

Why are MSMEs a target?

CERT-In’s warning is specifically targeted toward the weakness of the Indian MSMEs. Contributing almost 30% to India's GDP and employing over 110 million individuals, most MSMEs have failed to adequately prepare themselves against contemporary cyber threats. While a large corporation would have a full-time cybersecurity team, a security operation centre, and frequent vulnerability assessments, the majority of MSMEs lack such infrastructure due to budget constraints, out-of-date software, etc. This lack of security has proved to be quite disadvantageous for smaller businesses, as India was identified as one of the top global targets for cyberattacks, where approximately 46% of the total breaches worldwide targeted organizations having fewer than 1000 employees. The advisory claims that frontier AI systems have significantly increased the threats, for the skills necessary to carry out advanced cyberattacks have dramatically decreased. Ransomware, phishing and data exfiltration can be executed by even unsophisticated attackers. The aftermath could result in critical financial, operational, and compliance impact on these MSMEs.

‍

The Global Context

These developments seem to validate CERT-In's warning about threats posed by frontier AI. In its 2026 State of Cybersecurity Report, ISACA listed AI-related threats as the top concern of cybersecurity professionals; 61% of those surveyed reported generative AI/large language models as the top technology trend impacting cyber risk. Worryingly, in 2026 only 7% were confident in their organizations' defenses against ransomware. Check Point Software's Cyber Security Report 2026 corroborates this; in 2025 the report stated that in a single year, the trend of combined social engineering-based campaigns with automated operational execution has risen considerably. In all phases of the lifecycle of a cyberattack reconnaissance, social engineering, and tactical decision-making AI is being applied. KPMG is warning of deepfake-enabled fraud now "spreading at a faster rate than that experienced at the beginning of the phishing era, which is currently still the leading type of attack in the world."

‍

CERT-In Recommendations

‍

For Large Organisations:

‍

1. The use of security monitoring, threat detection, and log analysis should be increased.
2. DDoS protection systems and multi-factor authentication (MFA) should be implemented on all internet-facing devices and assets.
3. Critical security patches should be installed within 24 hours of release.
4. Old VPN and remote-access infrastructure should be updated or replaced.
5. AI-driven cyber drills and incident response simulations should be regularly performed.

‍For MSMEs:

‍

1. Software and security updates should be automatically enabled on all devices and systems.
2. MFA should be enabled on organisational accounts and sensitive platforms.
3. MSMEs should utilize MSSPs for specialized support and monitoring.
4. Detailed inventories of IT assets and system logs should be kept for fast incident response.
5. Staff should be educated about identifying AI-generated phishing, deepfakes, and scams.

‍

For Individuals:

‍

• Independent communication channels should be used to verify any dubious message or money request.
• Software from unverified sources or unauthorised channels should not be downloaded.
• The use of strong and unique passwords along with MFA wherever possible should be enforced.

‍

From Advisory to Action

The May 2026 cybersecurity road map released by CERT-In signals a departure from identification of threats to enabling operations against frontier AI-led cyber threat landscapes. This initiative builds on their April advice and delineates a clearly articulated three-phase roadmap comprising immediate cyber readiness, AI governance controls, and deep integration of AI-driven defenses. It also provides for the establishment of a focused AI Cyber Defense Center and various multisector governance provisions. A prominent area is the increased threat of impersonation via deepfakes, and companies are encouraged to institute executive verification procedures prior to approving high-value transactions. The framework also emphasizes the establishment of an AI asset register requiring formal accounting and governance of all AI systems utilized in an enterprise. Meanwhile, CERT-In also recognizes the twin-use nature of frontier AI: for every threat, the same technology can bolster security with automated threat detection, phishing, and log analysis in real time.  However, the deployment of state-of-the-art defenses is uneven, especially with MSMEs, where there isn’t the requisite domain expertise and funding for this infrastructure. Accordingly, the road map puts the emphasis on immediate and stronger cyber hygiene, compulsory incident reporting, enhancing AI literacy, and proper implementation of the Digital Personal Data Protection Act for long-term security investment and resilience.

‍

Conclusion

The CERT-In advisory CIAD-2026-0020 signifies a vital acknowledgment of AI's transformational impact on the cybersecurity ecosystem. Capabilities formerly exclusive to elite state actors are being deployed by low-skilled users, leveraging state-of-the-art frontier AI tools. India’s MSMEs, enterprises, and digital citizens are experiencing a rapidly accelerating threat milieu. In this context, the CERT-In advisory and the ensuing blueprint can no longer be dismissed as ordinary government pronouncements but as critical operational imperatives. It is the country’s ability over the next few years to shore up its collective cyber resilience to the ever-increasing scale and sophistication of AI-powered attacks that will prove crucial.

‍

References:

1. https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0020
2. https://www.zeebiz.com/technology/news-cert-in-flags-high-severity-ai-cyber-risks-amid-claude-mythos-concerns-394448
3. https://www.business-standard.com/technology/tech-news/cert-in-warning-ai-scams-frontier-models-mythos-gpt-5-5-what-it-means-126042800988_1.html
4. https://www.businesswire.com/news/home/20251020612551/en/
5. https://corporate.indiamart.com/2025/07/29/staying-ahead-of-cyber-threats/
6. https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2025/deepfakes-real-threat.pdf

‍

In the vast, uncharted territories of the digital world, a sinister phenomenon is proliferating at an alarming rate. It's a world where artificial intelligence (AI) and human vulnerability intertwine in a disturbing combination, creating a shadowy realm of non-consensual pornography. This is the world of deepfake pornography, a burgeoning industry that is as lucrative as it is unsettling.

According to a recent assessment, at least 100,000 deepfake porn videos are readily available on the internet, with hundreds, if not thousands, being uploaded daily. This staggering statistic prompts a chilling question: what is driving the creation of such a vast number of fakes? Is it merely for amusement, or is there a more sinister motive at play?

Recent Trends and Developments 

An investigation by India Today’s Open-Source Intelligence (OSINT) team reveals that deepfake pornography is rapidly morphing into a thriving business. AI enthusiasts, creators, and experts are extending their expertise, investors are injecting money, and even small financial companies to tech giants like Google, VISA, Mastercard, and PayPal are being misused in this dark trade. Synthetic porn has existed for years, but advances in AI and the increasing availability of technology have made it easier—and more profitable—to create and distribute non-consensual sexually explicit material. The 2023 State of Deepfake report by Home Security Heroes reveals a staggering 550% increase in the number of deepfakes compared to 2019. 

What’s the Matter with Fakes? 

But why should we be concerned about these fakes? The answer lies in the real-world harm they cause. India has already seen cases of extortion carried out by exploiting deepfake technology. An elderly man in UP’s Ghaziabad, for instance, was tricked into paying Rs 74,000 after receiving a deep fake video of a police officer. The situation could have been even more serious if the perpetrators had decided to create deepfake porn of the victim.

The danger is particularly severe for women. The 2023 State of Deepfake Report estimates that at least 98 percent of all deepfakes is porn and 99 percent of its victims are women. A study by Harvard University refrained from using the term “pornography” for creating, sharing, or threatening to create/share sexually explicit images and videos of a person without their consent. “It is abuse and should be understood as such,” it states.

Based on interviews of victims of deepfake porn last year, the study said 63 percent of participants talked about experiences of “sexual deepfake abuse” and reported that their sexual deepfakes had been monetised online. It also found “sexual deepfake abuse to be particularly harmful because of the fluidity and co-occurrence of online offline experiences of abuse, resulting in endless reverberations of abuse in which every aspect of the victim’s life is permanently disrupted”.

Creating deepfake porn is disturbingly easy. There are largely two types of deepfakes: one featuring faces of humans and another featuring computer-generated hyper-realistic faces of non-existing people. The first category is particularly concerning and is created by superimposing faces of real people on existing pornographic images and videos—a task made simple and easy by AI tools.

During the investigation, platforms hosting deepfake porn of stars like Jennifer Lawrence, Emma Stone, Jennifer Aniston, Aishwarya Rai, Rashmika Mandanna to TV actors and influencers like Aanchal Khurana, Ahsaas Channa, and Sonam Bajwa and Anveshi Jain were encountered. It takes a few minutes and as little as Rs 40 for a user to create a high-quality fake porn video of 15 seconds on platforms like FakeApp and FaceSwap.

The Modus Operandi 

These platforms brazenly flaunt their business association and hide behind frivolous declarations such as: the content is “meant solely for entertainment” and “not intended to harm or humiliate anyone”. However, the irony of these disclaimers is not lost on anyone, especially when they host thousands of non-consensual deepfake pornography.

As fake porn content and its consumers surge, deepfake porn sites are rushing to forge collaborations with generative AI service providers and have integrated their interfaces for enhanced interoperability. The promise and potential of making quick bucks have given birth to step-by-step guides, video tutorials, and websites that offer tools and programs, recommendations, and ratings.

Nearly 90 per cent of all deepfake porn is hosted by dedicated platforms that charge for long-duration premium fake content and for creating porn—of whoever a user wants, and take requests for celebrities. To encourage them further, they enable creators to monetize their content.

One such website, Civitai, has a system in place that pays “rewards” to creators of AI models that generate “images of real people'', including ordinary people. It also enables users to post AI images, prompts, model data, and LoRA (low-rank adaptation of large language models) files used in generating the images. Model data designed for adult content is gaining great popularity on the platform, and they are not only targeting celebrities. Common people are equally susceptible.

Access to premium fake porn, like any other content, requires payment. But how can a gateway process payment for sexual content that lacks consent? It seems financial institutes and banks are not paying much attention to this legal question. During the investigation, many such websites accepting payments through services like VISA, Mastercard, and Stripe were found.

Those who have failed to register/partner with these fintech giants have found a way out. While some direct users to third-party sites, others use personal PayPal accounts to manually collect money in the personal accounts of their employees/stakeholders, which potentially violates the platform's terms of use that ban the sale of “sexually oriented digital goods or content delivered through a digital medium.”

 Among others, the MakeNude.ai web app – which lets users “view any girl without clothing” in “just a single click” – has an interesting method of circumventing restrictions around the sale of non-consensual pornography. The platform has partnered with Ukraine-based Monobank and Dublin’s BetaTransfer Kassa which operates in “high-risk markets”.

BetaTransfer Kassa admits to serving “clients who have already contacted payment aggregators and received a refusal to accept payments, or aggregators stopped payments altogether after the resource was approved or completely freeze your funds”. To make payment processing easy, MakeNude.ai seems to be exploiting the donation ‘jar’ facility of Monobank, which is often used by people to donate money to Ukraine to support it in the war against Russia.

The Indian Scenario 

India currently is on its way to design dedicated legislation to address issues arising out of deepfakes. Though existing general laws requiring such platforms to remove offensive content also apply to deepfake porn. However, persecution of the offender and their conviction is extremely difficult for law enforcement agencies as it is a boundaryless crime and sometimes involves several countries in the process.

A victim can register a police complaint under provisions of Section 66E and Section 66D of the IT Act, 2000. Recently enacted Digital Personal Data Protection Act, 2023 aims to protect the digital personal data of users. Recently Union Government issued an advisory to social media intermediaries to identify misinformation and deepfakes. Comprehensive law promised by Union IT minister Ashwini Vaishnav will be able to address these challenges.

Conclusion 

In the end, the unsettling dance of AI and human vulnerability continues in the dark web of deepfake pornography. It's a dance that is as disturbing as it is fascinating, a dance that raises questions about the ethical use of technology, the protection of individual rights, and the responsibility of financial institutions. It's a dance that we must all be aware of, for it is a dance that affects us all.

References

• https://www.indiatoday.in/india/story/deepfake-porn-artificial-intelligence-women-fake-photos-2471855-2023-12-04
• https://www.hindustantimes.com/opinion/the-legal-net-to-trap-peddlers-of-deepfakes-101701520933515.html
• https://indianexpress.com/article/opinion/columns/with-deepfakes-getting-better-and-more-alarming-seeing-is-no-longer-believing/

Executive Summary:

‍

Recently, our team came across a widely circulated post on X (formerly Twitter), claiming that the Indian government would abolish paper currency from February 1 and transition entirely to digital money. The post, designed to resemble an official government notice, cited the absence of advertisements in Kerala newspapers as supposed evidence—an assertion that lacked any substantive basis

‍

‍

Claim:

‍

The Indian government will ban paper currency from February 1, 2025, and adopt digital money as the sole legal tender to fight black money.

‍

‍

‍

Fact Check:

‍

The claim that the Indian government will ban paper currency and transition entirely to digital money from February 1 is completely baseless and lacks any credible foundation. Neither the government nor the Reserve Bank of India (RBI) has made any official announcement supporting this assertion.

Furthermore, the supposed evidence—the absence of specific advertisements in Kerala newspapers—has been misinterpreted and holds no connection to any policy decisions regarding currency

During our research, we found that this was the prediction of what the newspaper from the year 2050 would look like and was not a statement that the notes will be banned and will be shifted to digital currency.

Such a massive change would necessitate clear communication to the public, major infrastructure improvements, and precise policy announcements which have not happened. This false rumor has widely spread on social media without even a shred of evidence from its source, which has been unreliable and is hence completely false.

We also found a clip from a news channel to support our research by asianetnews on Instagram. 

‍

‍

‍

We found that the event will be held in Jain Deemed-to-be University, Kochi from 25th January to 1st February. After this advertisement went viral and people began criticizing it, the director of "The Summit of Future 2025" apologized for this confusion. According to him, it was a fictional future news story with a disclaimer, which was misread by some of its readers.

‍

The X handle of Summit of Future 2025 also posted a video of the official statement from Dr Tom.

‍

‍

‍

Conclusion:

‍

The claim that the Indian government will discontinue paper currency by February 1 and resort to full digital money is entirely false. There's no government announcement nor any evidence to support it. We would like to urge everyone to refer to standard sources for accurate information and be aware to avoid misinformation online.

• Claim: India to ban paper currency from February 1, switching to digital money.
• Claimed On: X (Formerly Known As Twitter)
• Fact Check: False and Misleading