This Week In Disinformation 19 - 25 April 2026
19 - 25 April 2026
🗣️ Would you like to show your support?
🔗 It is only a click away to stay informed and show support for what is true.
The EU's April 2026 sanctions on Euromore and Pravfond confirmed what investigators established years earlier: Russia did not retreat from European information space after 2022. It reregistered.
In Ukraine, a man in Zhytomyr was selling 3,000 fake Telegram accounts a month from his flat, producing the raw material that Russian intelligence operations depend on.
In the United States, at least 325 AI-generated accounts were posting coordinated pro-Trump content across four platforms and nobody, including the platforms themselves, has yet established who built them or why.
Welcome To This Week In Disinformation.
Russia's Brussels-Based Propaganda Network Survived EU Sanctions
▪️1. BLUF
On 21 April 2026, the EU Council sanctioned two pro-Russian entities, Euromore and Pravfond, under its hybrid warfare framework, freezing their EU-held assets and barring any EU citizen or company from providing them funds.
Both are documented instruments of Russian state-directed information manipulation.
The action confirms what investigative journalists and at least one European intelligence service established two years prior: a layered Russian influence architecture operating inside EU territory through plausibly deniable proxies.
▪️2. Context
Russia’s overt state media apparatus, RT and Sputnik, was effectively expelled from the EU after the full-scale invasion of Ukraine in February 2022. The response from Moscow was not retreat but redesign. New outlets were built to appear Western: locally registered, editorially independent in presentation, and staffed or chaired by non-Russian nationals who could give the operation a European face. The vulnerability Russia exploited was structural. A Belgian company registration carries institutional legitimacy that RT, after 2022, could no longer claim. Russian-speaking diaspora populations across the EU, particularly in the Baltic states, Poland, and Germany, provided both an audience and operational cover.
Founded in 2012 by Russia’s Foreign Ministry and Rossotrudnichestvo, a state agency whose stated mission is ‘strengthening Russia’s humanitarian influence in the world’, Pravfond built a presence across 48 countries under the guise of offering legal aid to Russians abroad. An archive of nearly 50,000 internal emails, obtained by Danish broadcaster DR and shared with OCCRP and 28 media partners in 2025, exposed what the foundation actually did: fund propaganda networks, finance the legal defence of convicted Russian intelligence operatives, and maintain personnel with documented links to the GRU in management positions.
▪️3. What Happened
On 21 April 2026, the EU Council issued Council Decision CFSP 2026/884 and Implementing Regulation EU 2026/885, listing both entities under the hybrid activities framework established in October 2024. The total under that framework now stands at 69 individuals and 19 entities.
The EU described Euromore as operating as ‘an unofficial media relay’ within Russia’s information architecture, amplifying narratives that challenge the legitimacy of EU institutions and justify Russia’s war against Ukraine. Its website had by this point been stripped of most original content; the domain now redirects to Euroview Media, which republishes material from RT and Sputnik.
▪️4. Classification
This incident is Foreign Information Manipulation and Interference (FIMI) and is factually true.
Euromore was a real publication producing real content, but its identity as an independent Belgian outlet was fabricated. Its ownership, funding, and editorial direction all ran through Moscow. Pravfond’s legal aid framing is similarly a genuine operational cover for a documented propaganda financing and intelligence support structure.
▪️5. Tactics And Methods
The core tactic was plausible deniability through geographic and legal cover. Belgian registration and a Brussels office address gave Euromore access to European audiences that had already rejected overtly Russian-state outlets.
Amplification ran primarily through Telegram and Facebook, with both Euromore and Golos also active on X. Both outlets partnered with PolitWera, a Russian-language Telegram channel hosted by Vera Bytko, for joint broadcasts. Golos content was regularly reshared by ‘Another Ukraine’, a Telegram channel controlled by Viktor Medvedchuk, linking this network to the Voice of Europe cluster that multiple European governments investigated in 2024.
▪️6. Implications
What makes this case strategically significant is the adaptation it represents. Moscow’s post-2022 investment was not in doubling down on overt state media but in building outlets designed to pass as Western. Euromore operated for four years before formal EU action. It required leaked intelligence documents to establish that a Belgian-registered publication was controlled from Moscow, pointing to a structural problem: EU company registration systems are not designed to detect foreign-controlled outlets using domestic incorporation as cover.
The exclusion of Golos from the EU’s April 2026 action is the clearest forward indicator to watch. It shares an address, a phone number, a funding trail, and documented network connections with Euromore.
▪️sources
Russian hybrid threats: EU lists two entities over information manipulation activities | European External Action Service | Press and information team of the Delegation to Ukraine
New UK action against foreign information warfare | UK Government, Foreign, Commonwealth and Development Office
Russian State-Backed Foundation Paid Allies in the EU Despite Sanctions | OCCRP | Martin Laine
EU targets two Russian propaganda networks with new sanctions | The Record from Recorded Future News | Daryna Antoniuk
UK Sanctions Media Outlets That Posted Pro-Russia, Anti-Ukraine Content from EU | Kharon | Kharon Staff
EU Imposes Sanctions on Two Russian Entities It Says Are Linked to Disinformation | Reuters via US News and World Report
Russian hybrid threats: EU lists two entities over information manipulation activities | Council of the European Union
EU lists Euromore and Pravfond over information manipulation activities | X | EUCouncil
New York Times Reporting On Rise of AI Astroturfing in American Politics
▪️1. BLUF
The New York Times documented 304 AI-generated fake pro-Trump influencer accounts flooding TikTok, Instagram, Facebook, and YouTube since January 2026.
Attribution remains unresolved: the operation could be the work of domestic commercial content farms, opportunistic fraudsters, or a politically motivated actor, and current evidence cannot distinguish between them with any confidence.
▪️2. Context
The tools required to run this kind of operation became widely accessible in 2024 and 2025. Platforms such as HeyGen, D-ID, and Synthesia allow any user to generate a photorealistic human face, clone or synthesise a voice, and produce broadcast-quality video content in under thirty minutes.
Research has consistently shown that conservative social media audiences have been encouraged by political leaders to trust influencer content, viral videos, and online memes as legitimate sources of political information. That trust becomes a vulnerability when the influencer is not a person. In the months before the 2026 US midterm elections, the appetite for relatable pro-Trump content was high, and the algorithmic infrastructure of platforms like TikTok was optimised to reward the kind of emotionally engaging, short-form videos produced by these accounts.
Platform enforcement has not kept pace. TikTok’s own 2025 policy updates require AI-generated content to be labelled. None of the accounts identified in this investigation carried that label. The gap between policy and enforcement is not a technical mystery. It is a commercial one: platforms that restrict synthetic content aggressively risk reducing engagement and ad revenue.
▪️3. What Happened
The Times began systematically tracking a pattern of AI-generated avatar accounts on TikTok in January 2026 and by April had documented at least 304 accounts sharing coordinated pro-Trump content, some of which had already been removed by the time of publication. Researchers at Purdue University’s Governance and Responsible AI Lab independently identified a further dozen accounts across TikTok, Instagram, and Facebook. Analysts at digital threat mitigation firm Alethea found nine more on YouTube. The operation’s total footprint across four platforms ran to a confirmed minimum of 325 accounts.
The accounts presented as ordinary, attractive Americans, posting rapidly about topics including the war in Iran, abortion, immigration, and cultural flashpoints. Their tell was their sameness. Multiple accounts posted identical, grammatically awkward captions within the same week.
One account tracked by the Times changed its avatar’s appearance six times across 37 videos, adjusting hair and eye colour in patterns consistent with commercial audience targeting tests.
The Washington Post had identified one account independently four weeks earlier. An Instagram persona called Jessica Foster had accumulated over one million followers since appearing in December 2025, posting fabricated images of herself alongside President Trump and foreign leaders and falsely claiming military service in a non-existent operation. That account funnelled followers to a paid adult content platform and has since been removed by Instagram. Trump reposted content from at least one separate AI avatar on Truth Social, amplifying fabricated claims about California’s governor to his own audience without apparent awareness that the source was synthetic.
▪️4. Classification
The New York Times investigation is factual reporting, corroborated independently by Purdue University’s GRAIL laboratory, digital threat firm Alethea, and the Washington Post’s earlier investigation into the Jessica Foster account.
The operation documented by the New York Times is classified as disinformation.
The accounts were deliberately constructed to deceive audiences about both their nature and the political views they claimed to represent.
The intent to deceive is confirmed by the consistent absence of AI labelling across all reviewed accounts, despite platform policies requiring it, and by the A/B testing behaviour that indicates deliberate optimisation for audience penetration rather than organic expression.
▪️5. Tactics And Methods
When a viewer encounters not one but dozens of apparently different, apparently real people independently expressing the same political view, the instinct is to read that as genuine consensus. That instinct is the target. The accounts were designed to populate a feed with the illusion of a political movement, not to make any single persuasive argument.
The execution was low-cost and operationally simple. AI video generation tools rendered faces that do not belong to real people, making reverse image searches ineffective.
TikTok reviewed the 304 flagged accounts and found no evidence of a coordinated influence operation, describing them instead as engagement-farming spam accounts. That assessment is plausible but insufficient. Whether or not a central coordinator exists, the accounts functioned as an influence operation in effect: they shaped political content feeds, amplified false claims, and deceived real voters who believed they were engaging with genuine supporters.
▪️6. Implications
The most important concept to understand here is astroturfing and why AI has changed it permanently. Astroturfing means manufacturing the appearance of grassroots political support where none organically exists. It has always been possible. Political operatives have paid people to attend rallies, post on forums, and write letters to newspapers for decades. What kept it bounded was cost and labour: you could only fake as much support as you could afford to staff.
That constraint no longer applies.
At one to three dollars per video, with a single person capable of operating the entire network, synthetic consensus is now available at a price that sits within the budget of a motivated individual, let alone a well-resourced campaign or foreign actor. The question is no longer whether someone can manufacture the impression of a political movement. It is whether anyone can reliably detect that they have.
Attribution remains the central unresolved question. Without technical forensics, including device fingerprinting, payment records, and account registration data held only by the platforms and law enforcement, any claim about who built this network is speculation. The absence of equivalent left-wing networks is noteworthy but should not be treated as a definitive finding until the methodology for that search is disclosed.
▪️sources
Hundreds of Fake Pro-Trump Avatars Emerge on Social Media | The New York Times | Tiffany Hsu
A pro-Trump ‘Army girl’ went viral online. Experts say she isn’t real. | The Washington Post | Drew Harwell
The Fake Influencer Plague Is Here: AI Comes For Your Newsfeed | U.S. News & World Report | Olivier Knox
TikTok and Instagram Ban Accounts for Unlabeled, Exploitative AI-Generated Black Female Avatars | OECD.AI Incidents
AI-Generated Influencers Are Spreading Political Content Across Social Media — What the Investigation Reveals | AI Tech News | Dr. Nikunj Raval
Ukraine Bot Farm Bust
▪️1. BLUF
On 20 April 2026, Ukraine’s Security Service (SBU) and National Police arrested a man in Zhytomyr who had been producing fake Telegram accounts at scale, selling over 3,000 per month to what Ukrainian authorities allege were Russian intelligence services.
These accounts were used to spread disinformation about Ukraine’s armed forces and to send fake bomb threats intended to trigger panic. The attribution to Russian intelligence is plausible and fits documented patterns, though no publicly verifiable intercept evidence supports it. Every account was registered on a genuine Ukrainian SIM card, giving it a domestic appearance that made the operation significantly harder to detect.
▪️2. Context
Inside Ukraine, Telegram is the primary news channel, military communication tool, and main public information feed, making it a priority target. Since Russia’s full-scale invasion in February 2022, Ukrainian authorities have documented a sustained effort to flood the platform with accounts that mimic ordinary Ukrainians, spreading Kremlin narratives and sending fake bomb threats that force real emergency responses.
The SBU and Cyber Police have dismantled dozens of bot farms since 2022. A Cyber Police sweep in July 2023 seized 150,000 SIM cards across 21 locations. A June 2024 arrest, also in Zhytomyr, targeted a woman selling fake accounts to fund phishing attacks on Ukrainian soldiers. The 2026 arrest shows the problem has not been solved. The infrastructure regenerates because the economics work: one person, one apartment, cheap hardware, and a buyer paying in cryptocurrency.
▪️3. What happened
On 20 April 2026, the SBU announced it had detained a man at his home in Zhytomyr, acting jointly with the National Police. His name has not been made public. Investigators simultaneously blocked approximately 20,000 fraudulent profiles operating across social media and messaging platforms.
The suspect was allegedly producing more than 3,000 new fake Telegram accounts each month, each registered to a genuine Ukrainian mobile number. Ukrainian SIM cards give accounts a domestic appearance that foreign-registered numbers cannot replicate. These accounts were then sold through online platforms used by pro-Russian actors, with Russian intelligence representatives named as the main buyers. The accounts served two purposes: spreading disinformation about Ukraine’s defence forces and internal political situation, and sending anonymous messages falsely claiming that facilities across the country had been mined. That second function is a direct public disruption tool, not just propaganda.
Investigators seized computer equipment, mobile phones, USB hubs connected to modems, and close to 2,000 SIM cards from multiple operators. The hardware is consistent with a SIM bank setup, commercially available equipment that allows one person to register and manage thousands of phone numbers simultaneously. The suspect is charged under Part 2 of Article 361 of Ukraine’s Criminal Code, covering unauthorised interference with information systems committed in conspiracy. Additional charges remain possible.
▪️4. Classification
This incident is classified as factual reporting about a disinformation infrastructure operation.
The underlying activity, mass production and sale of fake accounts used to circulate false narratives and bomb threats, is deliberate, coordinated disinformation.
▪️5. Tactics and methods
SIM farming is the core technique. A GSM gateway device, commercially available for a few thousand dollars, enables one person to register and control hundreds of phone numbers simultaneously. Each number produces an account that passes platform verification because a real mobile number is attached. The Ukrainian SIM cards are a specific adaptation. Telegram does not verify physical location, so accounts on Ukrainian numbers appear Ukrainian to any basic filter. The product being sold was not just accounts but apparently domestic ones, which carry a credibility that Russian-origin accounts cannot match.
▪️6. Implications
The arrest is significant not because of who was caught but because of the model it exposes. Russian intelligence is not building its Telegram influence infrastructure directly; it is purchasing from commercial operators. The Zhytomyr suspect is not a spy; the evidence points to someone running a cash business, paid in cryptocurrency through underground marketplaces. Arresting individual operators does not close the supply chain; it creates a vacancy.
Zhytomyr has produced at least two major bot farm arrests in 22 months. A July 2025 DFRLab and OpenMinds report found a separate network of 3,634 automated Telegram accounts posting over 316,000 pro-Russian comments in occupied territory channels between January 2024 and April 2025. This farm could plausibly have fed operations of that type. Enforcement is effective at the supply level; the demand remains unchanged.
The day after this bust, the EU sanctioned two Russian entities, Euromore and Pravfond, for running Kremlin information campaigns targeting European audiences. Whether the timing was deliberate, it signals Western institutions moving against Russian information operations on multiple fronts simultaneously.
