Extreme right-wing Twitter users in the United States and France continued to attack the centrist candidate in France’s presidential election, Emmanuel Macron. On Saturday, however, it appeared they were losing ground to opponents countering their attacks with mockery and accusations of Russian involvement.

Late Friday, American alt-right activist Jack Posobiec launched a Twitter storm under the hashtag #MacronLeaks after unknown users dumped some 9 GB of emails purportedly hacked from Macron’s campaign on Pastebin and 4chan.

The leak appeared 36 hours before the opening of polls in the decisive round of France’s presidential election. This seemed a last-ditch effort by supporters of nationalist candidate Marine Le Pen to torpedo Macron, who is some 20 points ahead in the polls.

Posobiec’s hashtag drive was supported by other alt-right voices in the US, and a collection of probable bot accounts. It was picked up and spread by some of Le Pen’s most active supporters in the French Twittersphere.

Over the course of May 6, the DFRLab conducted three machine scans of posts using the hashtag #MacronLeaks: the first from 01:00 to 08:00 UTC, the second from 08:00 to 12:00, and the third from 12:00 to 16:00. Each collected roughly 100,000 tweets.

In each period, the number of users was relatively steady, ranging between 35,000 and 39,000. This is a high rate of activity and engagement, enough to make the hashtag trend on both sides of the Atlantic.

However, while the number of users and posts was relatively constant, their behavior was not. Tracking the evolution in the tone of the most popular posts over the course of the day therefore allows us to judge how well the message penetrated the broader French political discourse on the eve of Sunday’s crucial vote.

The early hours were dominated by English-speaking voices. According to the machine scans, eight of the ten most-retweeted tweets in the hours immediately after Posobiec’s launch came from Anglophone accounts — three from WikiLeaks, which commented on the leaks, and five from Posobiec, who launched the hashtag drive.

Just two French tweets made it into the top ten — a post from Front National deputy leader Florian Philippot, and a tweet from an account called @Messsmer, which the DFRLab has identified as one of the drivers behind the online campaign to support Le Pen.

By the early hours of Saturday morning, French time, the situation was even more extreme. All twenty-five most shared tweets during this period were in English.

However, they were divided between alt-right voices, such as Posobiec and US Twitter user Mike Cernovich, and opponents, such as the account @RVAWonk, which tracks bots and disinformation campaigns.

By 12:00 UTC, the balance between English and French had swung the other way. Seven out of the ten top tweets on the Saturday morning were in French; just three were in English, two from WikiLeaks and one from Posobiec.

Two more were from anti-Macron voices — one of them, @TintinCAC40, a regular amplifier of anti-Macron messaging.

The other five, however, did not support the hashtag and leak, but rather attacked them. The single most popular tweet during the morning came from the account @gblardone, highlighting tweets from a WikiLeaks lawyer questioning the propriety of dumping so much data just before the election:

Another popular tweet, from @Cyrilefevre, attacked Le Pen’s party, the Front National (FN) as “F Haine,” which means “F Hate,” but is pronounced in French the same as “FN:”

A third highly-performing tweet came from the fake-busting team at French daily newspaper La Libération, pointing out that the same accounts which spread the story of the leaks had earlier spread allegations that Macron had a secret bank account in the Bahamas:

Throughout the top 50 most-shared tweets during Saturday morning, this mockery of the leaks and their sources continued in parallel to alt-right accounts amplifying the original message:

These posts did not stop alt-right and far-right accounts tweeting, but they challenged the hashtag and achieved thousands of retweets of their own. This suggests that the #MacronLeaks campaign, after an initial rapid penetration of the information space, met significant resistance — and may well have had its spread and ability to influence voters limited as a result.

The online debate evolved further between 12:00 and 16:00 UTC. The proportion of English-language tweets, which had fallen during the morning (night in the US), rose again; but while alt-right and pro-Le Pen tweets continued to flow, the most-retweeted posts included a cluster of very high-performing tweets tracing the leak itself back to Russia.

The single highest-impact tweet over the period, with 1,931 shares in four hours, was from writer Malcolm Nance, sharing a post which traced the hacking of the Macron mails back to Russia.

Nance’s post beat Posobiec’s best-performing tweet — a post attacking the French media — by some 500 retweets over the scan period.

Three other tweets which also linked the leak to Russia made it into the top 10, from @RVAWonk, @henkvaness and @ItIzBiz, while a further post from WikiLeaks acknowledged that several of the Office files in the leak had Cyrillic metadata.

One tweet, retweeted 645 times, even thanked the Front National and Russia for releasing the leak, claiming that it proved Macron’s honesty:

During this period, attacks on Macron and mockery of the leakers both continued, as a number of popular tweets demonstrate:

However, the Russian theme continued to gain traction, further fragmenting the Twitter conversation around #MacronLeaks.

These evolutions are significant for what they show about the impact of the Macron leaks. Initially, the conversation was dominated by alt-right and anti-Macron voices, especially in the US alt-right movement. During the night, the emphasis shifted to French accounts; at the same time, posts mocking and criticizing the leaks began to gain traction. On Saturday afternoon (French time), the claim of Russian involvement began to dominate.

While these trends evolved, the number of posts and users remained remarkably constant. This suggests that the share of alt-right and anti-Macron messaging, which dominated the conversation initially, was progressively reduced by counter-messaging, either mocking the leaks and leakers or linking them to Russia.

This, in turn, would suggest that, although the hashtag #MacronLeaks itself performed extremely well, gathering close on half a million tweets in 24 hours, the leakers struggled to achieve the kind of seismic change in the French political debate which would be required to overturn Le Pen’s poll lag. Only Sunday’s vote will tell for sure; but the last-ditch #MacronLeaks campaign, while widespread on Twitter, does not appear to have dominated the conversation enough to fundamentally reshape the political landscape.

This post was updated on May 7 at 08:11 UTC to correct the translation of “écoeuré”. Thanks to Phil Straforelli, @PStrafo, for alerting us.

Read our coverage: