Old threat reporting is being re-released into a live escalation window, with its dates stripped off

The feature, syndicated to Yahoo the same day, assembles a documented phenomenon out of old entries: Lebanon’s General Security Directorate warning residents in January 2025 against a Facebook page called SAWA it suspected was a Mossad front; Al Akhbar reporting that same month that Israeli operatives were recruiting Lebanese through fake high-salary job adverts and WhatsApp outreach; L’Orient Today reporting in December 2025 that the agency had warned against a page calling itself “Unit 504”; a further August 2025 warning about an Instagram account. The only new material is commentary. Wissam Nassif Yassin, an academic and political researcher, told Al Jazeera that Israeli intelligence uses colloquial Lebanese Arabic to avoid suspicion, and that “the Israeli side focuses on all segments of society because it considers that every person can be penetrated from their own angle.” A quote from retired Brigadier General Mounir Chehade, on recruitment targeting Beirut’s southern suburbs, the south and the Bekaa, comes from Al Akhbar in January 2025 — twenty-one months old.

Three other items in the window carry the same defect in different forms. SOCRadar’s “Iran–Israel/US War 2026” cyber dashboard, cataloguing Iranian APT groups including MuddyWater, is a live-updating vendor marketing asset whose timestamp refreshes whether or not anything happens. Bloomberg’s report that FBI and Coast Guard investigators found hackers had accessed the propulsion system of an oil supertanker approaching the Texas coast “this summer” is dated 2 October, rests on US officials familiar with the matter, and attributes the breach to no actor; watch for it reappearing in Gulf maritime coverage without either qualifier. A Jerusalem Post opinion column dated 13 October sourcing escalation claims to the Foundation for Defense of Democracies is advocacy, not reporting. The specialist tracker Flare, by contrast, last logged a null — no new attributed cyber operation in its window, with kinetic escalation as the governing variable.

Set against that, the week’s one hard number came from fraud enforcement rather than statecraft. Meta removed more than 3.7 million accounts, Pages and Groups from Facebook and Instagram in an operation coordinated with police forces who spent a week in London in October; law enforcement confirmed 28 arrests and the rescue of 117 people trafficked into a scam compound in Ghana. The arrests and rescues are attested by police, not self-reported by the platform. Compare that with the claim, carried by Gulf News on about 11 October and tied to a Microsoft–CPX–UAE Cyber Security Council programme, that the UAE faces “over 800,000 cyberattacks daily” — a figure with no stated methodology and no sample period. One of these two numbers can be checked.

Assessment: Recycling is not fabrication, and the Unit 504 and SAWA pages are real and were documented at the time. The problem is placement: dated material re-released during an escalation cycle reads as evidence of a current campaign, and gets cited that way within a day. For this desk the discipline is mechanical — ask what the event date is, not the publication date, and ask who is attested to the claim versus who is marketing against it. Flare’s null is the most honest entry in the window. Absence of new attributed operations, logged as such, is information; a dashboard that always looks fresh is not.