Imagine opening your phone and seeing a message from your government’s cybersecurity service. The logo is in the right corner, the language is official, and the message warns about a new threat. You pause, but the page matches every other official page you have seen. You share it with your family. You enter your phone number for a security alert. That moment—when a citizen’s trust is used as a doorway into their private life—has become a central weapon in Russia’s war against Ukraine. On September 28, the Security Service of Ukraine (SBU) issued a public warning that Russian intelligence has significantly intensified efforts to create fake websites and social media accounts that clone official Ukrainian government institutions and domestic media outlets. According to the SBU, these counterfeit platforms are deployed in coordinated information-psychological operations, or IPSO, designed to destabilize Ukraine’s internal political and social life and damage its credibility in the eyes of the world. In the early days of the invasion, social media was a lifeline. Official accounts of the Ukrainian government, the armed forces, and the SBU became essential sources for alerts about air strikes, curfews, and safe corridors. People learned to check Telegram channels before making any move. Now, Russian intelligence is using that learned dependence as a point of entry. If they can create an account that looks like the one millions of people trust, they can provoke anxiety, spread despair, or quietly steal the information that people give out of genuine urgency. The fakes are not merely annoying attempts at trolling; they are part of a deliberate strategy to make truth so foggy that citizens no longer know which security service, which news site, or which public official is real. For a country already fighting for its existence, this is more than an online nuisance: it is an attack on the basic trust that holds society together.
At first glance, the purpose of these cloned pages appears to be disinformation—fake quotes, fabricated announcements, exaggerated statistics. The SBU warns that beyond spreading targeted lies, the pages have a far more dangerous function: harvesting personal data. Russian operatives design these pages to collect names, locations, contact information, and online habits of Ukrainian citizens. Those who follow the pages or click on embedded links often find their accounts compromised. In some cases, they lose control of their own social media profiles. The SBU says that Russian hackers frequently compromise the accounts of users who interact with the malicious pages, using those stolen identities to expand their reach, recruit new victims, and gather sensitive intelligence. The focus of this information gathering is especially disturbing: Russia is interested in the combat activities of Ukraine’s Defense and Security Forces. In practice, that means an ordinary citizen’s careless click could eventually expose a soldier’s movements, a supply route, or the location of a defensive position. The human dimension of this is profound. People are not simply having their passwords stolen; they are being transformed, without their knowledge, into nodes in an espionage network. And once that happens, the psychological damage is unavoidable. A military spouse who accidentally clicks on a malicious link may spend weeks wondering if her actions will get someone killed. A student who liked a fake page might become cautious about every official post he sees, even the ones that could save his life. It is not only individual citizens who are vulnerable. The fake pages also imitate media outlets, which means journalists, fact-checkers, and international organizations may use them as sources without realizing they are reading Russian-produced fabrications. The waste of resources, the time spent debunking, the effort required to restore trust—all of this is part of the attack. The SBU’s warning also suggests that these fake platforms are not necessarily meant to last. They may appear before an election, during a sensitive military operation, or after a major event, do their damage, and disappear. That ephemeral nature makes them difficult to track and even more difficult to prosecute. Once a user clicks, the data is already gone; the page can be deleted overnight, leaving almost no trace for investigators.
Ukrainian cyberdefense has responded by going after the infrastructure of deception. The SBU’s Cyber Security Department announced that it has already identified and blocked more than 50 fraudulent online resources that specifically imitated the official branding and positioning of the SBU itself. In other words, before this warning was even public, the digital police were quietly dismantling fake SBU pages. This is a measure of how brazen the operation has become. It is not enough for Russia to clone the Ministry of Defense or a major news outlet; it has also tried to clone the very organization whose job is to catch such fakes. The level of craft behind these pages points to a sophisticated machine. The design elements, language choices, and information architecture are carefully copied, making it difficult for ordinary people to recognize a fake. Some pages may promise compensation for war victims; others may warn of imminent missile strikes; still others may ask people to enter personal details in order to receive a document. Each one is a different hook, but all are fishing in the same dark water. Behind each blocked resource, there are likely hours of analytical work by Ukrainian specialists: tracing server addresses, breaking down code, mapping out networks of linked accounts, and identifying the individuals orchestrating the operation. This is a silent war within a war, conducted in server halls and encrypted chat rooms. But it touches everyone. The fact that the SBU itself has been impersonated more than 50 times tells us that there is no institution sacred enough to be spared. To be clear, the 50 blocked pages are likely only the tip of the iceberg. The SBU’s announcement is a first public disclosure, not a comprehensive inventory. There are probably many more sites and profiles operating under other ministries, regional governments, and news organizations. The inside of this operation is difficult to observe, but its effects are visible in the increasing number of Ukrainians who say they no longer trust what they see online. This is a dangerous development: when state institutions are suspected of being fake, real warnings can be ignored and fake alarms can be believed. The SBU’s message is not just a warning; it is also an attempt to take ownership of the narrative before public confidence erodes further. It asks people to become active participants in digital verification rather than passive consumers. In a country where information warfare is as important as artillery, the fight for the truth is a strategic objective.
For citizens, the advice from the SBU is simple enough to memorize: use only official state channels, don’t click on suspicious links, and report fraudulent communications to official hotlines. But simple advice can be hard to follow when you are exhausted, scared, and overwhelmed by missile alerts, news of death, and economic hardship. That is why the SBU’s warning is also an invitation to pause. Before clicking on a link that claims to be from a security service, ask: Did I look for this page myself? Does the URL match the official domain? Have I seen this message in any official media? The urgency that fake pages create is designed to bypass critical thinking; they want you to click before you think. In that context, skepticism is not disloyalty—it is survival. The SBU also wants people to report suspicious contacts. If someone claims to be a security official and requests personal data, documents, or details about military movement, that communication is a red flag. Genuine officials have established procedures; they do not ask citizens for sensitive information through random social media messages. Every time a citizen reports a suspicious page or message, it becomes a piece of intelligence for Ukrainian cyber specialists. The public can be an army of digital sentinels. In the same way that people learned to report suspicious persons in their neighborhoods during the invasion, they are now being asked to report suspicious digital activity. This is a form of civic defense adapted to the information age. The SBU’s insistence on official hotlines may seem anachronistic in an era of instant messaging, but there is a reason for it. Official hotlines are published and verified. They can be called, texted, or checked by the public. A random Telegram bot that claims to be a security official cannot. By steering citizens toward established channels, the SBU is trying to create a central nervous system for the reporting of suspicious behavior. The war has already changed Ukrainian habits: people have become accustomed to checking military announcements before traveling, to carrying documents with QR codes, and to using mobile apps for air alerts. The new task is to make safe cyber hygiene as automatic as taking shelter during an air raid. It is not always easy; after months of war, attention is short and alert fatigue is real. But in the same way that a soldier learns to check both sides of a street, civilians are learning to check the authenticity of a URL and the origins of a message. This is not because they are paranoid; it is because their enemies are paying attention to every mistake.
The fight in cyberspace is not limited to fake pages and phishing schemes. Russian state-linked hackers, known as Midnight Blizzard or GTG-20006, have recently taken advantage of artificial intelligence to intensify their espionage operations. According to a threat intelligence report from Anthropic, the group responsible for a string of high-profile cyberattacks has customized Anthropic’s Claude AI model to carry out automated attacks. These were not simple tricks or memes; they involved advanced use of AI to create evasive malware, process stolen communications in bulk, and reverse-engineer proprietary military drone software. The targets were more than 20 Ukrainian and European government, military, and defense organizations. The significance of this development cannot be overstated. Artificial intelligence gives a cyberattack a kind of speed and adaptability that was previously impossible. Malware can be rewritten automatically to escape signature-based defenses. Large datasets—such as thousands of intercepted messages—can be searched within minutes for sensitive information. Military technology, like the software that controls drones, can be studied and dismantled by AI systems far faster than by human analysts. This has effectively opened a new era of state-sponsored warfare, one where the frontline is increasingly a neural network. For Ukraine, this means that while soldiers are defending trenches in the east, another battle is being waged in the invisible structure of algorithms and digital code. The use of a commercial AI platform by a state enemy also raises uncomfortable questions for the global tech industry: How can AI be made safe when the same tools that help farmers, doctors, and students are being exploited by intelligence agencies? That is not a hypothetical question; it is being answered every day in the server rooms of Kyiv and Brussels. Moreover, the use of AI in espionage is not a one-time event. The same model that powers a popular chatbot can be manipulated to write targeted phishing messages in perfect Ukrainian—messages that know the recipient’s unit, location, or family status. It can analyze the responses and adapt automatically. This turns a broad phishing campaign into a precision attack. It is one thing to receive a generic fake message about a bank transfer or a new employment law; it is another to receive a message that mentions your street name and your husband’s military callsign. The threat, therefore, is not simply more malware; it is more personalized, more automated, and more destructive. Open societies and their defenders must now consider how to build resilience against machine-speed attacks, and that requires not only technical solutions but also legal, diplomatic, and educational ones. The warning from Anthropic is essential because it is one of the few cases in which a private AI company has publicly documented the misuse of its own platform by state actors. This transparency is itself a form of defense, but the arms race will not stop there.
Both Ukrainian and international readers might be forgiven for feeling exhausted by the scale of the threat. But the story also contains an undeniable countercurrent: Ukraine has not remained passive. Ukrainian hacktivists and military intelligence units have repeatedly broken into Russian networks; one headline in this very report notes that Ukrainian hackers raided Russia’s naval files and walked away with secrets from 70 projects. The cyberworld has become a realm of mutual infiltration, where every attack creates a counterattack, and where the distinction between soldier and civilian is impossible to maintain. Yet the point of all this analysis is not to produce fear, but to encourage understanding and support for truth. The information you just read—the SBU’s warning, the AI-driven threat from Midnight Blizzard, and the context of a real information war—was written and published by journalists who are on the ground. They are human beings who also check suspicious links, who also wait for missile alarms, who also verify official sources before writing a single sentence. In a war that is being fought partly over the right to be believed, the small act of supporting independent journalism is a small act of resistance. As Kyiv Independent puts it: “We bring you stories from the ground. Your support keeps our team in the field.” And in a world where fake pages multiply by the hour, that field is not only the front line—it is also the screen in front of you. Remember to fact-check, to report, to trust the official sources that have earned their place, and to support the people who are working to show you the difference between truth and lies. Every person who shares a verified official announcement, every journalist who verifies a source rather than repeating a rumor, every reader who supports original reporting rather than fake copy, is part of a network of resilience. The narratives that emerge from Ukraine will shape the history of this war, and the physical battles will be remembered alongside the digital ones. In that sense, the work of documenting and understanding the evolving nature of cyberwarfare is a service to present and future generations. It is also a reminder that information, like ammunition, can be used for defense or for destruction. The choice starts with what you read, what you trust, and what you decide to share.