Canadian researchers have unmasked a disinformation campaign with possible links to Iran that includes posing as mainstream media to spread falsehoods targeting primarily Israel, Saudi Arabia and the United States.
The University of Toronto's Citizen Lab said an "Iran-aligned" group has impersonated legitimate media outlets using copycat sites to "spread falsehoods and amplify narratives critical of Saudi Arabia, the United States and Israel."
The group, which the researchers dubbed "Endless Mayfly," would then use fake online identities to amplify the stories by tweeting about them or forwarding links to others.
Stories published in mainstream media are often picked up by other journalists.
The researchers cited as an example a 2017 Reuters story informed by a fake story purported to have been published in the Swiss newspaper The Local.
The Reuters story was picked up by Global News, The Jerusalem Post and others before it was eventually retracted by the news agency.
The Endless Mayfly group would delete the original inauthentic articles soon after they were posted to hide their trail, but references to the false content would often remain online.
The group created at least 135 inauthentic articles and 72 lookalike domains of well-known media outlets, using common misspellings (typosquatting) of websites such as theguaradian.com for Britain's Guardian newspaper. The daily's real address is theguardian.com.
It reached thousands of readers around the world since 2016, said the Citizen Lab, with false stories about the CIA staging a coup in Turkey, Saudi Arabia funding French President Emmanuel Macron's election campaign and Arab countries ganging up on Qatar to prevent it from hosting the 2022 FIFA World Cup, for example.
The authors of the report said they "cannot conclusively prove" that Iran is behind the campaign, but added that "Iran or an Iran-aligned actor is the most plausible" culprit, noting that the narratives fit with Iran's interests and political rhetoric.
They also said that, despite having tracked many clicks, retweets and media coverage of the misinformation, "it is unclear to what extent the operations swayed public opinion."