T8-AT-014HIGH

False Crisis Generation

T8 · External Deception & Misinformation →
Risk score210
RatingHigh
Procedures10
Severity
Mechanism

False-crisis generation uses LLMs to fabricate urgent emergency content — disaster alerts, breaking-news bulletins, pandemic announcements, market-crash warnings, threat notices, cyberattack and infrastructure-failure alerts — designed to trigger panic, herd behavior, or costly defensive action before anyone can verify. It works because crisis messaging is processed under time pressure with suspended skepticism: people act first and check later when safety or money is at stake. LLMs reproduce the exact register of authentic emergency communications (terse alert phrasing, official-sounding sourcing, escalation cues) and can localize and mass-distribute them instantly.

Detection
  • Authoritative-source cross-checking: Verify any emergency claim against official emergency, public-health, market, or infrastructure channels before amplification
  • Velocity and burst detection: Flag sudden coordinated spikes of identical alert content, a signature of fabricated crises
  • Format/signature verification for alerts: Validate against authenticated emergency-alerting systems and signed official feeds
  • Coordinated-amplification detection: Identify networks injecting the alert in synchrony to manufacture credibility
Mitigation
Authenticated emergency-alert channelsHIGH
Rapid official confirm/deny pipelineHIGH
Velocity/burst anomaly detectionMEDIUM
Coordinated-behavior takedownsHIGH
Chaining

False-crisis content is a high-velocity trigger that supercharges other techniques: it borrows authority impersonation (T8-AT-001) for "official" sourcing, distributes through disinformation infrastructure (T8-AT-007), and creates the urgency window that social-engineering scams (T8-AT-005) exploit ("act now to protect your account"). It feeds election destabilization (T8-AT-011) and false-flag attribution (T8-AT-010), and pairs with T9 synthetic media when a fabricated clip "shows" the crisis.

Framework mapping
OWASP LLMLLM09
MITRE ATLASAML.T0048
Open in the technique browser →