Operation Doppelganger
A Russian influence campaign that cloned legitimate Western news websites to spread Kremlin-aligned narratives, making disinformation appear to come from trusted media outlets.
What we know
Operation Doppelganger is a Russian influence campaign, first identified and named by researchers in 2022, that creates near-identical clones of legitimate Western news websites, including outlets such as Der Spiegel, The Guardian, and Fox News, copying their layout, branding, and typefaces closely enough that casual readers may mistake the fake site for the genuine outlet, then publishing Kremlin-aligned narratives under that borrowed visual credibility.
The U.S. Department of Justice announced in 2024 that it had disrupted part of the operation, seizing more than 30 internet domains that had been used to host these cloned websites and disclosing detailed technical evidence, including domain registration records and network infrastructure analysis, tying the operation to Russian government-linked entities. The disclosed material described a coordinated campaign that used the cloned sites to publish fabricated articles, which were then amplified through networks of fake social media accounts designed to drive traffic to the counterfeit pages.
Independent research organizations, including EU DisinfoLab, which first documented and named the operation, identified specific technical patterns distinguishing the fake sites: URLs using slight misspellings or alternate domain extensions of the real outlets, article content that mixed some genuine wire-service copy with inserted fabricated claims, and a distribution pattern relying heavily on paid social media advertising to drive visibility, a notably different and more resource-intensive tactic than the organic-looking troll farm posts used in earlier Russian influence operations.
The operation specifically targeted audiences in multiple European countries and the United States with content designed to undermine support for Ukraine and to amplify divisive domestic political narratives within the target countries, following the same broader strategic goal documented across other Russian influence operations of eroding institutional trust rather than promoting a single unified message.
Meta and other social media platforms have separately confirmed removing large numbers of accounts and advertisements linked to the operation in their own periodic threat reports, providing platform-side corroboration of the findings independently made by EU DisinfoLab researchers and the U.S. Justice Department, and the cloned-website tactic itself has prompted several legitimate news outlets to issue public warnings to their own readers about the existence of fraudulent copies of their sites.
Researchers have noted that the operation's reliance on cloning real, trusted outlets rather than inventing entirely new fictional ones represents a deliberate exploitation of audiences' existing trust heuristics, since readers who recognize a familiar publication's visual branding are statistically less likely to apply the same scrutiny they might to an unfamiliar source, a vulnerability that media literacy researchers say requires teaching audiences to verify URLs directly rather than relying on visual branding recognition alone.
Several EU member states have since introduced or strengthened domestic legal frameworks specifically addressing foreign information manipulation, citing Operation Doppelganger as a direct case study justifying the need for faster website takedown authority and stronger platform cooperation requirements.
Common claims
- Russia created fake websites impersonating major Western news outlets.Supported
- Doppelganger websites were easy to identify as fakes.Misleading
- The operation was fully shut down after DOJ seizures.Not supported