We’ve all been there – that slightly nagging feeling you get when you see a sensational headline pop up on social media, or an urgent message land in your inbox. Is it real? Should I believe it? For the team at #CivilNetCheck, this feeling has become a daily reality, not just for themselves but for countless fact-checkers across Europe. For over two years now, their inboxes have been flooded with what look like genuine pleas: “This news needs to be verified.” “Urgent request for fact-checking.” But what started as a trickle has become a deliberate deluge, revealing a sophisticated and worrying trend: fact-checkers themselves are being targeted in a coordinated disinformation campaign.
Imagine receiving an email, seemingly from an ordinary person, asking you to check a wild claim about your country’s leadership. Now imagine hundreds of these emails, all from different, brand-new Gmail addresses, but all with strikingly similar wording and all pointing to the same outrageous stories circulating on obscure corners of X, Bluesky, TikTok, or Telegram. This isn’t just about misinformation; it’s about a calculated strategy to manipulate how information spreads. Initially, these “urgent” requests focused on countries like Ukraine, France, and Moldova. But since late 2025, there’s been a noticeable shift, and Armenia has become a prime target. Suddenly, the emails are packed with sensational rumors about corruption, upcoming elections, foreign meddling, and the integrity of Armenian leaders. This isn’t just random people looking for truth; it’s a carefully orchestrated plan designed to sew seeds of distrust and confusion, and they’re using fact-checkers as unwitting accomplices in their scheme.
This isn’t an isolated incident affecting just one organization. Fact-checking groups across Europe are reporting the same unsettling pattern. Stefan Rathmanner, editor of the fact-checking division at the Austrian Press Agency (APA), shared a revealing insight: they started systematically tracking these emails in early 2024. He noticed a clear pattern emerging even before Armenia became a focus. “I was quite alert when the first emails arrived because I assumed that there might be elections coming up, which obviously is the case,” Rathmanner explained. He recalled a similar experience with Moldova last year, where a surge of emails promoting false narratives began about six months before their elections. APA received around 56 such emails concerning Moldova, most of them clustered in the weeks leading up to the vote. Now, they’ve recorded at least 23 similar emails about Armenia, and Rathmanner anticipates this number will only climb as Armenia’s elections draw nearer. He pointed out another chilling similarity: “The primary target in Moldova was President Sandu, as now in Armenia it is Prime Minister Pashinyan.” This isn’t about specific individuals finding and reporting misinformation; it’s about a targeted attack on specific political figures and the democratic process.
International fact-checkers have a name for this kind of coordinated trickery: “Matryoshka” campaigns. Much like the Russian nesting dolls, these operations involve spreading the same false narratives across numerous platforms and accounts, creating the illusion that many different “independent sources” are all reporting the same “truth.” Sending emails to fact-checkers is just another layer of this elaborate deception. The lies are first planted on social media, then links to these posts are sent to newsrooms from various email addresses, hoping to hook journalists into investigating and thereby amplifying the false claims. A fascinating investigation by Foreign Affairs magazine uncovered that the Russian companies behind these operations meticulously track how their content is received by media outlets, social media platforms, and even fact-checking organizations. They compile reports, monitoring media coverage, investigations, and account removals, all to demonstrate the “effectiveness” of their campaigns. These reports, it turns out, are used to justify further funding for future operations. It’s a cynical, self-perpetuating cycle of deception.
One of the most striking clues that this is a coordinated operation lies in the emails themselves. At first glance, they seem to be from different individuals, but a closer look reveals a startling uniformity: almost every email originates from a newly created Gmail account that is never used again. These addresses are often a jumble of random letters and numbers, devoid of any real names or identifying information, strongly suggesting they are either automatically generated or disposable. Yet, in a bizarre twist, the senders often use real-sounding names in the body of the email, trying to create the façade of an ordinary user. However, these names rarely match the email addresses, adding another layer of artifice to the charade. This meticulous yet inconsistent approach points to a system, not a spontaneous outpouring of concern.
Beyond the email accounts, other patterns scream “coordinated campaign.” Posts published on social media are typically sent to fact-checkers one to two days later, not from one, but from multiple email addresses. Even though the senders are different, the attached links are often identical, sometimes even sent in the exact same sequence. It beggars belief to imagine unrelated users independently sending the same content in the same order, using identical structures. For instance, emails from completely different addresses contained links to the very same X and Bluesky accounts, in precisely the same order. These emails frequently include four or five Armenia-related posts for “verification” at once, most of which were published on the same day, sometimes only minutes or hours apart. They’re almost always in English and echo the same core narratives. One email, for example, asked for verification of posts claiming the Institute for the Study of War (ISW) reported Armenia was preparing for war against Russia, and another that Prime Minister Pashinyan’s press secretary confirmed a drone factory was being built in Armenia using Ukrainian technology. Another post from the same day alleged Pashinyan owned eight apartments in Paris. Even seemingly minor details betray the campaign’s origins, like a post misidentifying pop diva Cher as “Sher” in a demand for Pashinyan’s resignation, hinting at non-native English speakers or mistranslations from another language.
A deeper dive into the content reveals more disturbing connections. The emails frequently link to the same Russian-language Telegram channels, including “Шкварка 2.0,” “Республика Одесса,” and “Шаман Раху.” Fact-checkers are repeatedly asked to verify claims originally published on these channels, which are known for circulating false or manipulative content about Armenia. For instance, one email sought verification of a claim from “Шкварка 2.0” about an Armenian man involved in laundering Pashinyan’s money disappearing in Dubai. Technical data suggests that at least some of these channels operate from Russia and primarily publish in Russian. #CivilNetCheck has previously reported on these very Telegram channels targeting Armenia, highlighting a consistent and persistent effort to undermine the country.
The social media platforms themselves are often quick to catch on, as many of the X (formerly Twitter), Bluesky, and TikTok accounts linked in these emails are rapidly removed. This is because social media companies have systems to identify and remove accounts engaged in “fake or inauthentic behavior.” However, #CivilNetCheck’s investigation revealed that some X accounts, before their removal, had been dormant for years, only to suddenly spring to life and begin posting political content about Armenia. This suggests the possible use of hacked or purchased dormant accounts, adding another layer of sophistication to the operation. Additionally, inconsistencies between display names and usernames – a common characteristic of genuine user accounts – were absent in these cases. The display names and usernames often differed across all examined accounts, further indicating they weren’t used by real individuals.
The increase in email volume about Armenia since April 2026, especially after October 2025, is no coincidence. There are now days when multiple emails from different addresses arrive simultaneously, all urging fact-checkers to review the exact same posts. An analysis of the content reveals that many of these narratives are meticulously crafted to influence Armenia’s 2026 parliamentary elections. Claims of election fraud, Western interference, social unrest, and political instability are rampant. Similar surges in such information activity have also been observed during other major political events, such as the European Political Community summit, underscoring the strategic timing of these campaigns.
The most common narratives revolve around corruption, a perceived loss of sovereignty, and Armenia’s foreign policy. The emails are designed to spread allegations about Prime Minister Nikol Pashinyan and his associates, claiming they own foreign assets or are engaged in corrupt schemes – claims that #CivilNetCheck has repeatedly addressed and debunked. Other posts allege foreign companies are acquiring Armenian territory or natural resources. One claim suggested the American financial company BlackRock had purchased 33% of the Shikahogh Reserve, while others insisted Armenia’s agricultural lands were being sold to foreign corporations, or that the country was becoming a “testing ground for social experiments.” Some narratives even focus on alleged government repression and persecution of critics, with one email urging verification of claims that an Armenian blogger died in France after being attacked for criticizing Pashinyan.
As the 2026 parliamentary elections draw closer, these election-related narratives are becoming increasingly aggressive. Claims are spreading that the elections will be rigged and that Western actors are interfering in Armenia’s internal political affairs. One email, for example, requested verification of a post claiming Facebook was mass-blocking accounts of Armenian diaspora members who called on voters not to support the ruling Civil Contract party. Other posts alleged that the European Union monitoring mission in Armenia would be involved in election “fraud.” Separately, narratives attempt to link Armenia to the ongoing war in Ukraine, claiming Ukrainian oligarchs are financing Pashinyan or that drone factories using Ukrainian technology are being built in Armenia. Another persistent theme portrays Armenia’s relationship with France as a dangerous flirtation that could lead to war with Russia. Some posts falsely state that the Institute for the Study of War (ISW) reported Armenia was preparing for war against Russia, while others claim France is simply pushing Armenia toward conflict. The emails also circulate content related to LGBT+ issues, aiming to portray the authorities as having “abandoned traditional values.” In nearly every instance, a specific tactic is employed: the names and logos of reputable international organizations and media outlets like Reuters, CNN, Der Spiegel, ISW, and Human Rights Watch are brazenly used to create the false impression that these claims originate from credible sources. However, investigations show that none of these organizations have published the alleged reports. Many of these narratives simply rehash claims previously spread in other disinformation campaigns that were later debunked, including by #CivilNetCheck itself.
This insidious campaign isn’t limited to Armenia. The links attached to these emails also promote disinformation targeting other European countries. In France, dominant narratives focus on the alleged “weakening” of the military, a supposed loss of control over nuclear weapons due to refugees, and efforts to discredit President Emmanuel Macron. For Germany, the narratives include claims about “Nazi” military leadership and growing sympathy for Russian President Vladimir Putin. Simultaneously, another recurring theme suggests that attitudes toward Russia in parts of Europe are becoming more positive, portraying Russia as waging a supposedly “more humane” war. The investigation clearly shows that such campaigns often intensify before elections and other major political developments in European countries. Meanwhile, Ukraine-related narratives remain a constant in these emails, regardless of the specific political context. In Armenia’s case, the same deceptive methods have clearly become more aggressive in the run-up to the 2026 parliamentary elections. Observations by European fact-checkers consistently suggest that these information campaigns become particularly active during politically sensitive periods, striving to exploit vulnerabilities and sway public opinion when it matters most. It’s a stark reminder that in our digitally interconnected world, the battle for truth is fought on many fronts, and sometimes, the very people dedicated to finding it become targets themselves.