A pro-Iranian disinformation group is mimicking media brands as it spreads fake news about Israel and Saudi Arabia, according to a new report.
Dubbed “Endless Mayfly,” the group is capitalizing on the shortening attention spans of social-media users, according to the University of Toronto’s Citizen Lab.
In a 43-page report released on Tuesday, the researchers at the Lab, which studies how the internet affects human rights and security, describes the development of this disinformation group.
In 2016, a hoax article about a former spymaster got traction in Russia after it was published on a copycat site resembling that of Britain’s Guardian newspaper. In 2017, writers at the French newspaper Le Soir wrote that someone was impersonating them. Last year, Facebook, Google and Twitter deactivated several user accounts, alleging they were all controlled by a group involved in “state-sponsored activity” and “coordinated manipulation.”
According to the Citizen Lab, a group likely from Iran is behind all of these campaigns and it has a signature technique.
First, the group places fake news on websites whose design and domain names are made to mimic those of legitimate media sites. It amplifies such messaging by circulating screenshots of the articles on sites such as Facebook and Twitter.
The original hoax articles are then taken off the internet, leaving only images of the media brand and the article’s headline, photo, and lead paragraphs surviving on social media. The group then encourages readers to recirculate these screenshots even though the original false stories have disappeared. Replacement links redirect social-media users to the home pages of credible media sites. While the hoax article cannot be found, that can escape the attention of people who reflexively repost whatever they see as they scroll through Twitter or Facebook.
The technique "leads people to believe it is actually authentic because the trace of inauthenticity is removed,” said Ron Deibert, founder of the Citizen Lab, which is housed within U of T’s Munk School of Global Affairs and Public Policy. “We know from studies of how people use social media that, generally speaking, users have short attention spans, they tend to focus on high-level details.”
Other researchers first identified the existence of this group and attributed its origins to Russia. But the Citizen Lab says that it concludes “with moderate confidence” that Endless Mayfly is Iran-aligned.
The Lab reviewed about 100 disinformation narratives spread by the group. Common themes were unflattering portrayals of Saudi Arabia and Israel. Such narratives could potentially bolster Iran’s standing in the Middle East compared with that of its regional rivals.
Although no one can say whether the Iranian government actually runs the disinformation campaign, the Citizen Lab says it found that the group stockpiled at least 73 potential fake-news sites through a practice known as “typosquatting.”
The squatters register domain names that are just a few keystrokes removed from those of bona fide media brands. Domain names copycatting those of two Canadian organizations – The Globe and Mail and the National Post – were created by the group, the Citizen Lab says. But Mr. Deibert says these sites were likely being held “in reserve” – his researchers found no evidence they were used to disseminate any fake news.
Mr. Deibert says Endless Mayfly may be a sign of things to come in an era when unsuspecting readers are increasingly preyed upon by far-flung factions out to manipulate the public discourse with disinformation spread by social media.
“I think there’s probably too much attention looking at it in terms of election disruption specifically," Mr. Deibert said. "When what we should be thinking about is the global public sphere and how campaigns like this are toxic.”
Colin Freeze