Deepfake Watchlist tracks election attacks, abusive apps and crypto fraud

AI-edited local news footage targeted Senate candidates

Resemble AI's featured case concerns Storm-1516, a Russian influence network that allegedly altered genuine local television reports to make them appear to contain fabricated abuse allegations against Ohio Senate candidate Sherrod Brown and Maine Senate candidate Troy Jackson. PolitiFact, NewsGuard and the Associated Press traced the videos to the network, according to the watchlist.

The altered material used footage from Cleveland 19 News and WABI-TV. In one case, the lip movements of Cleveland 19 reporter Nicole Vransky were changed to match words she did not say. In another, a genuine WABI-TV report about Jackson throwing a water bottle was edited to suggest that he had threatened staffers with an axe. Former Brown staffers named in the video told PolitiFact and the Associated Press that the allegations attributed to them were false.

Resemble AI says the operation shifted from using actors to using AI, citing PolitiFact's reporting. It also argues that provenance signatures applied by broadcasters when publishing footage could help viewers and platforms check whether a clip still matches the original broadcast. Brown, Jackson and Talarico all won their races on November 3, but the watchlist says that did not undo the harm to people whose identities and words were used.

Ordinary apps concealed sexual deepfake features

A WIRED investigation identified more than 400 linked apps and websites that presented themselves as services such as pet-portrait generators, workout coaches and language tutors while concealing tools for creating sexual deepfakes from uploaded photos. Apple removed 19 apps after WIRED shared its findings.

AI Forensics researchers found 27 of the apps on Google Play in September, with more than 350,000 combined downloads. The abusive interface appeared only after an external server assessed information such as a user's language, referral source and identifiers. Infoblox linked the operation to nearly 500 related domains.

Meta said it took action against 11,600 ad accounts and blocked 209 apps from advertising. Apple said the apps met its rules at review and that developers later changed what they loaded. Resemble AI reports that similar apps and advertisements continued to appear while WIRED was reporting the story.

A fake interview preceded Binance's record theft

Binance's November 3 incident report traced its October 29 theft to a fake recruitment process, according to Help Net Security. An engineer was interviewed by an impostor HR representative and a supposed CEO of a fictitious company, then asked to run a malware-laced coding assessment on a work computer.

The reported sequence moved from a fake project director on a legitimate job platform to staged HR and CEO interviews, a malicious assessment repository, an internal AI tool used to compromise two more engineers and the abuse of a wallet-signing service. The FBI attributed the theft to North Korea's TraderTraitor group. Binance said its findings would receive further independent review.

Binance has not said whether the people shown during the video screening were deepfakes. It did say it detected and stopped 57 suspected North Korea-linked attempts this year, including fake job interviews, poisoned developer tools and fake video-call apps. The case puts identity verification in recruiting alongside endpoint protection as a security concern, according to Resemble AI.