“If my account ever posts pro Russian shit, then know I was probably hacked by them...”
If you've recently been locked out of your Bluesky account, it could be because Russian hackers are using it to deliver fake news.
“The compromised Bluesky accounts included those of people who are influential in their fields, though perhaps not famous. They were journalists and professors, a pollster in Texas, an anime artist and a filmmaker in Hollywood…”
Article about an account, “like hundreds of others on Bluesky, had been hijacked and used to post fake news articles, according to the company and researchers at Clemson University working with a collective of internet monitors who track Russian influence operations.”
“While Russians have long flooded social media platforms with fake accounts and content, hacking into real accounts appeared to be a novel strategy. “They are clearly still experimenting,”
“Bluesky Says Kremlin Is Hacking Its Platform to Spread Propaganda”
The company said it was fighting Russian efforts to hijack real users’ accounts to post fake content, an apparently novel tactic
Ben Gilbert describes himself on Bluesky, the social media app, as an “economist, lit and guitar nerd, rugby fan, owner of excessive pets.” A professor at the Colorado School of Mines, he rarely posts, but when he does, the subjects reflect his expertise in natural resources.
So it was odd when a video purporting to be a news report appeared on his account last month, blaming France’s financial and political support for Ukraine for police staff shortages at home.
Without his knowledge, Mr. Gilbert said, he had fallen victim to Russia’s latest tactic to try to spread its propaganda in the West.
His account, like hundreds of others on Bluesky, had been hijacked and used to post fake news articles, according to the company and researchers at Clemson University working with a collective of internet monitors who track Russian influence operations and call themselves the dTeam.
The compromised Bluesky accounts included those of people who are influential in their fields, though perhaps not famous. They were journalists and professors, a pollster in Texas, an anime artist and a filmmaker in Hollywood, whose account posted a video doctored by artificial intelligence to impersonate a Canadian police official criticizing France’s president, Emmanuel Macron.
The campaign, which the researchers at Clemson linked to the Social Design Agency, a company in Moscow, shows how Russia continues to seek new ways to erode public support for Ukraine, which Russian forces invaded in 2022.
Bluesky has grown more prominent as a rival platform to X since X’s owner, Elon Musk, threw his political support behind President Trump before the 2024 election. With 42 million users, though, Bluesky trails far behind X’s nearly 600 million.
While Russians have long flooded social media platforms with fake accounts and content, hacking into real accounts appeared to be a novel strategy.
“They are clearly still experimenting,” said Darren L. Linvill, a director of Clemson’s Media Forensics Hub. “They’re always experimenting.”
Bluesky has been tracking the activity and removing the posts — as many as a couple of thousand. They came in waves beginning in April and continuing until at least last week.
In a statement, the company called Russian influence operations “an industrywide problem.” “We dedicate significant resources toward detecting and disrupting coordinated inauthentic campaigns,” the statement said.
Mr. Gilbert of the Colorado School of Mines, a public research university near Denver, learned of the post on his account when The New York Times contacted him. “I just deleted it,” he wrote in an email.
In other cases, Bluesky has suspended accounts until the owners stepped forward to reset them. Many targets learned of the hacking only when they were locked out of their accounts. One of them was Pamela Wood, a political reporter at The Baltimore Banner.
She was on vacation on April 28 when her account was suspended after it posted a short video with a caption that said The New York Post had linked Ukraine to the man charged with trying to assassinate Mr. Trump last month at the White House Correspondents’ Association dinner.
“Bluesky didn’t provide much information but suggested that my account may have been hacked or compromised,” Ms. Wood said. “My account is rather vanilla — just posting my stories, pretty much — and I hadn’t posted or even looked at Bluesky in a few days, so getting hacked made the most sense.”
Clemson attributed the Social Design Agency’s campaign to a Kremlin influence operation that researchers have called Matryoshka, after the Russian nesting dolls.
The operation, which emerged in 2024, specializes in creating fake articles that look as if they were from real news organizations like Reuters or France 24. The goal seems to be to spread the claims by encouraging fact checkers to debunk them.
Russian news outlets also cite these fabricated posts, falsely suggesting that the content, mostly in English, originated in the West. The Social Design Agency did not respond to a request for comment.
Russian propaganda on Bluesky first became notable during Germany’s elections last year, when the Kremlin sought to bolster Germany’s far right, led by the Alternative for Germany party, known as AfD
Joseph Bodnar, a researcher with the Institute for Strategic Dialogue, an international organization that has also tracked Russian disinformation, said the hijacking of individual accounts on Bluesky had “a level of sophistication beyond what we usually see.”
“What we usually see is using hijacked accounts on X, but those are random, obscure accounts with crazy avatars,” said Mr. Bodnar, who was not involved in the Clemson research. “They’re not trying to get someone moderately known or respected.”
Ukraine is almost always the main target of Matryoshka’s operations, but previous campaigns also tried to discredit preparations for the 2024 Summer Olympics in Paris and the Trump administration’s dismantling of the U.S. Agency for International Development.
The latter was one of Russia’s most successful disinformation operations, Mr. Linvill said. It featured videos of fabricated news reports suggesting that U.S.A.I.D. had paid celebrities, including the actor Ben Stiller, to travel to Ukraine. Millions of people saw those posts.
Although Mr. Trump was a subject of the recent posts on Bluesky, most showed Russia’s preoccupation with France, which has emerged as the leader of European efforts to bolster Ukraine in the war, and Armenia, a former Soviet republic that elections next month could move further from Moscow’s orbit.
“They just have to get lucky a couple of times for this to be worth it,” Mr. Linvill said.
Steven Lee Myers covers misinformation and disinformation from San Francisco. Since joining The Times in 1989, he has reported from around the world, including Moscow, Baghdad, Beijing and Seoul.
Our Coverage of the War in Ukraine
Human Rights Commissioner: Russia has appointed a politician accused of kidnapping Ukrainian children to be its point person for dealing with human rights abuses.
Environmental Toll: After invading more than four years ago, Moscow has usually been the one causing ecological disaster. But Kyiv’s strikes, intended to cut into the Kremlin’s oil revenue, have flipped the script.
Ukrainian Strikes: At least four people were killed by drone strikes across Russia in the biggest attack by Ukraine this year and one of its largest of the war, according to Tass, the Russian state-owned news agency.
Drones in Kyiv: Russia pummeled Ukraine’s capital with hundreds of drones and missiles, the latest in a string of deadly strikes that suggested that President Vladimir Putin had little intention of de-escalating his war.
Cease-Fires Have Lost Meaning: Under the Trump administration, temporary truces have become a tool of performative diplomacy, an end in themselves rather than a prelude to a lasting settlement, analysts say.
How We Verify Our Reporting
Our team of visual journalists analyzes satellite images, photographs, videos and radio transmissions to independently confirm troop movements and other details.
We monitor and authenticate reports on social media, corroborating these with eyewitness accounts and interviews. Read more about our reporting
