“I was looking at my Ukrainian counterpart. We were having a perfectly normal conversation. He responded to everything I said. But it wasn’t him.”

With those words, Greece‘s Secretary General for National Security, Thanos Dokos, described how he found himself at the center of one of the most sophisticated artificial intelligence-enabled deception operations ever encountered by the country’s state apparatus.

The timeline

It was a video conference that appeared entirely genuine. A conversation that gave no indication anything was amiss.

Until the “Ukrainian” began showing unusual persistence over the issue of the drones in Lefkada.

That was when the first suspicion arose.

A few minutes later, a phone call to the real Ukrainian official, followed by the immediate involvement of Greece’s National Intelligence Service (NIS), revealed that the person Dokos had just been speaking to had never existed. It was a digitally created likeness produced using highly advanced deepfake technology.

Dokos’s account sheds light not only on the sequence of a carefully orchestrated hybrid attack but also on the new reality now facing governments and security agencies in an era where, as he himself acknowledged, “you can no longer trust even your own eyes”.

Speaking to SKAI just hours after the case became public, Dokos revealed the full background, explaining how an operation executed with remarkable precision managed to bypass even the strict security protocols normally followed for such communications.

The sophistication of the trap became apparent because, before the video conference, documents had been sent containing names, addresses and even the official letterheads used in communications between the two sides.

“The wording was exactly the same as that routinely used,” he said, adding that his personal contact details are not publicly available through a simple internet search.

Moreover, just one week earlier he had spoken with his real Ukrainian counterpart, and they had left several issues open for further discussion.

“All of this led me to conclude that I was having a genuine conversation with my Ukrainian counterpart,” he said, explaining that he had never before encountered a case in which both a fake image and a fake voice had been used so convincingly at the same time.

“The video conference was progressing without raising any suspicions. I could see my counterpart and we started talking exactly as I am talking to you now. It was a completely normal conversation. He reacted to everything I was saying,” he recalled.

The first suspicions

The first warning signs came towards the end of the conversation.

His counterpart repeatedly returned to the issue of the drone in Lefkada, insisting that some members of the Ukrainian government had not received Athens’ message and that they intended to proceed in the same direction once again.

“He repeated it several times and I started wondering whether it was simply a language issue or whether something else was going on,” Dokos said.

As soon as the call ended, the state mechanism was immediately activated.

Dokos informed the National Intelligence Service (EYP) and shortly afterwards contacted his real Ukrainian counterpart by telephone on an unrelated matter.

It was then confirmed that the person he had just been speaking to was not him.

The alarm

What followed caused even greater concern for the Greek authorities.

According to Dokos, the Ukrainians informed Greece that, during the same period, a similar operation had targeted a senior official from a Baltic state, who was later confirmed to be Estonian.

This information strengthened the assessment that the incident was not isolated but formed part of a broader operation.

The case has already become a turning point for the security protocols governing official government communications.

“A review of our security protocols has already begun. From now on, even what we see with our own eyes cannot always be considered reliable,” he said from the outset.

Dokos also highlighted what he described as the real threat.

“It is not only about what someone says. It is also about how advanced algorithms can edit and manipulate material so that someone appears to say something they never actually said,” he noted.

He also pointed to the timing.

“Clearly, the timing is not accidental,” he said, recalling that similar influence operations had been recorded before elections in Moldova and Armenia.

In Athens, officials also believe there is credible evidence suggesting that the latest incident forms part of a broader pattern linked to Russian activity in the Baltic states and beyond.

“There are concerns involving other European countries as well. So there appears to be coordinated planning unfolding across different timeframes through this type of operation.”

Briefing Prime Minister Mitsotakis

Dokos also described the reaction of Prime Minister Kyriakos Mitsotakis.

According to Dokos, the Prime Minister was concerned when informed of the incident, not only because of the attack itself but because it confirmed concerns he had repeatedly expressed.

“He is someone who understands technology well and appreciates these issues. This incident confirmed his concerns about deepfakes,” Dokos said.

It was not the first time the government had publicly highlighted the risks posed by artificial intelligence.

The Prime Minister has repeatedly warned, both in Greece and internationally—from the Artificial Intelligence Action Summit in Paris to speeches at the United Nations and European summits—that deepfakes and the uncontrolled use of AI could become powerful tools for disinformation and the undermining of democracy, calling for a common European and international regulatory framework.

The same concerns had already been expressed in April by the Secretary General for Communication and Media, Giannis Mastrogeorgiou.

In an interview with protothema.gr and journalist Giorgos Evgenidis, he described artificial intelligence as “the best-known unknown issue”, warning that the greatest challenge lies not only in the technology’s remarkable development but also in its ability to distort reality, generate highly convincing false audiovisual material, influence public debate and, ultimately, affect democratic processes.

Dokos’s observation that “you can no longer trust even your own eyes” appears to give those warnings a strikingly tangible dimension.

Government rejects opposition criticism

On the political aspect of the affair, government officials have rejected criticism from the opposition, arguing that “such demands have now lost their meaning” and that “calls for resignations over every issue have become tiresome”, while stressing that this does not mean the seriousness of the incident is being underestimated.

Officials at the Prime Minister’s Office insist that the cyberattack did not result in any leak of classified or confidential information, emphasising that it was carried out using the most advanced artificial intelligence technologies currently available.

At the same time, work is already under way to further strengthen and secure government communications against an evolving landscape of hybrid threats.

They also note that similar operations have previously targeted senior European officials as well as heads of government.