Banner: A photo of Alexei Navalny and candles are seen in front of the Russian consulate in Krakow, Poland on February 16, 2024. (Jakub Porzycki/NurPhoto via Reuters Connect)

One year ago in February 2024, after the February 16 death of Russian political dissident Alexei Navalny, a surge in scams began posting as advertisements on Facebook. In most cases, the pages responsible for posting the ads were impersonating the Navalny team, Putin’s political opponents, or posing as authoritative news sources.

The DFRLab found eighty-three Meta ads that linked to scams which redirected users to webpages that used financial incentives to entice victims to share personal data in order to register in a fraudulent fund or trading platform. The DFRLab observed swarms of inauthentic pages in Russian that appeared to impersonate or pose as news sources in order to promote the scam. As previously reported by Times of Malta, the scam appears to be an iteration of the “European partnership investment programme,” which previously used Facebook pages posing as European initiatives to lure victims. The pages also spread rumors about King Charles’s health, about the assassination attempt against Slovakian Prime Minister Robert Fico, and used miscaptioned or deepfake videos to impersonate political figures.

The websites involved in the scam operations used designs stolen from the Navalny team’s official website, as well as typo-squatting subdomains and domains. The DFRLab found four Facebook pages published eighty-three fraudulent ads redirecting to scams. At the time of writing, nine of the seventeen pages that ran the scam have not been deplatformed and some of the fraudulent ads they ran have never been taken down. In certain cases, the ads featured political content defaming German political parties, while posts spread pro-Russian narratives and anti-French sentiment in Africa.

The DFRLab previously observed similar patterns with scams revolving around then-French Prime Minister Gabriel Attal, as well as pages that ultimately served to spread anti-Ukrainian messaging as a part of Russia’s operation doppelganger.

Widescale scam targeting Navalny exposes suspicious network of fake Facebook pages                

On February 20, 2024, Russian independent news outlet Meduza reported on an ad containing a deepfake video that was posted by a Facebook page impersonating the YouTube channel Khodorkovksy Live, belonging to Russian opposition figure Mikhail Khodorkovsky. In the deepfake video, an impersonation of Khodorkovsky Live host Yuri Belyat amplified a claim that the late Navalny had left a deathbed letter to his wife.

The narrative alleging Navalny wrote a deathbed letter was a key claim that circulated. Media outlets Meduza and NewsRu almost immediately debunked the claim, exposing the letter as a scam. Although some pages impersonating Khodorkovsky Live were taken down, the ads posted on one page, that is no longer active at the time of writing, garnered nearly 30,000 impressions between February 20 and February 23, 2024.

The DFRLab observed that pages impersonating Khodorkovsky Live reappeared over time, suggesting the scammers created multiple pages as a fallback to ensure the scam remained operational amid Meta’s deplatforming actions.

The DFRLab found several Facebook ads that scammers posted via false news pages or pages impersonating German newspaper Deutsche Welle in Russian (DW Новости).

The DFRLab observed that scammers repurposed video thumbnails posted to Khodorkovsky’s YouTube channel to feign authenticity. The thumbnails appeared to have been copied from genuine videos posted in the days following the notice of Navalny’s death.

Furthermore, a Facebook page impersonating Navalny’s team (“Команда Навального” in Russian) posted two ads on February 23. The ads featured a deepfake impersonation of Kira Yarmysh, a member of Navalny’s Team, who is depicted stating, “Alexei always wanted us to live better. That’s why he opened a fund where ordinary people earn 600 euros a day on stock markets! And this was the main reason for [his] murder!”

According to information provided by the Meta Ad Library, the page impersonating Navalny’s team was created in May 2022 and did not previously run ads. The page transparency section of the page indicates it was created under the name “Ntdg.” On February 20, the page was renamed to “The Navalny Team” (“Команда Навального”), and the page’s administrator uploaded a picture of the logo of the real  Navalny Team. Additional photos show an ad for “Parttime online work” in Spanish, posted when the page was created.

The photo in Spanish suggests the page may have been repurposed at a later point in time, likely February 20 of that year, to begin running the scam four days after Navalny’s passing.

The DFRLab found one ad impersonating Alexei Navalny’s wife in her address one day after his death was reported. The video notably used a deepfake of Yulia Navalnaya’s voice to promote the scam. The video lured users to register on a dubious platform that would help them “earn their first 600 euros.”

The DFRLab found evidence of multiple pages purporting to be news outlets or impersonating Deutsche Welle in Russian that ran ads in order to promote scams targeting Russian speakers. In some instances, the ads contained identical text, identical video clips, or directed to identical domains with variations only in the subdomains, all of which suggest broader coordination. In addition, a significant number of these pages, although they did not run fraudulent ads, appeared to showcase similarly generated information, suggesting that they could have been created automatically in the past and only activated at a later point in time.

Urgent news

Three concurrent Facebook pages titled “Urgent news” (“Срочные новости”) ran identical ads mentioning Navalny on the platform. According to a query of Meta’s Ad Library, other pages with identical names have since been taken down. The DFRLab observed that the oldest page running the ad was created in November 2023, while the two others were created in early February and on February 18, after Navalny’s passing.

The link embedded in the ads led to a fake investment fund website titled “European partnership.” The website, which was taken down, previously featured a description that claimed users could be “earning passive income from shares in the best European companies.” Almost all the ads observed linked to false or impersonating news outlets that pushed this scam.

While investigating duplicates of the “Urgent News” pages, the DFRLab uncovered nearly 550 inauthentic Facebook pages featuring identical logos and with few to no posts overall. The pages were created between 2016 and February 2023.

Prior ads pushed a narrative about the alleged “last deeds” of former Italian President Silvio Berlusconi a month after his passing in June 2023. The ads featured copypasta text identical to the ads featuring fraudulent Navalny material, with variations only in the date and cause of deaths.

Further, the DFRLab found that one page consistently reposted content featuring Russian military blogger Igor Girkin and links to Hyser, a Ukrainian top news aggregator on which the DFRLab previously reported.

Other pages posed as authoritative news sources

The DFRLab identified a dozen pages on Facebook that impersonated media outlets. While some purported to be Russian news pages with names revolving around “essential” or “daily news,” other ads impersonated the German news agency Deutsche Welle (DW) in Russian (DW Новости). As with the “Urgent News” pages, the DFRLab found duplicate dormant pages with identical names and visuals impersonating DW.

At the time of writing, we were able to archive one instance of a page impersonating DW (DW Новости), that was still active on Facebook. The date of the page’s profile picture indicated that it may have been created in December 2023, though it remained dormant until it started posting sponsored ads around the time of Navalny’s death.

At least four pages that impersonated DW in Russian contained similar transparency information, with fraudulent addresses in European cities, and websites and Gmail addresses featuring a variety of naming conventions involving “news” and “dw.” The pages all self-identified as being part of the “Social media agency” category, and some shared identical profile pictures. The pages’ names also featured the words “Новости” (News), “DW,” and “ru” in different places, indicating randomization of these text elements when the page was created.

In addition, one of the identified pages ran fraudulent ads in March 2024 with links to a scam in Russian. The ads featured a stolen DW video clip with a voiceover alleging that the far-right German party Alternativ Für Deutschland (AfD, or Alternative for Germany) had “bought voters.” The page that ran ads impersonating Navalny had also ran identical ads in February 2024.

Other pages seemed to pose as authoritative news sources by featuring the words like “EU” or “News” in a likely attempt to entice users to believe they were looking at European news content. The pages appeared to have been automatically created on February 22, 2024, a week after Navalny’s death, and ran several sponsored ads on Facebook directing users to scams. As for the ads analyzed above, the EuNews pages’ ads featured narratives alleging Navalny had left a deathbed note and featured identical video clips to the ones shared by the impersonations of political opponents and DW.

The ads shared an identical scam via copypasta content and links that directed to the same domain, alekkon[.]site. The pages featured an “EuNews” page and an inauthentic page purporting to be Khodorkovsky’s Facebook page.

A network of pages titled “Events Today” (“События Сегодня”) and “WORLD24” (“МИР24”) spread scams after a thwarted assassination attempt against Slovak Prime Minister Robert Fico on May 15, 2024. The pages started running the scam on May 20, 2024, featuring footage of the incident in a news segment together with an ad for the investment scam.

As previously reported by Meduza, all the ads featuring impersonations of Russian political opponents spread a false narrative claiming that Navalny had allegedly sent a deathbed letter to his wife. The letter supposedly contained instructions to reportedly “earn from 600 euros per day.” While this narrative has since been debunked, the DFRLab observed other narratives that spread using similar techniques. The Navalny iteration shows how spam operations tailor their discourse to domestic political events to entice targets. All the ads featured links that redirected victims to a webpage purporting to be either:

In one instance, the DFRLab found that ads purportedly sponsored by DW in Russian featured narratives that defamed AfD, alleging that “[AfD] chose to bribe voters. They help inhabitants earning from 300 euros daily by simply filling out a form and answering a phone call.”

In another instance, a page entitled “News In France,” which was later renamed to “Главные Новости” (Main News), shared scams in Meta ads and continuously posted anti-French narratives in Russian, criticizing France’s influence in Africa and its announced withdrawal of soldiers stationed in Niger.

Some ads appeared to feature evasion tactics to prevent Meta from flagging or deplatforming the content. The DFRLab observed that, in certain occasions, the Cyrillic letter “и” would be replaced by the Latin letter “u.” In addition, figures would not feature the number 0 but instead a capitalized letter “O.”

The scam page would feature design elements taken from the Navalny team’s website to deceive victims into submitting their personal data.

In other cases, the ad and the scam website would trick victims into registering for a false trading platform called “EUP” or “European Partnership.”

In all the analyzed cases, the scammers registered websites with either top level domains (TLD) or subdomains featuring typo-squatting – deliberate misspellings or variations in spelling – to better deceive victims into thinking the webpage was legitimate. The table below shows variants of subdomains that appeared in the Meta Ad Library. For AfD-related scams, the subdomains would sometimes use the Russian acronym АдГ (AdG), hence the “.adg” subdomains.

Another fraudulent Facebook page titled “European partnership” launched six ads in March 2024 alleging somebody attacked French president Emmanuel Macron. The ads also alleged that “The EU authorities presented the ‘European Partnership’ program, where one can earn additional profits through automatic trading of shares.”

Other pages used the name “Коротко о важном,” (“What’s important in a nutshell”). The latest pages indicated that they were repurposed in 2024 to pose as scams endorsed by a Russian person, allegedly named Olga Svetlaya, although the DFRLab could not confirm that identity. Svetlaya’s page history shows that the page changed name from Коротко о важном to Olga’s name on April 15, 2024. In the videos, Svetlaya appears to promote multiple trading apps allegedly available for download on Android Phones.

In one of the promoted ads, the links redirects users to a page purporting to be the Google Play inciting users to download the app “AUTO-TRADING PLATFORM.” In another add, the app promoted appears to be “Maxihabitery app,” which according to ScamAdviser.com is linked to the website onesansu[.]com. On the website, Russian text indicated that the app was an “intuitive app for tracking your financial habits.” At the time of writing, the two ads were still live.

Earlier occurrences of Facebook pages named “What’s important in a nutshell” show that the operation may have been present on Facebook as early as September 2022. The pages leveraged a variety of narratives, including footage recorded by a Russian boy in the 1990s that was allegedly showcased on Russian TV, the Facebook ban enforced in Russia since March 2022, or impersonations of Elon Musk. These occurrences point to similar tactics in devising deceitful advertising content, spread to various Meta platforms and featuring a link redirecting users to an investment scam with the promise of earning money daily.

Kristina Gildejeva is an independent OSINT researcher.

Kristina Gildejeva and Valentin Châtelet, “Scammers impersonated Navalny team, news outlets to promote fake stories and lure victims,” Digital Forensic Research Lab (DFRLab), February 25, 2025, https://dfrlab.org/2025/02/25/navalny-death-scam/.