Alberto Fittarelli
@fittarelli.com
Sr. Researcher @citizenlab.ca, Disinformation & Harassment. Fmr. Meta. Trainer: find & expose covert influence. I like doers.
Let me be *really* clear. Confirmation bias is NOT believing your eyes when you have multiple clear data sources *all* confirming what they see.
Check the bodycam footage. Check the NYT multi-angle reconstruction, and the witnesses statements.
This was plain murder.
Check the bodycam footage. Check the NYT multi-angle reconstruction, and the witnesses statements.
This was plain murder.
January 10, 2026 at 1:02 PM
Let me be *really* clear. Confirmation bias is NOT believing your eyes when you have multiple clear data sources *all* confirming what they see.
Check the bodycam footage. Check the NYT multi-angle reconstruction, and the witnesses statements.
This was plain murder.
Check the bodycam footage. Check the NYT multi-angle reconstruction, and the witnesses statements.
This was plain murder.
6/ Is “she” alone? Oh no. Here’s another example of legit, patriotic, antisemite Finn posting the same content and logging into X from… a Swiss VPN IP.
January 7, 2026 at 9:37 AM
6/ Is “she” alone? Oh no. Here’s another example of legit, patriotic, antisemite Finn posting the same content and logging into X from… a Swiss VPN IP.
5/ Do we know “she” is Russian-based? No. Do we know she’s real? Also no.
Because of course “she” operates the account from a VPN, and has zero personal information on it.
Except an anonymous blog on Blogspot, where “she” posts writings by… Aleksandr Dugin.
Because of course “she” operates the account from a VPN, and has zero personal information on it.
Except an anonymous blog on Blogspot, where “she” posts writings by… Aleksandr Dugin.
January 7, 2026 at 9:37 AM
5/ Do we know “she” is Russian-based? No. Do we know she’s real? Also no.
Because of course “she” operates the account from a VPN, and has zero personal information on it.
Except an anonymous blog on Blogspot, where “she” posts writings by… Aleksandr Dugin.
Because of course “she” operates the account from a VPN, and has zero personal information on it.
Except an anonymous blog on Blogspot, where “she” posts writings by… Aleksandr Dugin.
4/ But “she” doesn’t stop at that! Let’s not forget to throw in the mix a copy of the Protocol of the Elders of Zion, it’s still fashionable in 2026 after all.
January 7, 2026 at 9:37 AM
4/ But “she” doesn’t stop at that! Let’s not forget to throw in the mix a copy of the Protocol of the Elders of Zion, it’s still fashionable in 2026 after all.
3/ “She” is gloating about the US threats to Greenland and Denmark, naturally. And doesn’t forget to link them to Denmark’s integrity in supporting Ukraine.
January 7, 2026 at 9:37 AM
3/ “She” is gloating about the US threats to Greenland and Denmark, naturally. And doesn’t forget to link them to Denmark’s integrity in supporting Ukraine.
2/ Of course, she mainly posts articles from the “Pravda Network” (aka Portal Kombat, that we all know by now to be a Russian network. Check the great Viginum reports on it.)
“Her” niche is Finland, so here’s the Finnish website.
“Her” niche is Finland, so here’s the Finnish website.
January 7, 2026 at 9:37 AM
2/ Of course, she mainly posts articles from the “Pravda Network” (aka Portal Kombat, that we all know by now to be a Russian network. Check the great Viginum reports on it.)
“Her” niche is Finland, so here’s the Finnish website.
“Her” niche is Finland, so here’s the Finnish website.
1/ Russian disinfo sponsors can’t believe their luck at the chaos spurred by their American counterparts. Not only politicians, but their tech enablers too, of course.
Meet “Budjetti”. “She” is on X, of course. Openly antisemitic, racist, anti-Ukraine. And completely unchallenged.
Meet “Budjetti”. “She” is on X, of course. Openly antisemitic, racist, anti-Ukraine. And completely unchallenged.
January 7, 2026 at 9:37 AM
1/ Russian disinfo sponsors can’t believe their luck at the chaos spurred by their American counterparts. Not only politicians, but their tech enablers too, of course.
Meet “Budjetti”. “She” is on X, of course. Openly antisemitic, racist, anti-Ukraine. And completely unchallenged.
Meet “Budjetti”. “She” is on X, of course. Openly antisemitic, racist, anti-Ukraine. And completely unchallenged.
6/ To the point that… it’s still being used today. And very likely, also by the governments targeted here in the first place.
In October 2025, we reported on PRISONBREAK, a most likely Israeli-run IO targeting Iran. They had a variation on the ephemerality theme: fake links to real news outlets.
In October 2025, we reported on PRISONBREAK, a most likely Israeli-run IO targeting Iran. They had a variation on the ephemerality theme: fake links to real news outlets.
December 12, 2025 at 4:15 PM
6/ To the point that… it’s still being used today. And very likely, also by the governments targeted here in the first place.
In October 2025, we reported on PRISONBREAK, a most likely Israeli-run IO targeting Iran. They had a variation on the ephemerality theme: fake links to real news outlets.
In October 2025, we reported on PRISONBREAK, a most likely Israeli-run IO targeting Iran. They had a variation on the ephemerality theme: fake links to real news outlets.
5/ Their “ephemeral disinformation” technique was later seen with other actors, and in different contexts. We won’t award a prize for who came up first with it… but we will say: it was effective. And intentionally confusing.
December 12, 2025 at 4:15 PM
5/ Their “ephemeral disinformation” technique was later seen with other actors, and in different contexts. We won’t award a prize for who came up first with it… but we will say: it was effective. And intentionally confusing.
4/ Why was Endless Mayfly special? We reported about it in 2019, but tracked the origin of that specific part of the campaign to at least 2017. Despite coming early into the online IO landscape - or what we now know of it - this actor was *skilled*. And it used some frustrating evasion techniques.
December 12, 2025 at 4:15 PM
4/ Why was Endless Mayfly special? We reported about it in 2019, but tracked the origin of that specific part of the campaign to at least 2017. Despite coming early into the online IO landscape - or what we now know of it - this actor was *skilled*. And it used some frustrating evasion techniques.
3/ Meta’s attribution tied Endless Mayfly to a broader set of campaigns that the company has disrupted on its platforms repeatedly over the years.
December 12, 2025 at 4:15 PM
3/ Meta’s attribution tied Endless Mayfly to a broader set of campaigns that the company has disrupted on its platforms repeatedly over the years.
2/ Meta notes: “Our investigation has compiled multiple, corroborating lines of evidence […] that attribute this multi-year operation to Iran’s International Union of Virtual Media (IUVM), a sanctioned propaganda group with close links to the Iranian government.”
December 12, 2025 at 4:15 PM
2/ Meta notes: “Our investigation has compiled multiple, corroborating lines of evidence […] that attribute this multi-year operation to Iran’s International Union of Virtual Media (IUVM), a sanctioned propaganda group with close links to the Iranian government.”
Here’s a trip down memory lane:
December 9, 2025 at 12:29 PM
Here’s a trip down memory lane:
For example: remember #JUICYJAM? The self-professed “businesswoman” who doxxed Thai protesters with information that only a government could have access to?
How likely is it that such an innocent private user is regularly on a Japanese VPN despite using the Thai version of the Android X app?
How likely is it that such an innocent private user is regularly on a Japanese VPN despite using the Thai version of the Android X app?
November 26, 2025 at 9:17 AM
For example: remember #JUICYJAM? The self-professed “businesswoman” who doxxed Thai protesters with information that only a government could have access to?
How likely is it that such an innocent private user is regularly on a Japanese VPN despite using the Thai version of the Android X app?
How likely is it that such an innocent private user is regularly on a Japanese VPN despite using the Thai version of the Android X app?
This entire keynote by @micahflee.com should be watched, but this excerpt, my friends - oh yes.
micahflee.com/practical-de...
micahflee.com/practical-de...
October 26, 2025 at 4:21 PM
This entire keynote by @micahflee.com should be watched, but this excerpt, my friends - oh yes.
micahflee.com/practical-de...
micahflee.com/practical-de...
I thought we had agreed a few decades ago that Nazi propaganda was bad?
October 11, 2025 at 9:48 AM
I thought we had agreed a few decades ago that Nazi propaganda was bad?
15/ At the moment of publishing this, several PRISONBREAK profiles continue to be active. We notified X prior to publication - but got no reply.
October 3, 2025 at 3:32 AM
15/ At the moment of publishing this, several PRISONBREAK profiles continue to be active. We notified X prior to publication - but got no reply.
14/ So - who’s behind PRISONBREAK? We analytically weighed multiple hypotheses. The one most consistent with the available evidence is that the Israeli gov, directly or through a contractor, conducted the operation. Alternatively, but less likely, the US gov could be responsible for it.
October 3, 2025 at 3:32 AM
14/ So - who’s behind PRISONBREAK? We analytically weighed multiple hypotheses. The one most consistent with the available evidence is that the Israeli gov, directly or through a contractor, conducted the operation. Alternatively, but less likely, the US gov could be responsible for it.
13/ Finally, we noticed PRISONBREAK consistently promoting and interacting with an account named “تلآویو تهران” (Tel Aviv Tehran), which used an AI-generated persona to spread content very similar to the IO’s one. Including another AI-made “Evin Prison” video.
October 3, 2025 at 3:32 AM
13/ Finally, we noticed PRISONBREAK consistently promoting and interacting with an account named “تلآویو تهران” (Tel Aviv Tehran), which used an AI-generated persona to spread content very similar to the IO’s one. Including another AI-made “Evin Prison” video.
11/ We have many more examples in the report. But one that’s worth highlighting here is the creation of a whole videoclip for “Baraye”, an Iranian protest anthem. The catch? The lyrics were changed to a direct call for uprising; and the video is a (poorly made) deepfake of 3 known Iranian singers.
October 3, 2025 at 3:32 AM
11/ We have many more examples in the report. But one that’s worth highlighting here is the creation of a whole videoclip for “Baraye”, an Iranian protest anthem. The catch? The lyrics were changed to a direct call for uprising; and the video is a (poorly made) deepfake of 3 known Iranian singers.
10/ The use of AI in the campaign is *pervasive*. An attentive reader could have spotted the botched artifacts that often come with AI-generated videos, like the one claiming to show a crowd withdrawing their money from a bank in apparent panic. Just check the distorted human figure in yellow.
October 3, 2025 at 3:32 AM
10/ The use of AI in the campaign is *pervasive*. An attentive reader could have spotted the botched artifacts that often come with AI-generated videos, like the one claiming to show a crowd withdrawing their money from a bank in apparent panic. Just check the distorted human figure in yellow.
9/ In fact, the network had only just started increasing pressure on the Iranian government by spreading claims of state bankruptcy, generalized lack of basic resources (water, for example), and broader societal unrest.
October 3, 2025 at 3:32 AM
9/ In fact, the network had only just started increasing pressure on the Iranian government by spreading claims of state bankruptcy, generalized lack of basic resources (water, for example), and broader societal unrest.
8/ We now know that that didn’t happen. Iranian security forces retook control of the prison later that same day, temporarily transferring prisoners to different facilities before returning them to Evin in August 2025. But PRISONBREAK was not done yet.
October 3, 2025 at 3:32 AM
8/ We now know that that didn’t happen. Iranian security forces retook control of the prison later that same day, temporarily transferring prisoners to different facilities before returning them to Evin in August 2025. But PRISONBREAK was not done yet.
7/ What was possibly even more fascinating was the quick pivot by the network, immediately after the bombings stopped, to encourage Iranians in reaching the Evin Prison and free the prisoners. “The area is now safe”, some of the accounts posted.
October 3, 2025 at 3:32 AM
7/ What was possibly even more fascinating was the quick pivot by the network, immediately after the bombings stopped, to encourage Iranians in reaching the Evin Prison and free the prisoners. “The area is now safe”, some of the accounts posted.
6/ The video initially tricked the international press into republishing it as real. Not only that: it was even reposted by the Israeli MoFA, Gideon Sa’ar. It was later spotted as AI-generated footage by several outlets.
October 3, 2025 at 3:32 AM
6/ The video initially tricked the international press into republishing it as real. Not only that: it was even reposted by the Israeli MoFA, Gideon Sa’ar. It was later spotted as AI-generated footage by several outlets.