In January 2026, a covertly recorded video alleging irregularities in the financing of Nikos Christodoulides’s 2023 presidential campaign surfaced on X under the account “Emily Thompson” and, within hours, spread into Cypriot broadcast and online media. Working within the MedDMO framework, Fact Check Cyprus examined both the footage and the account behind it. The team, led by Dr Michael Sirivianos with fact‑checker Theophile Bloudanis, found no indications of AI manipulation in the segments showing the three Cypriot personalities involved, but uncovered a more consequential operational layer behind the account itself: a groomed sockpuppet cultivated over several years across conservative‑leaning online publications, fronted by a profile image carrying strong signatures of AI generation.
The story has since developed further. The operation has been publicly attributed to Black Cube, the Israeli private intelligence firm, which has confirmed its involvement while declining to name the commissioning client and rejecting the hybrid‑warfare framing advanced by the Presidential Palace. Its reference to cooperation with Cypriot authorities remains unexplained, and the criminal investigation led by Andreas Paschalides now has access to roughly thirty hours of original, unedited material that had not previously circulated.
This reframes how the case should be read. Public debate has centred on whether the video was a deepfake, yet the clearest confirmed use of artificial intelligence in the operation was not the fabrication of the content but the fabrication of the “person” delivering it. Authentic footage, amplified through a pre‑built identity backed by a private intelligence firm, moved faster than any detection tool designed primarily to catch synthetic video. The full case study, prepared for the MedDMO network, sets out what the investigation has established, what remains unresolved, and what the incident reveals about verification speed, platform accountability, and the structural vulnerabilities of small EU information ecosystems to coordinated identity operations.
