Russian-linked operators are flooding X with AI-made videos aimed at Democratic candidates before the midterms, according to a Bloomberg investigation. Bloomberg analyzed 130 fabricated videos and fake newspaper front pages posted between September 10 and October 9, 2026, and researchers it cites attribute them to Matryoshka, also known as Operation Overload, believed to be backed by the Russian state.
This is a "what is confirmed" post. The core reporting comes from Bloomberg, which is paywalled, so we rely on Bloomberg Government's summary, La Voce di New York's report and the AI Incident Database entry. We attribute every claim to its source and mark what nobody has verified. It adds to our earlier reporting on the Storm-1516 Talarico deepfake, a different network.
TL;DR: confirmed, attributed, unknown
| Question | Answer |
|---|---|
| How many fakes? | 130 videos and doctored front pages, September 10 to October 9 (Bloomberg's analysis) |
| Who is behind it? | Attributed by researchers to Matryoshka / Operation Overload; not a government finding in the sources we read |
| What do they show? | AI-made clips of celebrities such as Robert De Niro, Julia Roberts and Cher attacking Democrats, plus fake news-branded videos with false corruption claims |
| Are the claims true? | No evidence supports them |
| How are they spread? | Thousands of automated accounts inflate views, per Antibot4Navalny |
| Platform response? | None reported in the articles we read |
| Voting systems affected? | No evidence of direct manipulation of voting systems or ballot counting, per the reports |
Agents that act on your behalf need rules. Agentbeam stops the dangerous actions →
What Bloomberg and others report
The videos began appearing on X in early September. Some show AI-generated versions of well-known actors and singers appearing to criticize the Democratic Party. Some posts push a "#AllDemocratsAreCriminals" hashtag. Others spread invented allegations against individual candidates.
Two examples reported: a fake video carrying an ABC News logo accused Texas Democratic Senate candidate James Talarico of paying OnlyFans models, and a video falsely attributed to CBS claimed Georgia Sen. Jon Ossoff hid eight properties from tax authorities. According to the reports, no evidence has emerged to support either allegation. The AI Incident Database logs the campaign as incident 1702, dated September 10, 2026, noting that celebrities and CNN rejected the manipulated statements and unauthorized branding.
How the amplification works
The network reportedly relies on thousands of automated accounts. Antibot4Navalny, a group that tracks Russian influence activity, told Bloomberg that some posts reach up to 200,000 views in their first hour and then growth abruptly stops. The posting accounts often have few followers and almost no genuine interaction, which the La Voce summary says is meant to create an impression of greater popularity.
That pattern is itself a detection clue. Organic viral posts usually build over hours with replies and reshares from varied accounts. A sharp spike followed by a flat line, from accounts with little history, suggests purchased or automated views.
Matryoshka versus Storm-1516
Both are Russia-linked, and both use fabricated media, but researchers separate them. Matryoshka has a signature of impersonating media brands, putting fake logos from outlets such as CNN, ABC or CBS on made-up clips. Storm-1516 is the group researchers tied to the fabricated Talarico sexual-assault video we covered in our Storm-1516 explainer. Some aggregators lump the two together; the reporting we read keeps them distinct, and so do we.
This sits in a pattern we have tracked: OpenAI disrupting Russia- and Iran-linked false-front influence operations, AI bots in the Israeli election, and Google's AI Overview surfacing a lookalike donation page in the Talarico race. AI lowers the cost of producing a plausible clip; distribution still depends on bots and platform reach.
Why the tactic is called Overload
The name Operation Overload describes the strategy as much as the actor. Rather than convincing anyone of one big lie, the network produces a high volume of plausible-looking items and sends them to journalists, fact-checkers and ordinary users, hoping to exhaust the people who verify claims. Researchers have documented this approach of impersonating media brands for several years, well before cheap generative video existed. What changed in 2026 is the cost per item: a cloned voice and a stock-style clip can be assembled in minutes, so the same small team can produce many more variants.
That matters for how you read the number 130. It covers about a month, September 10 to October 9, which works out to a few fabricated items per day. That is a modest volume by social-media standards. The operation does not need any single item to go viral. It needs a steady supply, a few lucky spikes through bot amplification, and a handful that real accounts pick up and share in good faith.
What AI changes, and what it does not
AI changes production. Celebrity likenesses and voices that once required an actor or careful editing can now be synthesized, and a convincing news-style template takes little skill. It also helps with volume and variety: many near-duplicate clips make takedowns harder, because each one must be reported separately.
AI does not change distribution. The reporting is consistent that the reach comes from automated accounts inflating views, not from the clips being unusually persuasive. That points to the more tractable defenses: detecting coordinated inauthentic behavior, labeling impersonated brands quickly, and making it cheap for outlets like CNN, ABC and CBS to flag fakes that use their logos. Detection of the synthetic media itself is a weaker lever, because the clips are compressed and re-uploaded.
It also does not mean the effect is large. Researchers cited in the reports describe engagement that looks artificial: low followers, little real interaction, and views that stop growing abruptly. A campaign can be loud and still reach few real voters. We have no measurement of persuasion, and neither do the sources.
A checklist for newsrooms, campaigns and platforms
- Newsrooms. Keep a public page listing your official video formats and accounts so readers can compare. When a fake carries your brand, respond fast and link the original.
- Campaigns. Pre-write a short response for false allegations and name the clip, rather than repeating the claim. Capture the post URL and account handle for platform reports before the content is removed.
- Platforms. Prioritize impersonation of news brands and coordinated view inflation over trying to rule on every claim. The account-level signals are the strongest evidence in the public reporting.
- Researchers. Publish indicators such as hashtags, account clusters and template styles so others can reproduce the findings. Bloomberg's count of 130 items is a good example of a result others can check against their own collections.
What officials have said
The La Voce report says US authorities have reported disinformation activity from Russia, China and Iran ahead of the midterms and identified Moscow as the most active foreign actor. German Chancellor Friedrich Merz told Bloomberg that Europe continues to underestimate the threat from Moscow, saying Vladimir Putin aims at "destabilizing the entire political order" in Europe using propaganda, cyberattacks and sabotage. These are general statements about Russian activity, not findings about this specific campaign.
The articles do not report a response from X or other platforms, and we found no named US agency statement tied to these 130 items. Treat that as unknown, not as evidence of inaction.
What is not verified
- Attribution. It rests on outside researchers cited by Bloomberg. Attribution of influence operations is probabilistic; a government or platform confirmation would strengthen it.
- Reach and effect. View counts are inflated by design. Nothing in the reports measures how many real voters saw or believed the clips.
- Tools. The reports say AI-generated and AI-cloned voices were used, but do not name the models or services.
How to spot and respond to these fakes
- Check the outlet. If a clip carries a network logo, look for it on the outlet's own site and verified accounts. CNN, ABC and CBS brands appear on fakes without authorization.
- Look at the account. Few followers, no history and a sudden spike in views are red flags.
- Pause on celebrity endorsements. An actor appearing to attack a party in a vertical clip is a classic synthetic setup. Search for the original appearance.
- Do not reshare to debunk. Quote-posting a fake spreads it. Link the debunk instead.
- For teams building with agents. Agents that browse, summarize and post can be fed fabricated pages. AgentBeam, the agent security platform from the explainx.ai team, stops AI agents before they take dangerous actions, which is relevant if your agents act on web content.
What this means for AI builders
If you ship video or voice generation, this is the misuse case regulators and journalists will cite: cheap celebrity voice cloning plus fake news branding. Provenance and watermark checks help only if platforms read them, and these clips are re-encoded on upload. If you build summarizers or answer engines, expect fabricated outlet pages to enter your retrieval results during election season, and weight verified domains accordingly.
Related reading
Details are accurate as of October 28, 2026 and rely on secondary summaries of a paywalled Bloomberg investigation; they may be revised.