'Typosquatting' campaign imitated news outlets to spread propaganda for years, report says

The effort demonstrates how propagandists have adopted the SEO and social media tactics that real outlets have used to increase audience engagement.

Researchers have uncovered a years-long disinformation campaign in which suspected Iranian operatives masqueraded as well known international media outlets and used fake Twitter accounts to amplify fabricated news articles.

The group, dubbed Endless Mayfly, published some 135 news articles on sites meant to look like Bloomberg, The Guardian, The Atlantic, Politico and others, according to findings published Tuesday by Citizen Lab, the team of researchers at the University of Toronto.

The group impersonated outlets via a technique known as “typosquatting,” in which it used websites like “theatlatnic.com” instead of “theatlantic.com” to avoid detection. Endless Mayfly would use this method to push anti-Saudi narratives and other fabrications that would be picked up on social media and legitimate news outlets, Citizen Lab said. It also involved the use of 11 Twitter personas since 2016.

The effort demonstrates how propagandists have adopted the SEO and social media tactics that media outlets and other organizations have implemented to increase audience engagement. Similar campaigns have been uncovered in the past, though Citizen Lab’s report highlights how actors including international governments simply will nudge readers’ opinion in a certain direction, rather than seeking to overwhelm them with obvious propaganda.

“The campaign was neither strikingly clever nor particularly sensitive to the culture of the intended audience,” the report said. “However, it eluded blocking and detection for years, generated some social media engagement and achieved a few successful cross-overs into mainstream news.”

Citizen Lab decided with “moderate confidence” the operation was tied to Iran or an Iranian-aligned entity in part because the disinformation “systematically benefit Iranian interests or fit within familiar propaganda narratives already used by the Iranian government.” Researchers also cited findings previously published by FireEye and Facebook, which tied a similar effort to Iranian state media.

“The network is still active at the time of writing, although its activity levels and tactics have evolved since we first began observing it,” the researchers wrote.

Unlike in previous disinformation campaigns, Endless Mayfly would delete the content of its fake articles when they gained traction on social media. They would then replace the story with a legitimate link to the actual news outlet, apparently in an attempt to trick the reader into believing the story originated on that site and thus was credible.

“It is unclear how much demand they generated for the stories and narratives they were promoting, or whether they had a meaningful impact that swayed public opinion,” the group said. “Competing in the ‘attention economy’ is difficult and it is likely Endless Mayfly failed to achieve the kind of impact that its operators and backers hoped for.”

Researchers say Israeli government likely behind AI-generated disinfo campaign in Iran

The group leveraged dozens of social media accounts and “routinely used” AI-generated imagery and video to stoke unrest among Iran’s population, according to Citizen Lab. 

Researchers say media outlet targeting Moldova is a Russian cutout

WhatsApp says it disrupted spyware campaign aimed at reporters, civil society

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure