October 13, 2021

Quality journalism and honest reporting bring crucial facts to the public. But, in numerous cases, “media” (whether self-depicted or registered) have played a role in producing and distributing disinformation campaigns. In this research paper, the EU DisinfoLab highlights the most damaging examples of disinformation campaigns involving “media” as key players of these malicious strategies.


This short paper collects a dozen recent examples of actors and disinformers posing as reputable news sources to gain legitimacy in the public’s eye and influence the debate. Overall, these deceptive tactics range from the creation of entirely false outlets and actors, such as establishing false news websites and fake personas, to the inclusion of some elements of authenticity to then distort them: corrupting real journalists, stealing their identity, or pushing authentic sources to amplify deceptive contents.

This paper highlights two trends:

  • Trend #1: Established news brands spreading disinformation, with notorious cases like France Soir or the role of mainstream media in electoral disinformation during the US elections.
  • Trend #2: Online “media” outlets posing as credible sources to spread disinformation, which includes for instance coordinated disinformation campaigns in the case of the MH17 takedown in Ukraine.

The list is not exhaustive, as our purpose is to raise awareness of the phenomenon.

These activities obstruct access to verifiable information. It also undermines professional journalists who follow strict deontological principles of objective and fact-based reporting, thereby polluting an essential service to inform citizens in a functioning democracy.

Trend #1: Established news brands spreading disinformation

A  tendency that calls for media accountability is the case of once reputable news agencies or journalists that – deliberately or not – go from transmitters of information to agents of disinformation.

Resting on their past credibility, once reputable sources rebrand as disinformation spreaders

The conspiracy drift of FranceSoir (2016-ongoing). Founded in 1941 as an underground paper by young resistance leaders, FranceSoir (initially called “France-Soir – Défense de la France”) has been known as a distinguished and leading French newspaper, especially between the 1940s-1960s. However, the outlet went bankrupt in 2012 until it was bought and relaunched in 2016 as an online-only news media. As a number of journalists were let go by the end of 2019, the disinformation, conspiracy theories, and anti-vax content spread by the website increased. In 2020, NewsGuard called out the outlet for failing to adhere to several basic journalistic standards. In January 2021, the French Minister of Culture asked a court to re-examine the outlet’s status as a media of general and political information, although it was able to keep it as journalists are still employed there. In March 2021, YouTube decided to close FranceSoir’s channel for infringing its terms of service on health-based disinformation around COVID-19, and a few months later, the outlet was prevented from accessing Google Ads, following an investigative report aired on the French public broadcaster on the financing of conspiracy websites.

Polarised mainstream media hold greater responsibility in sharing disinformation than malign foreign actors.

Mainstream media amplifying disinformation around the US elections (October 2020). A study by the Berkman Klein Centre analysed a sample of 5.000 media stories, 5 million tweets, and 75.000 Facebook posts to conclude that a few mainstream American mass media and political elites have been the primary transmitters of Trump’s disinformation campaign against mail-in votes. In particular, Fox News – at the centre of many controversies for spreading disinformation of topics such as climate change and the COVID-19 vaccine – has been a key player. Therefore, it emerges that social media (regarding the platforms) and Russian trolls (concerning the actors) only played a secondary role in propagating this specific hoax.

Excessively factional media play an active role in spreading disinformation.

 Watching out for excessively political or factional media (2018-ongoing). In the era of alternative facts, factional media outlets with have often amplified disinformation. Many are familiar with the false and misleading content proliferated by Breitbart – especially after the deplatforming of the American Frontline Doctors video calling for the use of hydroxychloroquine to cure COVID-19 – or by Russian state-owned news agencies as Sputnik (e.g. in support of the Sputnik V vaccine). Nonetheless, the phenomenon extends also to other countries; for instance, the Institute for Strategic Dialogue recalled that during the 2018 Swedish elections: “nationalist, populist media outlets and politicians in Poland spread disinformation about the Swedish government and society both in Sweden itself and in English and Polish language media.”

Media outlets spreading disinformation go as far as obtaining recognition as registered newspapers.

Gasp.news & COVID-19 (April 2021). A 2021 Avaaz report showed that Italians are the least protected non-English Facebook users against disinformation. As the country was strongly affected by the pandemic and the subsequent infodemic, NewsGuard identified Oltre.tv as a COVID-19 misinformation super-spreader that reached approximately 1.5 million users. While the anti-science outlet (spreading conspiracies on vaccines, alternative cures, or blaming the government and Bill Gates) is not a registered news media, a Coda investigation showed that Oltre.tv shares similar content to Gasp.news, which is instead a registered online newspaper under Italian law. The two websites have the same publishing team and owner (a digital marketing and communication company), managing a network of seven Italian websites and Facebook pages that amplify each other’s content simultaneously, all flagged by NewsGuard.

Disinforming actors steal the identities of genuine journalists, exploiting their reputation to spread disinformation.

Taking over journalists’ identities to disinform (February 2021). Axios published an account of the stories of journalists whose names, photos, and bylines have been stolen by malignant actors to help give credibility to false news online. For instance, a reporter says his identity was hacked to propagate a right-wing meme conspiracy that the incoming US Defence Secretary planned to outsource systems to China; another became the amplifier of pro-Iranian regime propaganda from a fake Twitter handle. Another piece warns that media coverage is a quick, efficient, and less traceable way to mainstream a narrative by ensuring visibility while providing a façade of trustworthiness. As a consequence, actual journalists are increasingly targeted at the cost of their professional credibility.

Trend #2: Online “media” outlets posing as credible sources to spread disinformation

From malicious websites posing as reputable news sources to fake personas pretending to be journalists or experts, foreign and domestic disinformation operations have involved instances of claiming a media status to play on a false pretence of authenticity to push disinformation and polarising content.

Online media outlet coordinating with Russian intelligence to mislead a criminal court trial.

Bonanza Media & MH17 (November 2020). Presenting itself as an independent investigative platform in the Netherlands, Bonanza Media is a special-purpose disinformation media project devoted to propagating alternative narratives about the causes of the Malaysia Airlines Flight 17 (MH17) crash, as uncovered by Bellingcat. Former RT journalist Yana Yerlashova founded the outlet with the help of Dutch blogger Max van der Werff, who managed to receive Dutch press credentials a little after the website’s foundation in 2019. The investigation revealed that Bonanza Media, shortly after its creation, coordinated with Russia’s military intelligence and had a role in providing misleading elements in the criminal trial over the MH17 accident. The outlet also launched a crowdfunding campaign to finance an allegedly independent documentary and tracked aligned witnesses to reinforce their version of the story. Over the past months, the outlet broadened its contents from MH17-related conspiracies to include COVID-19 disinformation (e.g. accusing governments and mainstream media of overreacting to the health threat, opposing lockdown measures, or echoing claims that hospitals were empty).

Online media outlet spoofs on reputable media and operates intra-EU disinformation campaigns.

FranceLibre24: spoofing and manipulating online content (January 2020). In France, a past EU DisinfoLab investigation unveiled how a French-language media named France Libre 24 was, in reality, managed covertly by a controversial Polish far-right media network. Existing to this day, FL24.net relies on a spoofing strategy as its name reminds of quality news media France24. The outlet claims to repost content from credible sources. However, the articles are often manipulated to include false or polarising messages to affect the French political landscape on audience-dividing topics such as identity, religion, security, and migration. As Politico writes, such cases call our attention to the thorny challenges posed by intra-EU disinformation campaigns.

Online media outlet using fake personas to recruit freelance journalists.

PeaceData & the 2020 US election (September 2020). US cybersecurity firm Graphika found that self-defined “global news organisation” Peace Data was a Russian information operation set up by the Russian Internet Research Agency (IRA). The FBI proceeded to shut down the outlet, which manufactured a “content farm” of stories to sow discord ahead of the 2020 US Presidential elections. The Peace Data website named its staff, editor, and editorial assistants, all of whom were fake personas with AI-generated profile pictures. The Russian trolls used these fake personas to contact freelance journalists and American writers, paying them to write articles for the website.

Media outlets used for domestic influence operations to silence opposition.

Pro-Tabboune operations in Algeria (2019-ongoing). Online media posing as authentic outlets have been used for domestic influence campaigns, as in a cross-platform activity to advance the interests of Algerian President Abdelmadjid Tebboune, from his 2019 presidential candidacy to the 2020 constitutional referendum and 2021 parliamentary elections. Graphika shows that the operation also targeted the anti-corruption protest movement Hirak, seeking to silence dissenting voices. Platforms and pages were created, several of which also posed as independent media outlets or imitated legitimate news organisations to disseminate politically motivated messages supporting Tebboune.

Media outlets hire real freelance journalists to push hidden agendas.

AlphaPro & Pakistani propaganda (May 2021). In mid-2021, Facebook removed a network of accounts and pages that originated in Pakistan and engaged in coordinated inauthentic behaviour to target both domestic and international (English-, Pashto-, and Arabic-speaking) audiences associated with a Pakistan-based PR firm AlphaPro. Facebook found some links between the latter and another set of already removed accounts attributed to employees of the Pakistani military’s Inter Services Public Relations department. Many accounts involved fake personas or pretended to be independent media outlets that pushed a clear political anti-India and pro-Pakistan agenda. Graphika writes: “The accounts in this campaign also posed as independent media outlets and created original video content featuring paid actors and freelance journalists, demonstrating how political interests can trade on the values of a free press to advance their own agendas covertly”.

Media outlets franchise their malign activities to front media organisations and military factions.

Russian-linked assets in Africa  (December 2020). In December 2020, Facebook removed three separate networks that targeted communities across Africa, counting together 5.7 million followers. The Stanford Internet Observatory and Graphika reported that actors in two of these networks were previously affiliated with the Internet Research Agency (IRA) and Russian financier Yevgeniy Prigozhin. These grey propaganda activities have taken the form of covert operations with fake social media accounts, creating front media organisations, as well as funding and taking majority ownership in local news stations in numerous African countries (e.g. Central African Republic, Madagascar, Libya, etc.) that then started to air pro-Russian content.

In conclusion, the above list of examples is by no means exhaustive. It reflects how disinformation specialists encounter a media dimension to every single new information operation uncovered.