An examination of forged media reports and multi-candidate targeting during the August 2026 disinformation campaign.
The Claim
On 12 August 2026, a video circulating on X appeared to show a caricature of presidential candidate Gabriel Attal projected onto a wall of the Panthéon in Paris. One week later, on 19 August, a second wave followed: at least five fake news reports and five forged front pages attributed to French and European media, including a counterfeit Agence France-Presse (AFP) item. Over the course of August, fabricated content about Attal borrowed the visual identity of outlets including AFP, Le Monde, Le Figaro and Libération.
The fakes pushed two main narratives. The first was that Attal had been hospitalised or was suffering from Parkinson’s disease. The second was that people close to him were involved in cyberattacks on the French tax administration. The posts were then aimed at journalists and fact-checkers, who were tagged and asked to “verify” the material, in an attempt to force coverage and draw the claims into mainstream election commentary.
The Fact
VIGINUM, the French agency against foreign digital interference and part of the Secretariat-General for National Defence and Security (SGDSN), assessed the narratives as inauthentic and manifestly inaccurate or misleading. It attributed the operations to Matriochka, a pro-Russian information operation that researchers also track as Operation Overload. None of the outlets whose branding was used published these reports.
On the Panthéon video, VIGINUM noted that it was still checking whether the caricature had actually been projected onto the monument or added digitally. The forged media reports, by contrast, are established fabrications.
Paid views were used to amplify the content artificially, but its real reach was very limited. Researchers at Antibot4Navalny estimated only a few hundred organic views per video. VIGINUM warned that media coverage risks amplifying content that very few citizens actually saw, which is exactly the operators’ goal of saturating public debate.
How Matriochka Works
VIGINUM’s June 2024 technical report on Matriochka describes the network’s standard method:
- Content first appears on Russian-language Telegram channels such as @sheyhtamir1974, @belshkarvka and @thehandofkremlin.
- “Seeder” accounts then post the fakes on X.
- Some 30 to 40 minutes later, “quoter” accounts share them in replies. Each operation targets between 50 and 150 media outlets, fact-checkers and other entities.
- The accounts appear to have been bought from a specialised vendor, and all use digitally generated profile pictures.
By the time of that report, VIGINUM had recorded at least 90 successive operations since September 2023.
From Stagecraft to Narrative Manipulation
Matriochka’s logic is not mass persuasion. It manufactures cheap counterfeits, such as short videos, forged screenshots, fake front pages and letters, and places them directly in front of journalists and fact-checkers. The aim is to exploit the media’s duty to verify. Every request for a debunk consumes newsroom time, and every debunk risks giving national visibility to a forgery that would otherwise have gone almost unseen. The wider effect is information saturation, in which authentic reporting must constantly compete with fabricated artefacts.
Who Was Targeted, and Who Reacted?
Attal was not the only target. In August and September 2026, pro-Russian operations targeted mainstream candidates from the centre-left to the centre-right. Rather than backing one candidate, they appear designed to erode trust in the democratic centre and deepen polarisation ahead of the 2027 presidential election.
- Gabriel Attal (Renaissance) was targeted in three waves in August. On 5–6 August, fake reports used the branding of outlets including Le Monde, RFI, BFM and AFP. On 12 August came the Panthéon video, and on 19 August the ten forged reports and front pages. VIGINUM attributed the operations to Matriochka.
- Édouard Philippe (Horizons) was targeted in August by fakes using Le Monde and AFP mastheads. They falsely attributed admissions of corruption to him and made false claims about his wife and vaccines, and researchers linked them to Matriochka. In late August, a video spread through a fake Italian news site, “Repupplica.com”, invented a €15 million villa purchase in Sicily. According to Euronews, French authorities have linked some of these operations to pro-Russian networks.
- Raphaël Glucksmann (Place Publique) was targeted from 30 July with a cloned site impersonating the investigative outlet Blast (blastinfo.fr), a deepfake video and a fabricated email. These also targeted his partner, the journalist Léa Salamé. French authorities attributed the operation to Storm-1516.
The Paris Prosecutor’s Office has opened investigations into suspected Russian interference targeting Attal, Philippe and Glucksmann. This followed complaints filed by Attal on 7 August and by Glucksmann on 12 August, after SGDSN had informed him of the operation.
Think Before You Trust
- Compare the design. Check typography, logo and layout against the outlet’s official website, not against circulating screenshots.
- Look for the link. Treat a screenshot or clip as unverified until you can find the story on the outlet’s own domain.
- Watch the tagging. New or zero-follower accounts that tag dozens of journalists and ask them to “verify” a leak are a classic sign of a coordinated operation.
- Check before sharing. Consult VIGINUM, EUvsDisinfo (EEAS) and EDMO-affiliated fact-checkers.
Sources
- VIGINUM/SGDSN, Matriochka: A pro-Russian campaign targeting media and the fact-checking community, June 2024
- AFP via La Libre, 21 August 2026; Blick, August 2026; Journal du Net, August 2026
- Euronews, 12 August, 18 August and 8 September 2026
- AFP via Yahoo Actualités, on Glucksmann and Salamé, August 2026