#FactCheck: Video of Khadija Belghoum and Billy Rahman Falsely Linked to Bangladeshi Nationals Executed in Saudi Arabia
Executive Summary
A video is being shared on social media with the claim that it shows a Bangladeshi couple sentenced to death in Saudi Arabia. In the video, a woman is seen telling her husband that she is pregnant. The claim states that the woman's only “crime” was that she was about to become a mother, and that Saudi Arabia sentenced not two, but three people to death. CyberPeace Research found that the couple shown in the video are husband and wife and have no connection to the Bangladeshi nationals sentenced to death in Saudi Arabia.
Claim
An X user shared the viral video with the following caption: “This is the Bangladeshi couple. Her only crime was that she was about to become a mother. She told her husband, ‘You are going to be a father.’ Hearing this, tears welled up in his eyes, and he kissed his wife's forehead out of joy. Saudi Arabia has sentenced not two, but three people to death.”
View the archived post here. Similar posts can be found here and here.
https://x.com/imarpit96/status/2113128510848172287
Fact Check
To verify the viral video being shared as showing a Bangladeshi couple sentenced to death in Saudi Arabia, we conducted a reverse image search of its keyframes. During the search, we found the same video uploaded on August 7, 2026, on the Instagram account of Khadija Belghoum (@khadijabelgoum).
Text overlaid on the video reads, “I told my husband that I am pregnant.” In the caption, the woman also wrote that she gave her husband the most precious gift at the holiest place during the most difficult time. The post also tags her husband, Billy Rahman, on Instagram. Additionally, the hashtag Mecca was included in the post.
https://www.instagram.com/p/DbtdSc
During our research into the claim, we found a report published on October 19, 2026, by Bangladeshi news website Jago News. According to the report, Nazrul Islam and Sweety Akhtar, who were sentenced to death in Saudi Arabia, were being described as husband and wife in social media posts. However, Nazrul's father, Abdul Bashir, refuted this claim. Speaking to Jago News, he said that Sweety was not Nazrul's wife and that his family did not even know her. According to the report, he also said that Nazrul had worked for only six months after arriving in Saudi Arabia, following which he spent three years and three months in prison. The family was still unaware of the reason for his arrest.
https://www.jagonews24.com/en/national/news/97248
Conclusion
The evidence gathered during our research clearly establishes that the claim accompanying the viral video is false. The couple shown in the video are Khadija Belghoum and Billy Rahman, who are husband and wife. They have no connection to the Bangladeshi nationals who were executed in Saudi Arabia.
Related Blogs
Executive Summary:
A new threat being uncovered in today’s threat landscape is that while threat actors took an average of one hour and seven minutes to leverage Proof-of-Concept(PoC) exploits after they went public, now the time is at a record low of 22 minutes. This incredibly fast exploitation means that there is very limited time for organizations’ IT departments to address these issues and close the leaks before they are exploited. Cloudflare released the Application Security report which shows that the attack percentage is more often higher than the rate at which individuals invent and develop security countermeasures like the WAF rules and software patches. In one case, Cloudflare noted an attacker using a PoC-based attack within a mere 22 minutes from the moment it was released, leaving almost no time for a remediation window.
Despite the constant growth of vulnerabilities in various applications and systems, the share of exploited vulnerabilities, which are accompanied by some level of public exploit or PoC code, has remained relatively stable over the past several years and fluctuates around 50%. These vulnerabilities with publicly known exploit code, 41% was initially attacked in the zero-day mode while of those with no known code, 84% was first attacked in the same mode.
Modus Operandi:
The modus operandi of the attack involving the rapid weaponization of proof-of-concept (PoC) exploits is characterized by the following steps:
- Vulnerability Identification: Threat actors bring together the exploitation of a system vulnerability that may be in the software or hardware of the system; this may be a code error, design failure, or a configuration error. This is normally achieved using vulnerability scanners and test procedures that have to be performed manually.
- Vulnerability Analysis: After the vulnerability is identified, the attackers study how it operates to determine when and how it can be triggered and what consequences that action will have. This means that one needs to analyze the details of the PoC code or system to find out the connection sequence that leads to vulnerability exploitation.
- Exploit Code Development: Being aware of the weakness, the attackers develop a small program or script denoted as the PoC that addresses exclusively the identified vulnerability and manipulates it in a moderated manner. This particular code is meant to be utilized in showing a particular penalty, which could be unauthorized access or alteration of data.
- Public Disclosure and Weaponization: The PoC exploit is released which is frequently done shortly after the vulnerability has been announced to the public. This makes it easier for the attackers to exploit it while waiting for the software developer to release the patch. To illustrate, Cloudflare has spotted an attacker using the PoC-based exploit 22 minutes after the publication only.
- Attack Execution: The attackers then use the weaponized PoC exploit to attack systems which are known to be vulnerable to it. Some of the actions that are tried in this context are attempts at running remote code, unauthorized access and so on. The pace at which it happens is often much faster than the pace at which humans put in place proper security defense mechanisms, such as the WAF rules or software application fixes.
- Targeted Operations: Sometimes, they act as if it’s a planned operation, where the attackers are selective in the system or organization to attack. For example, exploitation of CVE-2022-47966 in ManageEngine software was used during the espionage subprocess, where to perform such activity, the attackers used the mentioned vulnerability to install tools and malware connected with espionage.
Precautions: Mitigation
Following are the mitigating measures against the PoC Exploits:
1. Fast Patching and New Vulnerability Handling
- Introduce proper patching procedures to address quickly the security released updates and disclosed vulnerabilities.
- Focus should be made on the patching of those vulnerabilities that are observed to be having available PoC exploits, which often risks being exploited almost immediately.
- It is necessary to frequently check for the new vulnerability disclosures and PoC releases and have a prepared incident response plan for this purpose.
2. Leverage AI-Powered Security Tools
- Employ intelligent security applications which can easily generate desirable protection rules and signatures as attackers ramp up the weaponization of PoC exploits.
- Step up use of artificial intelligence (AI) - fueled endpoint detection and response (EDR) applications to quickly detect and mitigate the attempts.
- Integrate Artificial Intelligence based SIEM tools to Detect & analyze Indicators of compromise to form faster reaction.
3. Network Segmentation and Hardening
- Use strong networking segregation to prevent the attacker’s movement across the network and also restrict the effects of successful attacks.
- Secure any that are accessible from the internet, and service or protocols such as RDP, CIFS, or Active directory.
- Limit the usage of native scripting applications as much as possible because cyber attackers may exploit them.
4. Vulnerability Disclosure and PoC Management
- Inform the vendors of the bugs and PoC exploits and make sure there is a common understanding of when they are reported, to ensure fast response and mitigation.
- It is suggested to incorporate mechanisms like digital signing and encryption for managing and distributing PoC exploits to prevent them from being accessed by unauthorized persons.
- Exploits used in PoC should be simple and independent with clear and meaningful variable and function names that help reduce time spent on triage and remediation.
5. Risk Assessment and Response to Incidents
- Maintain constant supervision of the environment with an intention of identifying signs of a compromise, as well as, attempts of exploitation.
- Support a frequent detection, analysis and fighting of threats, which use PoC exploits into the system and its components.
- Regularly communicate with security researchers and vendors to understand the existing threats and how to prevent them.
Conclusion:
The rapid process of monetization of Proof of Concept (POC) exploits is one of the most innovative and constantly expanding global threats to cybersecurity at the present moment. Cyber security experts must react quickly while applying a patch, incorporate AI to their security tools, efficiently subdivide their networks and always heed their vulnerability announcements. Stronger incident response plan would aid in handling these kinds of menaces. Hence, applying measures mentioned above, the organizations will be able to prevent the acceleration of turning PoC exploits into weapons and the probability of neutral affecting cyber attacks.
Reference:
https://www.mayrhofer.eu.org/post/vulnerability-disclosure-is-positive/
https://www.uptycs.com/blog/new-poc-exploit-backdoor-malware
https://www.balbix.com/insights/attack-vectors-and-breach-methods/
https://blog.cloudflare.com/application-security-report-2024-update
Executive Summary:
The picture of a boy making sand art of Indian Cricketer Virat Kohli spreading in social media, claims to be false. The picture which was portrayed, revealed not to be a real sand art. The analyses using AI technology like 'Hive' and ‘Content at scale AI detection’ confirms that the images are entirely generated by artificial intelligence. The netizens are sharing these pictures in social media without knowing that it is computer generated by deep fake techniques.
Claims:
The collage of beautiful pictures displays a young boy creating sand art of Indian Cricketer Virat Kohli.
Fact Check:
When we checked on the posts, we found some anomalies in each photo. Those anomalies are common in AI-generated images.
The anomalies such as the abnormal shape of the child’s feet, blended logo with sand color in the second image, and the wrong spelling ‘spoot’ instead of ‘sport’n were seen in the picture. The cricket bat is straight which in the case of sand made portrait it’s odd. In the left hand of the child, there’s a tattoo imprinted while in other photos the child's left hand has no tattoo. Additionally, the face of the boy in the second image does not match the face in other images. These made us more suspicious of the images being a synthetic media.
We then checked on an AI-generated image detection tool named, ‘Hive’. Hive was found to be 99.99% AI-generated. We then checked from another detection tool named, “Content at scale”
Hence, we conclude that the viral collage of images is AI-generated but not sand art of any child. The Claim made is false and misleading.
Conclusion:
In conclusion, the claim that the pictures showing a sand art image of Indian cricket star Virat Kohli made by a child is false. Using an AI technology detection tool and analyzing the photos, it appears that they were probably created by an AI image-generated tool rather than by a real sand artist. Therefore, the images do not accurately represent the alleged claim and creator.
Claim: A young boy has created sand art of Indian Cricketer Virat Kohli
Claimed on: X, Facebook, Instagram
Fact Check: Fake & Misleading
Executive Summary
Amid the ongoing geopolitical tensions involving the US, Israel, and Iran, and reports of disruptions in the Strait of Hormuz affecting cargo ship movement and global crude oil prices, several posts on social media have made a viral claim. The posts allege that Indian cargo vessels are being allowed to pass through the Strait of Hormuz after payments to Iran were made in Chinese currency, the yuan. The claim has been widely circulated from certain social media accounts, suggesting a shift in India’s trade and payment arrangements. However, a fact-check by CyberPeace Research Wing has found the claim to be false.
Claim
A social media user “MEHF voice 2.0” shared a viral post (archived link), claiming that an Indian oil tanker secured passage through the Strait of Hormuz by making payments in Chinese yuan. The post further suggested that India had formed a new alignment with China, bypassing the US dollar system.
Fact Check
Due to US sanctions, Iran is excluded from the international banking network SWIFT, which prevents direct trade settlements in US dollars or euros. As a result, India and Iran conduct trade through a specially designed rupee–rial payment mechanism. According to a Ministry of Commerce and Industry release (based on a written reply in Parliament), India and Iran established this arrangement to facilitate bilateral trade using local currencies instead of the US dollar.
Further, information from the Indian Embassy in Tehran notes that rupee-based payments are processed through UCO Bank and Iranian banks with vostro accounts, enabling trade settlement outside sanctioned banking channels. IDBI Bank has also been part of efforts to expand rupee-based transactions with Iran.
The Ministry of External Affairs’ official fact-check handle has also debunked this claim, confirming that it is false.
Conclusion
The viral claim that Indian oil tankers are paying in Chinese yuan to pass through the Strait of Hormuz is false. India and Iran conduct trade settlements through a rupee–rial payment mechanism, not through the Chinese currency.
