A "Telegram receipt" that was edited after the gunman was already in hospital? Bestie, that's not evidence. That's fan fiction with a timestamp.
On Saturday, 7 November 2026, a gunman killed six people in Krakow's Old Town in Poland. Within hours, X, Facebook and Telegram were flooded with "exclusive" photos of the attacker. The most viral one claims he ran a Telegram channel with a Ukrainian flag and posted a masked gun selfie wearing a Ukrainian flag patch days before the attack. We checked the Krakow shooter photo claim against fact-checkers, Polish officials and the original posts. Here's what's real and what's AI.
VERDICT: FALSE. The "Ukraine flag" selfie is AI-generated, and the Telegram channel it came from is almost certainly fake. DW Fact Check and AFP found the posts were edited on 8 November, after the suspect had already been shot and taken to hospital. AI detectors rated the image 99.9% likely AI-made, and AFP spotted visual glitches and an invisible AI watermark. Polish prosecutors say the attacker's motive has not been established, and no official source links him to Ukraine.
What Actually Happened in Krakow
Let's start with the verified facts, because they matter here. According to Poland's National Prosecutor's Office (9 November 2026):
- At around 3 PM on 7 November, the attacker drove through Krakow's Main Market Square (Rynek Główny) and nearby streets and fired at least several dozen shots.
- Six people were killed (four women and two men: four Polish citizens, one British citizen and one Austrian citizen). Fifteen people were injured, including six foreigners.
- Two police officers stopped him using their firearms. Both officers were shot.
- Prosecutors say the evidence points to a 24-year-old man from Ostrowiec Świętokrzyski, who earlier that day also killed his parents and 21-year-old sister.
- He died in a Krakow hospital on 9 November, before he could be charged.
- Prosecutors are investigating the Krakow killings as a terrorist act. In their words, the motive "has not been established so far."
Officials gave mixed early signals about his views. AP reports Poland's interior minister said he held far-right views, while prosecutors said it was too early to determine a motive (AP). Defence Minister Władysław Kosiniak-Kamysz said the man was never a soldier in the Polish Army and had nothing to do with the military (Demagog). None of it points to Ukraine.
The Claim
"Michal Oksinski, the terrorist from Krakow who also killed his parents and sister, had a Telegram account with the Ukrainian flag. On November 3, he wrote 'Thanks, Dad, for the gun', posting this photo of himself wearing the Ukrainian flag insignia."
According to DW Fact Check, that X post was viewed more than 700,000 times. The attached screenshot shows a Telegram channel with a blue-and-yellow profile picture and a masked man in a skull balaclava taking a selfie with a rifle in a living room, a Ukrainian flag patch on his vest. AFP found the same image spreading in English, Dutch and Hungarian, with one English X post shared more than 1,000 times (AFP Faktencheck).
What We Found
1. The "receipts" were edited after the attack. DW checked the Telegram channel's edit history in the app. The 3 November photo post and a 4 November post were both edited on 8 November, after the suspect had been detained. The channel's Ukrainian flag profile picture was also changed after the attack. AFP says the message was edited at 9:28 AM on 8 November. By then, Małopolska police had already posted on X (7 November, 4:17 PM) that the attacker had been shot by officers and was being taken to hospital.
2. That's a known disinfo trick. DW explains that fake accounts often edit old posts after breaking news so it looks like they "predicted" or "announced" the event in advance. A channel that appears to post on 3 November but was actually edited on 8 November proves nothing about what anyone knew beforehand.
3. The date is written the American way. The 4 November post just says "11/7/2026", the date of the attack. DW points out that in Poland the day is written first (7/11/2026), not the month. Small detail, big red flag.
4. AI detectors flagged the selfie hard. DW and AFP both ran the image through Hive Moderation, which rated it 99.9% likely to be AI-generated. AFP also says an AI-detection tool found an invisible digital watermark showing the image was created or edited with AI technology.
5. The picture has classic AI glitches. AFP spotted an object on the coffee table that seems to melt into the tablecloth, a carpet edge that makes no sense (a chunk seems to vanish where the table stands) and a headphone band above the right ear that doesn't line up.
It Wasn't the Only Fake
The "Ukraine selfie" was one of several AI or out-of-context posts that went viral after the attack:
- A "real photo" of the shooter's face: DW found it was AI-made. Hive rated it 99.5% likely AI-generated, and Google's SynthID Detector found a SynthID watermark, meaning it was generated or edited with Google's AI tools. DW notes that AI can't "sharpen" a blurry photo into real detail. It only guesses.
- The "arsenal in his trunk" and mercenary patch: DW rated this False. The car in the photo isn't the attacker's car. Its plate is registered to Krakow police, who likely moved evidence into it. The patch is a common pirate-flag symbol used in military circles, not the logo of Forward Observations Group, the US group that operated in Ukraine. Demagog adds that FOG's logo is different: a horned figure holding a rifle and spearing a red "F".
- A photo of Poland's interior minister shaking hands with the shooter: The Interior Ministry's spokesperson Karolina Gałecka called it "a fake photomontage generated by AI" and said the case would go to prosecutors (TVP Info).
TVP Info also reports that Digital Affairs Minister Krzysztof Gawkowski said Poland's NASK cybersecurity team flagged more than 2,000 social media accounts spreading false information about the attack, including automated bots posting mainly in Polish, English, French and Dutch.
Why This Is a Technology Story
This is what breaking news looks like in 2026. Image generators can make a "leaked selfie" in seconds, and an edited Telegram post can look like a pre-attack confession. The good news? The same tech leaves fingerprints: edit timestamps, invisible watermarks like Google's SynthID, and AI detectors that can flag the output. Just remember DW's warning: detectors give a probability, not final proof, so always pair them with source checks.
If you've been following our checks, this playbook will feel familiar. We saw AI fakes in the Florida Learjet crash photo, the Jeff Bezos hair transplant photos and the Trump 90-day blackout videos.
How to Check "Leaked" Photos After a Tragedy
- Check the edit history. On Telegram, edited posts show an "edited" label with a time. If the edit is after the event, the "prediction" is worthless.
- Line it up with the official timeline. Police and prosecutors post updates with timestamps. If a "suspect's post" was changed while the suspect was in custody or in hospital, someone else did it.
- Run AI detectors, but don't stop there. Try Hive Moderation, Google's SynthID Detector or the InVID-WeVerify plugin. Treat the score as a clue, not a verdict.
- Zoom in on the details. Melting objects, broken carpet edges, weird hands or headphones, and text that doesn't read right are common AI tells.
- Be suspicious of "too clean" photos. A crystal-clear close-up from a chaotic crime scene is unusual. DW flagged exactly this.
- Look for local clues. Date formats, language and spelling can expose a fake made by someone outside the country.
- Go to official sources and fact-checkers. For Poland that means police, the National Prosecutor's Office, AFP, DW, Demagog and Konkret24.
- Don't share images of suspects or victims. Even "debunking" posts can spread a fake further. Share the fact-check instead.
Want the full toolkit? Read our guide on how to check fake news in India (and anywhere).
FAQ
Did the Krakow shooter post a photo with a Ukrainian flag on Telegram? No verified evidence shows that. DW and AFP found the photo is AI-generated, and the Telegram posts and profile picture were edited on 8 November, after the suspect had been shot and taken to hospital.
Is there any official link between the Krakow attacker and Ukraine? No. Polish prosecutors said on 9 November that his motive had not been established, and the defence minister said he had nothing to do with the military.
How many people died in the Krakow shooting? Six people were killed in Krakow and 15 were injured, according to Poland's National Prosecutor's Office. Prosecutors say the attacker also killed three family members in Ostrowiec Świętokrzyski.
How do fact-checkers know the image is AI-generated? Hive Moderation rated it 99.9% likely AI-generated, AFP found an invisible AI watermark and visual glitches, and the Telegram edit history showed the posts were changed after the attack.
Sources
- Main source: DW Fact Check, "Fact check: Online disinformation rife after Krakow mass shooting" (Josh Axelrod and Anwar Ashraf, 10 Nov 2026)
- AFP Faktencheck, "Nach Anschlag in Krakau: Bild von Täter mit ukrainischer Flagge ist KI-generiert" (Judith Kantner, 10 Nov 2026)
- Prokuratura Krajowa (Poland's National Prosecutor's Office), investigation statement, 9 Nov 2026
- Demagog, "Zamachowiec z Krakowa walczył na Ukrainie? Naszywka tego nie potwierdza" (8 Nov 2026)
- TVP Info, "Dezinformacja w sprawie zamachu w Krakowie. W sieci pojawiły się fotomontaże generowane przez AI"
- AP, "What to know about the shooting in the Polish city of Krakow that killed 6 people"
