Deepfake Detection for Newsrooms: Hackers Hijack TV Streams

Iranian hackers interrupted TV streaming services to broadcast deepfake Gaza news. Viewers tuning in for regular programming got synthetic propaganda instead. The hackers did not need a studio. They needed a stream to hijack.

Broadcast hijacking works by compromising the delivery chain: the streaming server, the CDN, or the playout system. Once inside, attackers swap real segments for deepfaked ones. Viewers have no reason to doubt what is on their own TV. By the time the intrusion is found, the clip has been recorded and reshared everywhere. The intrusion often lasts only minutes, but screen recordings preserve it forever.

Your TV is not a trusted source anymore

Uncomfortable, but true. If streams can be hijacked and presenters deepfaked, "I saw it on TV" stops being proof. Newsrooms downstream of such feeds face an awful choice: report fast or verify first. Usually they guess, and usually they regret it.

Every newsroom should be able to answer what tools help newsrooms verify whether media is ai-generated without Googling. A deepfake detection platform that screens incoming feeds automatically is now basic infrastructure. The serious ai-powered deepfake detection platforms handle video at broadcast speed. Trust, but verify, literally.

Cotton Sandstorm has run influence operations for years, and deepfakes are just the newest tool in the kit. The pattern is consistent: compromise a distribution channel, inject divisive content, and let outrage do the rest. Attribution rarely leads to consequences, which is why the operations keep coming.