PARIS — Russian-linked disinformation has emerged as an early fault line in France’s 2027 presidential race after a succession of fabricated stories targeted three leading or prospective candidates across the political centre. The incidents, detected between late July and early August, have prompted warnings from candidates, action by prosecutors and renewed pressure on the government to strengthen France’s defences before the campaign enters its decisive phase.
The most recent operation targeted Gabriel Attal, the former prime minister associated with President Emmanuel Macron’s political camp. It used counterfeit videos, supposed news reports and fabricated front pages carrying the visual identities of established French and international media organisations. Among the brands imitated were RFI, BFM TV, France 24, Agence France-Presse, Le Parisien, Ouest-France, Libération, Le Figaro and Le Monde. The use of familiar logos and presentation styles was intended to give unsupported allegations the appearance of professional reporting.
Viginum, France’s service for monitoring and protecting against foreign digital interference, attributed the operation with “high confidence” to Matryoshka, an established pro-Russian influence network. The service operates under the General Secretariat for Defence and National Security, or SGDSN, and is responsible for detecting and characterising foreign operations that use deceptive and artificially amplified content to damage France’s interests or its digital public debate.
Researchers from Antibot4Navalny, a project that monitors pro-Russian automated activity, identified eight false videos aimed at Attal. The clips presented different supposed scandals but reportedly repeated a common conclusion that the allegation would weaken his position before the presidential election. Some contained invented quotations designed to provoke political, religious or identity-based tensions. There was no evidence that the statements attributed to Attal and other public figures were authentic.
Matryoshka’s established method helps explain why the operation was visible despite attracting little organic attention. In a 2024 technical report, Viginum described a two-stage system involving “seeder” accounts that publish fabricated content and “quoter” accounts that place links beneath posts by journalists, public institutions, politicians and fact-checkers. The second group asks prominent users to verify the material, creating pressure on them to view, discuss and potentially publicise content that would otherwise remain obscure.
The model turns verification itself into a distribution mechanism. A newsroom or political figure can expose a falsehood while simultaneously delivering it to an audience far larger than the network could reach independently. Viginum previously assessed that Matryoshka sought to discredit media outlets, public personalities and fact-checking organisations while promoting narratives favourable to Russia. The agency classified the continuing campaign as foreign digital interference.
Attal nevertheless chose to address the latest operation publicly, calling a press conference and warning that the Kremlin would probably continue acting against candidates with positions similar to his. He used the episode to reaffirm support for Ukraine and to challenge the National Rally over its historical relationship with Russia. Attal argued that the interference was intended to assist Marine Le Pen, saying the far-right party had consistently supported Moscow.
The National Rally disputed that interpretation. Party lawmaker Jean-Philippe Tanguy said Russian interference was routinely detected and stopped by the competent authorities and maintained that it had produced no electoral effect. He accused Attal of using the incident for political advantage and argued that attention should also be directed at potential influence originating from other foreign powers. Le Pen did not immediately make the attacks against her rivals a central subject of her public campaign messaging.
The disagreement illustrates how foreign interference can acquire political value even when the underlying content fails to circulate widely. A targeted politician has an incentive to rebut a damaging allegation before it grows, demonstrate vigilance on national security and portray an adversarial state as fearful of the candidate’s policies. Opponents, however, can accuse the candidate of exaggerating a marginal operation to raise visibility or claim international stature.
Attal was the third major figure in approximately 10 days to disclose a suspected Russian-linked campaign. Édouard Philippe, another former prime minister and the leader of the centre-right Horizons party, was targeted first. A video distributed on July 21 falsely suggested that he had a degenerative illness. French reporting attributed the material to Storm-1516, supported by another influence operation known as CopyCop. Philippe did not publicly engage with the substance of the false health claim.
Storm-1516 has been described by researchers and French reporting as a pro-Russian disinformation operation associated with Russian intelligence interests. It commonly places fabricated allegations on websites designed to resemble legitimate publications, then supports them with manipulated documents, staged material or synthetic audio and video. The content is subsequently circulated through social-media accounts and other channels in an effort to create the appearance that a genuine scandal is beginning to surface.
Raphaël Glucksmann, a member of the European Parliament and a prominent centre-left critic of the Kremlin, disclosed a separate operation at the beginning of August. A counterfeit article and video appeared on a website imitating the French outlet Blast. The material falsely alleged that his partner, France 2 journalist Léa Salamé, had attempted to bribe media organisations to support his possible presidential campaign. The operation included a deepfake reproducing the voice of journalist Edwy Plenel, the founder of Mediapart.
Glucksmann warned that the incident was an indication of what the 2027 campaign could face and predicted large-scale interference. The Paris prosecutor’s office subsequently opened an investigation into the disinformation effort targeting him. Judicial scrutiny makes the Glucksmann case more than a dispute over campaign messaging, although identifying and prosecuting operators based outside France may present significant practical and legal obstacles.
The three targets occupy different positions within France’s fragmented political landscape, but they share broadly critical views of Russia’s war against Ukraine. Philippe is building a centre-right presidential project, Glucksmann has become an influential pro-European figure on the centre-left, and Attal is competing for leadership of the post-Macron political centre. Their prominence makes them useful subjects for operations designed to test themes, response times and distribution networks before the official campaign.
The available evidence does not show that the recent fabrications changed voter preferences or reached a substantial authentic audience. Several items were crude, implausible or written in English despite being aimed at French voters. Automated accounts generated much of the visible activity. That distinction is important because evidence of an attempted influence operation is not evidence that the attempt succeeded, and presenting every detected falsehood as electorally decisive could overstate the capabilities of its authors.
French security specialists have therefore advised restraint. According to reporting on Viginum’s guidance, candidates and news organisations are often encouraged not to comment publicly when fabricated content has negligible circulation. Quiet authentication, platform referrals, evidence preservation and coordinated investigation can limit distribution while allowing authorities to map the infrastructure involved. A prominent rebuttal, by contrast, may place an otherwise invisible accusation before millions of people.
The risk creates a difficult editorial and political calculation. Silence may prevent amplification but can appear evasive if manipulated content is already spreading. A rapid public response can protect a candidate’s reputation but may reward the operators with attention. False branding also forces impersonated media organisations to defend their identities, since a fabricated clip can undermine confidence not only in the targeted candidate but also in the newsroom whose logo has been copied.
The strategic objective of such activity may be broader than persuading voters to accept any single claim. Repeated exposure to fake reports, corrections and claims of interference can encourage the belief that reliable information is impossible to identify. That atmosphere benefits actors seeking to reduce trust in institutions, professional journalism and electoral procedures. It can also deepen existing disputes over Ukraine, immigration, religion, national identity and relations with the European Union.
French officials are treating the incidents as an early warning rather than an isolated burst of online abuse. Prime Minister Sébastien Lecornu has said the detection apparatus established to monitor foreign digital interference is functioning. Political parties were brought together on June 11 to discuss threats to the presidential election, and another meeting is expected in September. President Macron, who is constitutionally barred from seeking a third consecutive term, has made protecting the integrity of the vote a government priority.
The government presented a short bill to the Council of Ministers on July 22 and wants it adopted in the autumn. According to the proposals reported by Le Monde, penalties for spreading false content during an election period would be tripled to as much as three years’ imprisonment and a €45,000 fine. An automatic system would also forward detected cases to the appropriate authorities in coordination with political parties.
Passing the legislation before campaigning restrictions take effect will require cross-party agreement amid a crowded parliamentary calendar and budget negotiations. The government has asked parties to propose improvements, but not all have responded. Lawmakers must also balance rapid intervention against protections for political speech, satire, investigative journalism and legitimate disagreement. Attribution can take time, while manipulated information can circulate globally within minutes.
The issue is producing demands that extend beyond criminal law. Marine Tondelier, a leading Green politician and possible presidential candidate, argued that foreign operations should be considered alongside the structural influence of social-media algorithms. She raised the possibility of restricting access to X if authorities confirmed a grave threat to electoral debate. Her criticism escalated into a public dispute with the platform’s owner, Elon Musk, highlighting the political sensitivities surrounding private control of major communications systems.
Jean-Luc Mélenchon, leader of the radical-left France Unbowed movement, called for candidates to form a common front against interference. Such cooperation could establish shared standards for handling suspicious material, including procedures for contacting Viginum, authenticating leaked documents and notifying other campaigns. It could also reduce incentives for parties to exploit fabricated allegations against rivals. Whether France’s sharply divided political forces can sustain that cooperation through a competitive presidential campaign remains uncertain.
Attention is also turning to campaign cybersecurity. Specialists caution that crude videos circulated by small networks may be less damaging than an intrusion into a party’s internal systems. France experienced that risk during Macron’s 2017 presidential campaign, when hacked documents were released online shortly before the decisive vote. A future operation could combine genuine stolen files with altered material, making rapid verification substantially more difficult.
Campaign organisations are beginning to adjust. Attal’s team said it had stopped using Telegram and moved communications to a secured internal application. Other parties will face similar pressure to protect staff accounts, donor information, strategic documents and candidate schedules. Strong authentication, restricted access, rehearsed incident procedures and direct contacts with state agencies may prove as important as public fact-checking.
The timing of the latest incidents gives French authorities and political organisations an opportunity to strengthen those safeguards, but it also suggests that interference will remain a recurring feature of the campaign. France’s first presidential round is scheduled for April 18, 2027, followed by a runoff on May 2 if no candidate wins an outright majority. With more than eight months remaining, hostile networks have time to refine their methods and adapt to official countermeasures.
The immediate challenge is to distinguish attempted interference from effective influence. Matryoshka and Storm-1516 have demonstrated persistence, access to synthetic-media tools and an ability to imitate trusted brands, but the latest fabrications appear to have achieved little genuine penetration before being exposed. French institutions must counter the operations without reinforcing the impression that outside actors possess unlimited power over the electorate.
For the candidates, the disclosures ensure that Russia policy, digital security and platform accountability will form part of the presidential debate well before formal campaigning begins. For voters, newsrooms and authorities, the test will be whether false content can be identified and contained without allowing the response to become the operation’s principal source of publicity. The incidents have not shown that Russia can determine France’s election, but they have shown that efforts to disrupt it are already under way.
Leave a Reply