Narrative Ops #023 · Recruit three friends, share a video: the missions that fought Brazil’s election on WhatsApp
#023

Recruit three friends, share a video: the missions that fought Brazil’s election on WhatsApp

Wednesday, October 28, 2026 · 9 min read

What does coordination look like when it is authentic? In Brazil’s runoff, both sides ran WhatsApp channels that gave millions of supporters the same instructions at the same time – the kind of synchronised activity detection tools are built to flag, produced this time by real voters.

Also: a week before the US midterms, a Russia-linked operation faked a sexual assault accusation against Texas Senate candidate James Talarico. And hacked files show Kremlin staff asking AI to write comments as “a 38-year-old Frenchman”. Welcome to issue 23 of Narrative Ops.

Main stories

How Brazil’s candidates turned WhatsApp into their main campaign platform

Photo: Sebastião Moreira/EPA

WhatsApp has been part of Brazil’s election fights for years: in 2018, the company admitted that its app had been used to send political messages in bulk. This year, after Lula finished behind Flávio Bolsonaro in the first round on October 4, both campaigns made it their main organising tool.

The largest channel, Exército do Lula (Lula’s Army), was run by congressman André Janones and grew from about 60,000 followers to almost 11 million in three weeks. Followers could not reply. They received “missions” – share this video, recruit three friends, push this hashtag – and carried them out on Instagram and X. Bolsonaro’s supporters ran a rival channel, Tropa do Flávio.

Screenshots: Exército do Lula/WhatsApp

Both sides took their complaints to the electoral court. Bolsonaro’s campaign said Lula’s Army spread false claims; the court briefly suspended the channel, found none of the flagged messages and let it return under monitoring. Lula’s campaign said Meta, which owns WhatsApp and Instagram, limited its reach and recommended the rival channel to people searching for Lula’s; the court ordered Meta to treat both candidates equally. Meta denies favouring either side.

Lula won the runoff on October 25 with 51.8% of valid votes. Two days later, Supreme Court justice Flávio Dino ordered the Federal Police to look for foreign interference in the campaign: whether Bolsonaro’s campaign received money from abroad, including through contacts with a US-based group called Rockbridge Network, whether accounts outside Brazil paid for posts, and whether Meta’s problems were technical or deliberate.

A fake ‘former student’ accused a Texas Senate candidate of assault, and researchers trace the video to Russia

Photo: Cécile Clocheret/AFP

James Talarico taught language arts at a San Antonio middle school before entering Texas politics; he is now the Democratic candidate for US Senate there, hoping to win a traditionally Republican state in the November 3 midterms. On October 20, an X account using the name of one of his former students posted two videos in which a man, speaking to camera, says Talarico sexually assaulted him in 2012. The account had been created in September, and its profile photo and old posts were copied from the real former student’s Facebook page. The real man told fact-checkers that the person in the videos is not him and called the clips “very bad AI”. San Antonio police have no record of any such report.

Researchers at the Institute for Strategic Dialogue and Clemson University attribute the videos to Storm-1516, a Russian operation that stages fake accusation videos and pushes them through influencer accounts; in 2024 it ran a nearly identical claim against Tim Walz, then the Democratic vice-presidential nominee. NPR traced the path of the Talarico post: 15 bot-like accounts shared it immediately, and about twelve hours later it was picked up by three accounts with large followings, one of which has advertised paid partnerships on X.

AP has since found a second target: a fabricated TV news report about Sherrod Brown, the Democratic Senate candidate in Ohio, that uses photos of Haya Akbik, a former intern in his office, who says the claims attributed to her are “completely made up”. X suspended the accounts that first posted both videos, though copies remained online on Tuesday. The Russian embassy did not respond to AP and has denied election interference in the past. After the House intelligence committee’s fifth classified briefing on October 27, its senior Democrat Jim Himes said nothing suggests an attempt to tamper with voting itself, and that the threat is disinformation aimed at voters.

Hacked files name the Kremlin officials who run Russia’s fake news sites

Photo: The Insider

Since 2022, an operation known as Doppelgänger has been cloning the websites of Bild, The Guardian and other Western outlets and filling the copies with fabricated stories meant to undermine support for Ukraine. Researchers have long attributed it to the Kremlin. The Insider, a Russian investigative outlet, has now obtained hacked correspondence between Russia’s Presidential Administration and the Agency for Social Design, the contractor that does the work.

The files show the project was set up under Sergey Kiriyenko, Putin’s first deputy chief of staff, and is run day to day by Ilya Gambashidze, whose agency reports its results to named Kremlin aides. One manager saved the prompts used to mass-produce comments with AI: a 450-character complaint about Olympic spending written as “a 38-year-old Frenchman”, a 400-character one about food prices as “a 38-year-old Polish woman”. By The Insider’s count the team failed more often than it succeeded, but its ads ran on Meta platforms and one of its Telegram channels reached 70,000 subscribers. In October 2024, Putin gave Gambashidze a state medal.

A study published by Sweden’s Psychological Defence Agency on October 15 maps the wider system around Kiriyenko. Its authors count at least 50 state-affiliated organisations and 20 long-term programmes under his direct or indirect control, with a combined budget of €1.3–1.7 billion a year – roughly what Russia spends on all of its state media, RT included. They conclude that Kiriyenko likely oversees all Russian information influence campaigns, and name Moldova, Hungary and Armenia as recent targets.

Republicans are missing from Georgia’s Senate race on social media, our study shows

Illustration: AI-generated

National Republican groups have scaled back television advertising in Georgia ahead of the November 3 midterms, and we set out to see whether the same retreat shows online. Across 12,447 posts on seven platforms and in 201 podcast episodes, arguments framed in Democratic terms outnumber Republican-framed ones nearly eight to one – 8,287 to 1,043 – in the Senate race between Democratic incumbent Jon Ossoff and Republican challenger Mike Collins.

We collected the posts from 6,040 accounts on Bluesky, Facebook, Instagram, Rumble, TikTok, Truth Social and X between August 21 and October 13, mapped them into 100 distinct narratives and checked more than 5,000 of them by hand. The gap comes from the number of voices: 4,609 accounts posted Democratic-framed content against 563 on the Republican side, while in both camps the most active 1% of accounts produced the same share of posts, 18%. “Republicans aren’t being outshouted, they are simply not showing up,” said Mykolas Katkus, CEO of Repsense.

Posts about the candidates outnumber posts about policy, 9,163 to 2,866. Immigration is the one policy area where Republican framing leads, 90 posts to 26, once progressive criticism of Ossoff is set aside. Read the full report.

Dispatch

France sets up an “information strike force” to defend its companies

Campaigns against French companies follow a schedule, foreign minister Jean-Noël Barrot says: doubt about a firm is seeded six months before a major contract, amplified three months out, and widespread a month before the decision. He announced a unit that will detect and counter such campaigns through France’s 400 diplomatic posts. Cases documented by VIGINUM, the French agency that tracks foreign digital interference, include a fake press release that moved a share price and video-game images used against the Rafale fighter jet.

France Diplomacy

Four fake stories targeted the Baltics in under three weeks this summer

Between July 30 and August 17, DFRLab counted four fake stories aimed at Estonia, Latvia and Lithuania: a forged Defense Post article about F-16 jets damaged at Estonia’s Ämari air base, a claim linking the presidents of Estonia and Lithuania to Jeffrey Epstein, a made-up report that a Ukrainian soldier shot three NATO troops during an exercise in Latvia, and a false claim that few Latvian conscripts reported for duty. It found 275 posts across seven platforms and links all four to the Russian operation Storm-1516. Estonia’s Propastop has now traced the F-16 fake to a copied news site that still carried the real outlet’s analytics code.

Propastop

Israeli parties reported a flood of Russian-language WhatsApp messages on election eve

The day before Israel’s October 27 election, Avigdor Liberman’s Yisrael Beytenu party asked the elections committee to stop thousands of Russian-language WhatsApp messages, sent from Indian and Swedish numbers, telling voters the party would fail to enter parliament. Fake accounts also posed as Naftali Bennett’s party, which joined the appeal. Both asked the Shin Bet, Israel’s security service, to establish whether a foreign actor is behind the messages; so far these are allegations without attribution.

Times of Israel

A study of five million articles maps how the pro-Kremlin Pravda network works

A peer-reviewed study analysed 147 websites of the Pravda network and the 5.3 million articles they published over two and a half years. The sites write nothing themselves: 96.5% of their sources are Telegram channels, led by RT and other sanctioned outlets. The network grew in waves – Western countries first, later Africa and separatist regions – and has a distinct Baltic cluster. The authors suggest the design may be aimed at search engines and AI models as well as human readers.

Journal of Information Technology & Politics
The thread

Last week’s issue led with the European Commission beginning to examine what spread online during the riots in France.

The Commission has now declined to open a formal investigation under the Digital Services Act, the EU’s platform law, saying there is not enough evidence that foreign manipulation was behind the events. President Macron told reporters there was no evidence of foreign interference in the events themselves. Alliance4Europe, a counter-disinformation network, analysed 547,471 posts in nine languages and found no foreign actor starting the protests. It did find that the Russian Doppelgänger operation published 639 coordinated messages, seen about 7.4 million times, and that in English nearly one post in five blamed migrants, against one in 33 in French, Euronews and Alliance4Europe report.

Stay briefed
Narrative Ops · #023 Repsense

Powered by Repsense narrative intelligence