The research reveals how Russian-aligned actors, foreign-operated Facebook pages, artificial intelligence and coordinated social media campaigns are being used to spread fabricated political narratives and undermine trust in democratic institutions.
From Moscow to Spanish voters
One of the investigation’s most significant findings concerns a Spanish-language Telegram network operated from Moscow by Enrique Arias Gil, a political scientist wanted by Spanish authorities over his alleged involvement with the pro-Russian hacktivist collective NoName057(16).
According to the report, his Telegram channel published recruitment advertisements offering Spanish citizens up to $3,000 per month and $25,000 signing bonuses to join the Russian Army. Other messages solicited confidential information about Spanish officials and encouraged participation in cryptocurrency-funded cyberattacks.
The channel operates within a broader network of Spanish-language Telegram accounts with approximately half a million combined subscriptions. These channels redistribute pro-Kremlin narratives, often within minutes, connecting Russian sources to established political audiences in Spain.
Influencing Spanish political debate?
Between 20 August and 5 November 2026, Golden Owl examined 54,737 social media items across Facebook, Instagram, TikTok, YouTube, X and Telegram, alongside dark-web intelligence. Using its AI-assisted investigation platform Noctua, researchers identified 41,509 election-related items, analysed 28,516 in detail and mapped 10,773 accounts.
The findings expose several distinct operations capable of influencing Spanish political debate, although researchers found no evidence that these activities had altered voting behaviour or compromised electoral infrastructure.
Fake Spanish newsrooms operated from Vietnam
The investigation also uncovered twelve Facebook pages presenting themselves as Spanish news or community outlets while operating through a network linked to Vietnam.
Together, the pages attracted approximately 270,000 followers. Some used Spanish addresses and patriotic advertisements to establish credibility before publishing fabricated political stories.
One advertisement encouraged users with the message “If you love Spain”, attracting predominantly Spanish audiences, including older users. From late October, the pages increasingly published invented political statements and election-related controversies.
Researchers traced the operation through Meta transparency records, advertising payments, shared domains and publishing infrastructure.
The report describes the phenomenon as “the industrialisation of deceptive influence”, showing how commercial content farms can manufacture seemingly independent political voices while generating advertising revenue.
Disinformation crosses borders within minutes
The investigation demonstrates how rapidly misleading narratives can travel between countries and platforms.
Following the deadly railway collision near Urda on 28 October, unsupported sabotage allegations appeared online within 36 minutes. A fabricated quotation attributed to Israeli Prime Minister Benjamin Netanyahu subsequently circulated through international accounts, with one Argentina-based account generating more than 606,000 views.
Researchers also documented how electoral fraud allegations originating in Latin American political discussions reached Spanish audiences, with related claims spreading between accounts in Argentina and El Salvador within 29 minutes.
AI-generated imagery, synthetic political content and coordinated account networks further amplified misleading narratives about postal voting, electoral fraud and political scandals.
A challenge for journalism and democratic resilience
For journalists investigating disinformation, the report illustrates the importance of combining open-source intelligence, platform transparency data, network analysis and AI-assisted verification.
Golden Owl emphasises that the documented activities do not necessarily belong to one centrally coordinated operation. Their combined impact nevertheless creates vulnerabilities in the information environment.
As the researchers conclude, “Spain’s democratic process will depend not only on the security of the ballot, but on the ability of its institutions, media and citizens to recognise and resist the invisible arsenal now operating within its information space.”
The findings demonstrate how disinformation increasingly operates through interconnected digital infrastructures that can exploit breaking news, manufacture credibility and spread misleading narratives faster than traditional verification processes can respond.
