#FactCheck-AI-Generated Video Falsely Shared as Real Footage of Iran Attack
Executive Summary
A video showing flames and thick smoke rising over a densely populated city at night is being widely circulated on social media. The video is being shared with the claim that it shows the actual visuals of explosions and destruction caused by an attack on Iran. CyberPeace Research Wing ’s research found the viral claim to be false. Our research revealed that the video is not real footage but an AI-generated video, which is being circulated with a false claim.
Claim
A user on social media platform Instagram shared the viral video on July 17, 2026, claiming that it shows the real visuals of an attack on Iran and the massive explosions caused by it.
https://www.instagram.com/reel/Da1_gaXyyoP/?utm_source=ig_web_copy_link&igsh=NTc4MTIwNjQ2YQ==
Fact Check
To verify the authenticity of the viral claim, we extracted multiple keyframes from the video and conducted a reverse image search using Google Lens. During the research, we did not find any credible news report, verified video, or authentic source confirming that the footage was related to any attack on Iran. To further examine the authenticity of the video, we analysed it using multiple AI detection tools. First, we scanned the video using Hive Moderation. The tool’s analysis indicated that the video had a 94.9% probability of being AI-generated, suggesting that the footage may have been created using Artificial Intelligence.
For additional verification, we analysed the video using DetectVideo AI. The tool also indicated that the video was likely AI-generated, with an estimated 80% probability.
We further checked the video using another AI detection tool, AI or Not, which suggested that the footage had a 64% probability of being AI-generated.
At the final stage of verification, we used WasIt.AI, which also indicated that the video was likely AI-generated, with an 88% probability.
Conclusion
CyberPeace Research Wing ’s research found that the viral video does not show real footage of an attack on Iran.The video was created using Artificial Intelligence (AI) and is being falsely shared as authentic visuals of explosions and destruction caused by an attack on Iran. Users are advised to verify such sensational claims before sharing them online.
Related Blogs
Executive Summary
Several social media posts are claiming that Chinese troops have entered nearly 60 kilometres inside Arunachal Pradesh. Amid these claims, a video showing security personnel managing a large crowd is being widely circulated as footage from Arunachal Pradesh. Users are sharing the clip claiming it captures the situation following the alleged Chinese intrusion. CyberPeace Research Wing found the claim to be false. The viral video is not from Arunachal Pradesh. It actually shows Baltal Base Camp during the Amarnath Yatra in Jammu and Kashmir. The Government of India has also categorically denied reports of any recent Chinese intrusion into Indian territory.
Claim
A Facebook user, "Komal Vanshi," shared the video on July 8, 2026, claiming that Chinese People's Liberation Army (PLA) soldiers had entered deep inside Arunachal Pradesh and referring to alleged incidents along the Line of Actual Control (LAC). The post was accompanied by the viral video, suggesting it was related to the alleged intrusion.
https://www.facebook.com/reel/1585091393251089
Fact Check
We first carefully examined the viral video. During the analysis, we noticed barricades bearing the words "Jammu & Kashmir Police." This clearly indicated that the footage could not have been recorded in Arunachal Pradesh.
In the next step, we extracted multiple keyframes from the video and conducted a reverse image search using Google Lens. Although the video was widely shared with the Arunachal Pradesh claim, our search led us to a YouTube Shorts video uploaded on July 7, 2026, identifying the location as Baltal, one of the main base camps for the annual Amarnath Yatra in Jammu and Kashmir.
https://www.youtube.com/watch?v=EEfP2RckyJM
The visual details in the YouTube video matched the viral footage, confirming that it was filmed at Baltal Base Camp and had no connection with Arunachal Pradesh or any alleged Chinese military movement
Conclusion
CyberPeace Research Wing found that the viral claim is false. The video being circulated as evidence of a Chinese military incursion into Arunachal Pradesh actually shows crowd management arrangements at Baltal Base Camp during the Amarnath Yatra in Jammu and Kashmir. The footage has been falsely linked to an unrelated claim about Chinese troops entering Indian territory. There is no evidence that the video depicts any incident related to the India-China border.
Introduction
Cyber-attacks are another threat in this digital world, not exclusive to a single country, that could significantly disrupt global movements, commerce, and international relations all of which experienced first-hand when a cyber-attack occurred at Heathrow, the busiest airport in Europe, which threw their electronic check-in and baggage systems into a state of chaos. Not only were there chaos and delays at Heathrow, airports across Europe including Brussels, Berlin, and Dublin experienced delay and had to conduct manual check-ins for some flights further indicating just how interconnected the world of aviation is in today's world. Though Heathrow assured passengers that the "vast majority of flights" would operate, hundreds were delayed or postponed for hours as those passengers stood in a queue while nearly every European airport's flying schedule was also negatively impacted.
The Anatomy of the Attack
The attack specifically targeted Muse software by Collins Aerospace, a software built to allow various airlines to share check-in desks and boarding gates. The disruption initially perceived to be technical issues soon turned into a logistical nightmare, with airlines relying on Muse having to engage in horror-movie-worthy manual steps hand-tagging luggage, verifying boarding passes over the phone, and manually boarding passengers. While British Airways managed to revert to a backup system, most other carriers across Heathrow and partner airports elsewhere in Europe had to resort to improvised manual solutions.
The trauma was largely borne by the passengers. Stories emerged about travelers stranded on the tarmac, old folks left barely able to walk without assistance, and even families missing important connections. It served to remind everyone that the aviation world, with its schedules interlocked tightly across borders, can see even a localized system failure snowball into a continental-level crisis.
Cybersecurity Meets Aviation Infrastructure
In the last two decades, aviation has become one of the more digitally dependent industries in the world. From booking systems and baggage handling issues to navigation and air traffic control, digital systems are the invisible scaffold on which flight operations are supported. Though this digitalization has increased the scale of operations and enhanced efficiency, it must have also created many avenues for cyber threats. Cyber attackers increasingly realize that to target aviation is not just about money but about leverage. Just interfering with the check-in system of a major hub like Heathrow is more than just financial disruption; it causes panic and hits the headlines, making it much more attractive for criminal gangs and state-sponsored threat actors.
The Heathrow incident is like the worldwide IT crash in July 2024-thwarting activities of flights caused by a botched Crowdstrike update. Both prove the brittleness of digital dependencies in aviation, where one failure point triggering uncontrollable ripple effects spanning multiple countries. Unlike conventional cyber incidents contained within corporate networks, cyber-attacks in aviation spill on to the public sphere in real time, disturbing millions of lives.
Response and Coordination
Heathrow Airport first added extra employees to assist with manual check-in and told passengers to check flight statuses before traveling. The UK's National Cyber Security Centre (NCSC) collaborated with Collins Aerospace, the Department for Transport, and law enforcement agencies to investigate the extent and source of the breach. Meanwhile, the European Commission published a statement that they are "closely following the development" of the cyber incident while assuring passengers that no evidence of a "widespread or serious" breach has been observed.
According to passengers, the reality was quite different. Massive passenger queues, bewildering announcements, and departure time confirmations cultivated an atmosphere of chaos. The wrenching dissonance between the reassurances from official channel and Kirby needs to be resolved about what really happens in passenger experiences. During such incidents, technical restoration and communication flow are strategies for retaining public trust in incidents.
Attribution and the Shadow of Ransomware
As with many cyber-attacks, questions on its attribution arose quite promptly. Rumours of hackers allegedly working for the Kremlin escaped into the air quite possibly inside seconds of the realization, Cybersecurity experts justifiably advise against making conclusions hastily. Extortion ransomware gangs stand the last chance to hold the culprits, whereas state actors cannot be ruled out, especially considering Russian military activity under European airspace. Meanwhile, Collins Aerospace has refused to comment on the attack, its precise nature, or where it originated, emphasizing an inherent difficulty in cyberattribution.
What is clear is the way these attacks bestow criminal leverage and dollars. In previous ransomware attacks against critical infrastructure, cybercriminal gangs have extorted millions of dollars from their victims. In aviation terms, the stakes grow exponentially, not only in terms of money but national security and diplomatic relations as well as human safety.
Broader Implications for Aviation Cybersecurity
This incident brings to consideration several core resilience issues within aviation systems. Traditionally, the airports and airlines had placed premium on physical security, but today, the equally important concept of digital resilience has come into being. Systems such as Muse, which bind multiple airlines into shared infrastructure, offer efficiency but, at the same time, also concentrate that risk. A cyber disruption in one place will cascade across dozens of carriers and multiple airports, thereby amplifying the scale of that disruption.
The case also brings forth redundancy and contingency planning as an urgent concern. While BA systems were able to stand on backups, most other airlines could not claim that advantage. It is about time that digital redundancies, be it in the form of parallel systems or isolated backups or even AI-driven incident response frameworks, are built into aviation as standard practice and soon.
On the policy plane, this incident draws attention to the necessity for international collaboration. Aviation is therefore transnational, and cyber incidents standing on this domain cannot possibly be handled by national agencies only. Eurocontrol, the European Commission, and cross-border cybersecurity task forces must spearhead this initiative to ensure aviation-wide resilience.
Human Stories Amid a Digital Crisis
Beyond technical jargon and policy response, the human stories had perhaps the greatest impact coming from Heathrow. Passengers spoke of hours spent queuing, heading to funerals, and being hungry and exhausted as they waited for their flights. For many, the cyber-attack was no mere headline; instead, it was ¬ a living reality of disruption.
These stories reflect the fact that cybersecurity is no hunger strike; it touches people's lives. In critical sectors such as aviation, one hour of disruption means missed connections for passengers, lost revenue for airlines, and inculcates immense emotional stress. Crisis management must therefore entail technical recovery and passenger care, communication, and support on the ground.
Conclusion
The cybersecurity crisis of Heathrow and other European airports emphasizes the threat of cyber disruption on the modern legitimacy of aviation. The use of increased connectivity for airport processes means that any cyber disruption present, no matter how small, can affect scheduling issues regionally or on other continents, even threatening lives. The occurrences confirm a few things: a resilient solution should provide redundancy not efficiency; international networking and collaboration is paramount; and communicating with the traveling public is just as important (if not more) as the technical recovery process.
As governments, airlines, and technology providers analyse the disruption, the question is longer if aviation can withstand cyber threats, but to what extent it will be prepared to defend itself against those attacks. The Heathrow crisis is a reminder that the stake of cybersecurity is not just about a data breach or outright stealing of money but also about stealing the very systems that keep global mobility in motion. Now, the aviation industry is tested to make this disruption an opportunity to fortify the digital defences and start preparing for the next inevitable production.
References
- https://www.bbc.com/news/articles/c3drpgv33pxo
- https://www.theguardian.com/business/2025/sep/21/delays-continue-at-heathrow-brussels-and-berlin-airports-after-alleged-cyber-attack
- https://www.reuters.com/business/aerospace-defense/eu-agency-says-third-party-ransomware-behind-airport-disruptions-2025-09-22/
Amid reports that the death toll in Iran’s ongoing protests has risen to 2,571, a video has been widely circulated on social media showing a man slapping a person dressed in clerical attire after an argument. Users sharing the clip claim that public anger in Iran has escalated to the point where people are now physically attacking religious clerics. However, research by the Cyber Peace Foundation has found this claim to be misleading. The research established that the video is not recent and has no connection to the current protests in Iran. In fact, the clip dates back to 2021 and was entirely scripted.
Claim
On January 14, 2026, users on X (formerly Twitter) shared the viral video with captions suggesting that Iranian citizens are openly assaulting clerics amid the ongoing unrest. One such post stated that the situation in Iran had deteriorated so badly that people were now beating religious leaders.
The link, archived version, and screenshot of the post are available below:
Factcheck:
To verify the authenticity of the claim, the Cyber Peace Foundation extracted keyframes from the viral video and conducted a Google reverse image search. This led investigators to a report published on April 19, 2021, on the Persian-language website of Deutsche Welle (DW). The visuals matched the viral clip exactly, confirming that the footage is nearly five years old, not recent. Here is the link to the original video, along with a screenshot:
Further examination of reports by Fars News Agency revealed that Tehran police had conducted a detailed probe into the video at the time and declared it fake and pre-scripted. According to Tehran Police Chief Hossein Rahimi, the individual seen wearing religious attire was not a cleric. Here is the link to the original video, along with a screenshot: He was actually employed at a carpet cleaning shop in Tehran, while the man seen slapping him was his own son.
Police stated that the video was deliberately staged and circulated to provoke public sentiment and create unrest by falsely linking it to religious tensions. Both the father and son were arrested, and images of them in police custody were published in contemporaneous reports. Additional confirmation was found on the Independent Persian website, which had also reported on the incident on April 19, 2021, reiterating that the video was fabricated and unrelated to any protest movement. Here is the link to the original video, along with a screenshot:
Conclusion
The claim that the viral video shows an Iranian protester slapping a cleric during the current wave of protests is false. The video is from 2021, was scripted, and has no link to the ongoing demonstrations in Iran. It is being reshared with a misleading narrative to spread disinformation and inflame public sentiment.c
