Key takeaways<\/p>\n
- \n
- Targeted disinformation campaigns against companies are rising sharply in 2025\/2026 \u2013 either as a standalone attack vector or as a complement to traditional cyberattacks<\/li>\n
- Real-time deepfakes in video conferences are enabling CEO fraud at a new level \u2013 a financial-services firm lost the equivalent of \u20ac25 million in 2024<\/li>\n
- Traditional IT security protects systems and data, not reputation and trust \u2013 most companies remain exposed to the reputational security gap<\/li>\n
- Countermeasures require cross-functional collaboration between IT security, communications, legal, and executive leadership<\/li>\n<\/ul>\n<\/div>\n\n+38 %<\/div>\nIncrease in state-directed cyberattacks since 2022<\/div>\nSource: Microsoft Digital Defense Report, 2024<\/div>\n<\/div>\n
Disinformation as an attack vector<\/h2>\n
The notion that disinformation is only a problem for governments and elections is dangerously wrong. In 2025 and 2026 a clear trend emerges: targeted disinformation campaigns against companies are on the rise \u2013 either as a standalone attack vector or as a complement to traditional cyberattacks.<\/p>\n
Real-world scenarios include: a deepfake video of the CEO announcing a profit warning; AI-generated whistle-blower reports of alleged data breaches circulating on social media; fake reviews and testimonials that erode trust in a product.<\/p>\n
\u201cHybrid threats blur the line between war and peace. Companies must understand they are already part of the battlefield.\u201dENISA Threat Landscape, 2024<\/cite><\/p><\/blockquote>\n
The anatomy of hybrid attacks<\/h2>\n
Hybrid warfare stitches together multiple attack methods into a coordinated campaign:<\/p>\n
- \n
- Phase 1 \u2013 Reconnaissance:<\/strong> social-media profiles of senior executives are analysed, voice samples and video footage are harvested, and weaknesses in corporate communications are identified<\/li>\n
- Phase 2 \u2013 Preparation:<\/strong> deepfakes are produced, fake accounts are seeded on relevant forums and LinkedIn, and compromised or fabricated insider information is obtained<\/li>\n
- Phase 3 \u2013 Attack:<\/strong> a technical cyber incident (e.g., ransomware) and a disinformation campaign are launched simultaneously. While the IT team tackles the technical breach, the reputational crisis escalates in the media<\/li>\n
- Phase 4 \u2013 Amplification:<\/strong> AI-driven bot networks spread the disinformation, and algorithmic amplification on social platforms drives reach<\/li>\n<\/ol>\n
Fact:<\/strong> According to Europol, the number of AI-generated deepfake videos rose by 550 percent year-on-year in 2025.<\/p>\n
Why traditional security measures fall short<\/h2>\n
Traditional IT security protects systems and data \u2013 not reputation and trust. Firewalls, EDR, and SIEM do nothing against a viral deepfake tweet. Most companies remain exposed to the reputational security gap.<\/p>\n
The challenge: defending against disinformation requires collaboration across IT security, corporate communications, legal, and executive leadership. Few organisations have established processes for this.<\/p>\n
Deepfakes: Quality Becomes the Problem<\/h2>\n
The technical quality of deepfakes reached a point in 2025\/2026 where they are barely distinguishable to the human eye. Real-time deepfakes in video conferences \u2013 CEO Fraud 2.0 \u2013 have been documented:<\/p>\n
- \n
- A financial services provider in Hong Kong lost the equivalent of \u20ac25 million in 2024 after fraudsters used a deepfake video call to impersonate the CFO<\/li>\n
- In Germany, multiple cases emerged in 2025 where deepfake voices of managing directors were used to authorize fraudulent transfers<\/li>\n
- Current detection tools achieve a 70 to 85 percent success rate \u2013 too low for reliable automated protection<\/li>\n<\/ul>\n
Fact:<\/strong> According to the FBI, the average damage caused by deepfake-enabled CEO fraud in 2025 was \u20ac4.7 million per incident.<\/p>\n
Countermeasures for Businesses<\/h2>\n
Six concrete steps every company should implement:<\/p>\n
- \n
- Deepfake Awareness Training:<\/strong> Train employees in key roles (finance, executive assistants) to recognize deepfake risks<\/li>\n
- Verification Protocols:<\/strong> Introduce multi-channel verification for critical decisions (transfers, personnel matters, press releases) \u2013 never act on a video call or voice message alone<\/li>\n
- Media Monitoring:<\/strong> Automated monitoring of social media, news portals, and dark-web forums for brand mentions and potential disinformation campaigns<\/li>\n
- Content Authenticity:<\/strong> Implement C2PA standards (Coalition for Content Provenance and Authenticity) for official corporate communications<\/li>\n
- Crisis Communication Plan:<\/strong> Pre-prepared statements and processes for disinformation attacks \u2013 response time is critical<\/li>\n
- Cross-functional Incident Response:<\/strong> Expand the IR team to include communications and legal, with specific playbooks for hybrid attacks<\/li>\n<\/ol>\n
Conclusion<\/h2>\n
Hybrid threats blur the lines between cyberattacks, information warfare, and economic crime. For CISOs, this means expanding their scope of responsibility: alongside systems and data, reputation and trust must also be protected. Those who dismiss disinformation as \u201cnot my problem\u201d become easy targets.<\/p>\n
Key Facts<\/h2>\n
Phishing Volume:<\/strong> More than 3.4 billion phishing e-mails are sent worldwide every day.<\/p>\n
Detection Rate:<\/strong> Only 3 percent of employees report suspicious e-mails to the IT department.<\/p>\n
Frequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n
\nHow do I spot a deepfake in a video conference?<\/strong><\/summary>\n
Watch for subtle artifacts: unnatural lip-sync, odd lighting shifts, missing micro-expressions, and lag during rapid head movements. Detection is less important than prevention: establish verification protocols for critical decisions \u2013 call back on a known number or confirm via a separate channel.<\/p>\n<\/details>\n
\nAre hybrid attacks only a risk for large enterprises?<\/strong><\/summary>\n
No. Midsize companies are especially vulnerable because they often lack dedicated communications teams that can respond quickly to disinformation. They are also targeted as suppliers or partners to indirectly harm larger firms.<\/p>\n<\/details>\n
\nWhat role does AI play in countering disinformation?<\/strong><\/summary>\n
AI-powered tools can automate social-media monitoring, detect bot networks, and flag deepfakes with 70 to 85 percent accuracy. However, the technology is not yet reliable enough for fully automated defense. The most effective approach today combines AI monitoring with human review.<\/p>\n<\/details>\n
\nMore from the MBF Media Network<\/p>\n
Digital Chiefs<\/span>Strategic IT decisions for executives<\/span><\/a>MyBusinessFuture<\/span>Business Future: Trends for decision-makers<\/span><\/a><\/div>\n\n<\/p>\nEditor’s Picks<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/03\/cyber-warfare-2026-wenn-staaten-digital-aufrusten-250x141.jpg\")
<\/span>Editor’s Pick<\/span>Cyber Warfare 2026: When States Digitally Arm Up<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/03\/st-ot-250x167.jpg\")
<\/span>Editor’s Pick<\/span>OT Security: 119 Ransomware Groups Target Industrial Facilities<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Deepfakes, AI-generated disinformation, and targeted reputational attacks: by 2026, hybrid threats will blur the lines between cyberattacks, information warfare, and economic crime. Why every company is at risk and what CISOs can do about it. Key takeaways Targeted disinformation campaigns against companies are rising sharply in 2025\/2026 \u2013 either as a standalone […]","protected":false},"author":55,"featured_media":3840,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"cyber threat","_yoast_wpseo_title":"Hybrid Warfare and Disinformation: The Underestimated Cyber Threat to Businesses","_yoast_wpseo_metadesc":"Hybrid warfare threats: Protect your business from AI disinformation and deepfakes. Stay ahead of cyber-reputation attacks\u2014act now.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["post_id-3841"],"footnotes":""},"categories":[259],"tags":[248],"class_list":["post-7473","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-strategie-governance-en","tag-ki"],"evm_reading_time_minutes":6,"wpml_language":"en","wpml_translation_of":3841,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=7473"}],"version-history":[{"count":8,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7473\/revisions"}],"predecessor-version":[{"id":21754,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/7473\/revisions\/21754"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/3840"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=7473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=7473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=7473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} - Verification Protocols:<\/strong> Introduce multi-channel verification for critical decisions (transfers, personnel matters, press releases) \u2013 never act on a video call or voice message alone<\/li>\n
- Deepfake Awareness Training:<\/strong> Train employees in key roles (finance, executive assistants) to recognize deepfake risks<\/li>\n
- Phase 2 \u2013 Preparation:<\/strong> deepfakes are produced, fake accounts are seeded on relevant forums and LinkedIn, and compromised or fabricated insider information is obtained<\/li>\n
- Phase 1 \u2013 Reconnaissance:<\/strong> social-media profiles of senior executives are analysed, voice samples and video footage are harvested, and weaknesses in corporate communications are identified<\/li>\n