A gunman launched a deadly shooting spree in Krakow’s historic Old Town on Saturday, killing six individuals before being subdued and detained by police. The suspect, who was also investigated for the murder of three family members prior to the mass shooting, subsequently passed away while in police custody at a local hospital.
On Monday, Poland’s national prosecutor’s office officially launched a comprehensive criminal investigation into the tragic events.
As details of the tragedy continue to emerge, significant gaps in the official narrative have led social media platforms to become flooded with misinformation. Users have been quick to share fabricated images of the suspect and alleged screenshots of his digital profiles. DW Fact Check provides a detailed analysis of the disinformation spreading online in the wake of the attack.
Are these genuine images of the attacker?
Claim: A highly viral photograph has been widely shared across social media platforms, with users asserting that it depicts the genuine face of the suspected attacker.
DW Fact Check: The image is fabricated and fake.
In the viral posts, the image is accompanied by a caption stating: “[…] The perpetrator of the attack in Krakow is a 25-year-old Polish citizen, Polish police have reported. The death toll has reached six. (…)”
However, the hyper-realistic sharpness of the image immediately raises serious doubts about its authenticity. Capturing such an exceptionally clear, high-resolution photograph in the midst of a chaotic, high-stress police intervention is highly improbable.
To verify the origin of the image, DW utilized two independent AI detection tools. Hive Moderation classified the image as 99.5% AI-generated, while Google’s SynthID Detector identified a SynthID watermark, confirming that the image was created or manipulated using Google’s artificial intelligence technology.
Our investigation uncovered multiple variations of the suspect’s image circulating across the internet, most of which bear striking visual similarities. Additionally, we identified several authentic photographs and video recordings capturing the actual events of the attack.
While DW cannot independently verify the raw footage, visual analysis reveals strong correspondences in terms of key individuals and background elements when compared to verified, authentic images distributed by professional picture agencies.
It appears that threat actors and misinformation spreaders utilized these authentic news footages as reference templates to generate the AI-driven deepfakes. Several of the social media posts distributing these manipulated images have already been flagged with platform labels indicating AI-generated content.
It is crucial to understand that artificial intelligence cannot genuinely sharpen a blurry image to recover accurate, missing details, nor can it reconstruct elements that were never captured in the original photograph. While AI algorithms can generate highly plausible details based on surrounding visual context, these elements are fundamentally statistical guesses rather than faithful reproductions of physical reality.
For more insights into how AI sharpening tools are exploited to manufacture deceptive visual evidence, further details are available elsewhere.
Did the shooter sympathize with Ukraine?
Claim: An X user in a post viewed over 700,000 times claimed: “Michal Oksinski, the terrorist from Krakow who also killed his parents and sister, had a Telegram account with the Ukrainian flag. On November 3, he wrote ‘Thanks, Dad, for the gun’, posting this photo of himself wearing the Ukrainian flag insignia.”
DW Fact Check: The claim and associated imagery are entirely fake.
This Telegram channel is almost entirely fabricated and inauthentic. The account allegedly published a photo on November 3 depicting the attacker holding a firearm in front of a television set, with a Ukrainian national insignia visible on the wall behind him.
Another post dated November 4 merely stated “11/7/2026”, which corresponds to the date of the attack. Crucially, both of these posts were retroactively edited on November 8, days after law enforcement had already apprehended the suspect.
DW verified this metadata directly within the Telegram application by inspecting the edit history of the posts. Furthermore, the channel’s profile picture, depicting a Ukrainian flag, was also modified retroactively after the attack had already concluded.
This is a well-known disinformation tactic. Malicious actors and fake accounts frequently edit old posts and images in the days following a major breaking news event to create the false illusion that they predicted or announced the incident beforehand.
Further proof of this manipulation lies in the formatting: in Poland, dates are standardly written in a day-month-year format, rather than the month-day format shown in the post. Additionally, the photograph of the alleged attacker is almost certainly AI-generated, with HIVE Moderation confirming a 99.9% probability of synthetic creation.
Does the attacker have links to a group that operated in Ukraine?
Claim: An X post that has been viewed nearly 100,000 times asserts: “#BREAKING: The attacker in Poland had a full arsenal in this trunk! He also has forward observation group patches, an American military company active in Ukraine.” The attached photograph depicting the purported “arsenal” inside a car trunk has been widely redistributed by multiple other accounts.
DW Fact Check: The claim is entirely false.
The attached photograph was shared to depict the attacker’s vehicle with a trunk fully loaded with weapons, ammunition, a helmet, and a military tactical vest.
The vest in the trunk of the car features a symbol supposedly connected to the Forward Observations Group, an American tactical training lifestyle brand that has traveled to and operated in Ukraine.
In reality, the patch shown in the image is the “Old Roger” flag, a traditional symbol widely used within military circles. While the Forward Observations Group logo is indeed a variation of this motif, it specifically features a horned skeleton holding a firearm, rather than the hourglass depicted in the photo.
Furthermore, this is not the vehicle of the attacker or the crime scene. The license plate of the car in the photograph is officially registered with the Krakow police department, indicating that law enforcement likely collected physical evidence from the primary scene and transported it in this vehicle for processing.
By paying close attention to such minute details, the public can better separate established facts from fabricated narratives, particularly during fast-moving and highly emotional events like the Krakow shooting.
Daniel Ebertz contributed to this research and article.
Also Read
- Pope Leo XIV concludes Argentina visit with prison visit and Luján pilgrimage ahead of Peru return
- Iran classes Argentina navy, air force as ‘terrorist organizations’
- U.S.‑Made Plastic Toy Soldiers Honor Real Veterans Through Domestic Production
- Mohammed Al-Otaiba’s Debut YA Novel ‘The Pearl’ Ponders Time and Humanity
