‘Typosquatting’ campaign imitated news outlets to spread propaganda for years, report says

Researchers have uncovered a years-long disinformation campaign in which suspected Iranian operatives masqueraded as well known international media outlets and used fake Twitter accounts to amplify fabricated news articles.

The group, dubbed Endless Mayfly, published some 135 news articles on sites meant to look like Bloomberg, The Guardian, The Atlantic, Politico and others, according to findings published Tuesday by Citizen Lab, the team of researchers at the University of Toronto.

The group impersonated outlets via a technique known as “typosquatting,” in which it used websites like “theatlatnic.com” instead of “theatlantic.com” to avoid detection. Endless Mayfly would use this method to push anti-Saudi narratives and other fabrications that would be picked up on social media and legitimate news outlets, Citizen Lab said. It also involved the use of 11 Twitter personas since 2016.

An example of the disinformation tactics used by Endless Mayfly (via Citizen Lab).

The effort demonstrates how propagandists have adopted the SEO and social media tactics that media outlets and other organizations have implemented to increase audience engagement. Similar campaigns have been uncovered in the past, though Citizen Lab’s report highlights how actors including international governments simply will nudge readers’ opinion in a certain direction, rather than seeking to overwhelm them with obvious propaganda.

“The campaign was neither strikingly clever nor particularly sensitive to the culture of the intended audience,” the report said. “However, it eluded blocking and detection for years, generated some social media engagement and achieved a few successful cross-overs into mainstream news.”

Citizen Lab decided with “moderate confidence” the operation was tied to Iran or an Iranian-aligned entity in part because the disinformation “systematically benefit Iranian interests or fit within familiar propaganda narratives already used by the Iranian government.” Researchers also cited findings previously published by FireEye and Facebook, which tied a similar effort to Iranian state media.

“The network is still active at the time of writing, although its activity levels and tactics have evolved since we first began observing it,” the researchers wrote.

Unlike in previous disinformation campaigns, Endless Mayfly would delete the content of its fake articles when they gained traction on social media. They would then replace the story with a legitimate link to the actual news outlet, apparently in an attempt to trick the reader into believing the story originated on that site and thus was credible.

“It is unclear how much demand they generated for the stories and narratives they were promoting, or whether they had a meaningful impact that swayed public opinion,” the group said. “Competing in the ‘attention economy’ is difficult and it is likely Endless Mayfly failed to achieve the kind of impact that its operators and backers hoped for.”