French Prime Minister Gabriel Attal is grappling with online attacks targeting him from multiple directions. The DFRLab identified a cryptocurrency scam that impersonated a French newspaper Libération to publish a fraudulent article critical of Attal, which was boosted via Meta ads. It also appears that Russia activated its Doppelganger disinformation operation against Attal, employing suspicious X accounts to amplify a story published by a fake Russian news outlet criticizing the French PM. Further, we observed social media influencers spread unproven narratives against Attal while others hijacked hashtags to boost the exposure of these narratives. We also documented the increasingly frequent use of AI-generated imagery to mock Attal.

In response to our investigation, Meta ultimately de-platformed 120 accounts “for using spammy inauthentic behavior tactics to inflate distribution of their content,” according to a Meta spokesperson.

French President Emmanuel Macron appointed Gabriel Attal, the former education minister, as the country’s new prime minister on January 9, 2024. Attal is France’s youngest and first openly gay prime minister.

The DFRLab initially identified five inauthentic Facebook accounts that posted twenty-three Facebook ads promoting an investment scam between January 13-16, 2024. The scam attempted to mislead users into investing €250 (approximately USD $268) into Trade ReoPro 360, a fake cryptocurrency investing company promising high returns for low investments. The ads, which incorrectly referred to Attal as “the vice-president,” promoted a fake article impersonating the French newspaper Libération. At the time of writing, the campaign had reached an audience of 188,423 users, according to data from Meta’s Ad Library.

The pages on Facebook running the adverts all displayed Ukrainian phone numbers. The listed locations of the pages included Kyiv and Odesa, Ukraine.

The ads promoted links to various subdomains of liberationsnews.com, which redirected to a Doppelganger version of the French newspaper Libération. The subdomains obfuscate the main domain that is partaking in the impersonation operation. Further, the website appears to be geofenced; in the absence of a France-based IP address, users are redirected to a webpage impersonating what appears to be the copyright policy page of the Financial Times. This seems to underline the website’s versatility in impersonating several international news outlets. 

The ads claim Attal made unnamed scandalous revelations during a segment with French TV host Gilles Bouleau and that “financial information of this magnitude can shake the foundations of French society.” The ads also suggested that Bouleau critiqued Attal for being “irresponsible.” The images featured in the ads were taken from an authentic interview that Attal posted to his X account on January 11. In the interview, Attal discussed personal matters related to this family, no major or shocking announcements were made. 

The article’s byline includes Liberation and AFP. The article states that the French national bank “demanded the segment be interrupted.” The forged outlet claims it received exclusive unaired footage that showed Attal discussing investments in a cryptocurrency company. It goes on to allege that host Bouleau placed an investment live during the segment. As evidence, the article includes edited images depicting the investment transactions. 

The article features a link redirecting users to a webpage allegedly belonging to a company called “Trade ReoPro 360.” The webpage includes impersonations of French TV show host Cyril Hanouna and French billionaire Bernard Arnaud. According to an August 2023 article by Warning Trading, a French support website for victims of scams, the campaign was previously exposed for impersonating French TV hosts Anne-Sophie Lapix and Cyril Hanouna to attract victims. 

The DFRLab also reverse image searched the banner image portrayed on the fake Liberationews article, revealing two copy-pasta articles. In one instance, the article appeared on the blogging platform Medium. In another instance, the article appeared on another fake news outlet named “Times Business News.” This article’s headline included Attal’s name in Arabic in brackets. 

Using the website’s search engine, we found five copy-pasta articles published on “Time Business News” that purport to be interviews with Attal. Each article used identical content to promote seemingly different scams.

On X, the DFRLab identified at least two suspicious accounts that shared links to spoofed URLs, which led to a Reliable Recent News (RRN) article criticizing Attal.  

RRN is a fake news outlet linked to a Russian-led disinformation operation that impersonates authoritative news websites to undermine support for Ukraine. Meta and the EU Disinfo Lab first exposed the operation in September 2022. France’s VIGINUM also investigated the operation and attributed it to Russia. In a speech to the European External Action Service, the European Union’s High Representative Josep Borell referred to RRN as “a factory of lies.” The DFRLab has previously reported on Russia’s doppelganger operation. 

The DFRLab identified links on X redirecting to RRN’s newly owned domain, rrn.media, which was registered one month after the French agency VIGINUM exposed the campaign.

The two X accounts shared the obfuscated URLs at the same time, 2:07 pm, and posted an identical image of Macron and Attal. The account names also indicate a shared profile name generation method. Both accounts featured a woman’s name and a surname followed by several digits. Similar naming patterns were observed among the accounts’ followers, some of which shared the same profile picture as one of the accounts, suggesting these two accounts are part of a larger operation. The profile pictures were stolen from real social media users; to protect their identities, the DFRLab is not sharing links to the accounts.

Another account, @NickyPotee1077, which follows one of the above X accounts, also posted obfuscated links and political comments in German, English, Ukrainian and French. 

The obfuscated links (q7qpd2.floppycats.blog/jnogdc and 75kzii.floppycats.blog/ggk489) led to a gateway website (letsfind.com/rrn0991573) that redirected to the RRN article hosted on rrn.media.

The links shared by the accounts led to a geofenced gateway, restricting non-European IP addresses’ access. The URLs appear to be linked to a server hosted in Russia, according to urlscan.io. Throughout the course of our research, the links stopped redirecting to RRN and later went dead. However, the DFRLab archived the middle-man website to which the links once pointed, which redirected to the RRN story. Before being disabled, the links temporarily redirected to Bing until the domain operators eventually deactivated them. As of now, the links return a 400 error, suggesting a possible failure in resolving the DNS request and indicating that the domain is likely no longer active. 

The URL 75kzii.floppycats.blog contained traces of metadata embedded in the HTML DOM – the source code of the webpage – that urlscan.io was able to archive. This metadata contains the exact same title and description as portrayed in the RRN story.

The gateway website “letsfind123.com” also contained embedded code to redirect users to the RRN story. 

The RRN article to which these URLs led criticized Attal by claiming that his cabinet ministers were unqualified and randomly chosen. 

Attal is currently embroiled in political scandals that stem from an article published on January 12 by the French online news outlet Mediapart. The article alleged that Attal, in his capacity as education minister, overlooked instances of homophobia and teachings that reportedly advocated for conversion therapy at one of France’s prestigious private Catholic schools. 

On the day Attal was appointed prime minister, a smear campaign was launched on X by the account @zoesagan. In 2022, French media exposed the account as a persona created by French writer Aurelien Poirson-Atlan, but it is unclear who operates the account today. The campaign centered around two hashtags, #Gabybug and #GabyKissMyAss. In a post on X, @zoesagan said #Gabybug was coined in collaboration with the account @TvlCampagnol, an alternative media channel previously flagged by Conspiracy Watch. The hashtag #Gabybug, which launched on January 9, received nearly 54,000 mentions as of January 19.  

According to the French news outlet 20 Minutes, Sagan was a significant amplifier of a photo of American actor Danny Poltner wearing a swimsuit that circulated online purporting to show Attal. 20 Minutes said the photo was also amplified on 4chan forums. In Sagan’s post sharing the photo, the account doesn’t reference the image at all, instead, the accompanying text references a narrative that suggests Attal’s degrees were fraudulently obtained. 

Attal’s education came under scrutiny after the French newspaper Les Échos reported that Assas University said Attal had not completed his bachelor’s degree in law. Attal’s LinkedIn profile lists a bachelor’s degree in law from Assas University. The claim evolved to suggest that if Attal did not finish his bachelor’s degree, then his master’s degree from SciencesPo, France’s renowned institute for political studies, must have been fraudulently obtained. Lawyer Juan Branco, formerly classmates with Attal, perpetuated this claim. In 2018, Branco authored the book Crepuscules, which reportedly shed light on Attal’s youth and political career. In a 3,000-word X post, uploaded as Attal was appointed prime minister, Branco questions how Attal earned his degrees. At the time of writing, the post had garnered 5.1 million views. Branco later shared a screenshot of an alleged formal notice he received directing him to remove the statement he posted on X. In it, Branco claimed a lawyer’s office linked to the prime minister would have issued the formal notice. 

Data collected from the social media monitoring tool Meltwater Explore shows that the most discussed topic using the hashtag #GabyBug was the allegation of falsified degrees. 

The hashtag #Gabybug – a compound of the nickname Gaby (French for Gabriel) and ladybug – went viral after Macron appointed Attal as prime minister. The ladybug has frequently been used as a symbol to mock Attal and express distrust in the French government. The account @zoesagan claimed without evidence that the hashtag #ladybug had been banned in December 2023 by French authorities. In a post on January 2, 2024, the account directed users to utilize the ladybug symbol “to make [it] conspiratorial.” 

Beginning January 9, the X account @Zerline888 posted at a high frequency AI-generated images featuring French symbols, politicians, and the ladybug. Between January 9-21, the account shared 102 posts on X, all of which featured either AI-generated images, photo-montages, or political imagery, all shared using the same hashtags, appearing in the same order – #GabyBug; #GabyKissMyAss; #DoryphoresDehors; #LadyBug; and #MyUnfairLady. 

Data collected via Meltwater Explore shows the hashtag #GabyBug went viral on the night of January 8 and peaked with 15,165 posts on X by January 10, 2024. The Twitter trend archive also showed that the hashtag trended on January 9. A second moderate peak was observed on January 18.

Another X account, @patrick4282, also shared several AI-generated images. In one depicting Macron as a superhero wearing a ladybug costume, the hashtag #midjourney is used, indicating the likely tool of choice; the account @zoesagan is also tagged. The account @patrick4282 used the #midjourney hashtag in two other posts sharing AI-generated images of Attal. 

The DFRLab also found posts participating in hashtag hijacking, utilizing several unrelated and seemingly popular hashtags alongside #GabyBug in a possible attempt to boost exposure. The posts shared a pro-Palestine perspective and used hashtags related to the conflict in Gaza in an apparent attempt to siphon attention towards the #GabyBug hashtag.  

In another example, the DFRLab observed hashtag hijacking around topics that include vaccine conspiracies and the “Jeffrey Epstein list.”

The DFRLab observed further overlaps between the anti-vaccine community and the campaign against Attal. The LinkedIn account “Health natural news” used the #GabyBug hashtag to share a video starring Swiss-based anti-vaxxer Jean-Dominique Michel commenting on Attal’s nomination as prime minister. 

The DFRLab also observed hashtag hijacking in the other direction, as #GabyBug was later used to bring attention to unrelated videos. A TikTok account that reportedly posts adverts for apartment rentals in Port Harcourt, Nigeria, used several hashtags with no connection to their video, including “#juanbranco,” “#hunterbiden,” and “#gabybug.” The video was shared on January 10, when the hashtag reached its apex. 

The versatility of the campaigns unveiled by the DFRLab against Attal highlight the fragility of France’s domestic information ecosystem, which is continuously targeted by actors employing a wide array of techniques, from social media influencers relying on narratives and generative AI to foreign actors and scammers using sophisticated methods to obfuscate their malign activities.  

Valentin Châtelet, “French prime minister faces onslaught of online attacks,” Digital Forensic Research Lab (DFRLab), February 20, 2024, https://dfrlab.org/2024/02/20/french-prime-minister-faces-onslaught-of-online-attacks.