BLUF: On October 16, the threat-intelligence firm Alethea published research on a new wave of Operation Doppelgänger, a Russian state-backed influence operation it attributes to the Social Design Agency and Structura. Alethea says the wave ran against three elections at once and pointed readers to cloned versions of real news sites, built and held in reserve for 17 months. It also says fabricated articles from the cloned sites are already indexed by Google, and warns AI assistants could cite them in answers. For organizations the lesson is wider than elections: a convincing fake page can now be built to be found, not just shared. This is one vendor's report, which we have not independently reviewed. We hold high confidence in the technique and low confidence in its effect.
What Is Reported
All figures below come from Alethea's own summary and are its assessment, not a legal finding.
- Targets. The US midterms on November 3, Israel's election on October 27, and France's 2027 presidential race.
- Activity. Between October 7 and 9, more than 50 fake accounts posted in synchronized waves, amplified by over 1,000 bot accounts into an estimated 150,000 quote-posts on X.
- Cloned sites. Links led to copies of Israel's Walla! News and France's Le Parisien and Le Point, which Alethea says were built and held in reserve for 17 months before this wave.
- Search indexing. Alethea says fabricated articles from the cloned sites are already indexed by Google.
- Evasion. It describes an "Invisible Ink" technique meant to slip past keyword-based monitoring. We have not seen the detail.
Why Indexed Fakes Change the Problem
Earlier briefings in this series covered fake clips and invented journalists, which depend on a human sharing them. A cloned site that search engines have indexed works differently. It waits to be found by someone who is looking for the real outlet's name or for the story itself.
AI assistants add a second route. Systems that answer questions by retrieving web pages can, in principle, pull a cloned article as if it were the original. Alethea flags this as a risk. We are not aware of public evidence, in the material we reviewed, of how often it has happened, so treat it as a plausible exposure rather than a measured one.
For a company the practical meaning is simple. A false article about your product, your executive or your incident could sit under a trusted masthead, be returned by search, and be repeated in a summary with no one checking the domain.
What Is Not Established
- Attribution. It rests on Alethea's analysis of the operation's documented playbook. We cannot confirm it independently.
- Reach. A count of quote-posts is not a count of people persuaded. The persuasion gap is covered in AI influence operations: more capacity, unproven persuasion.
- Assistant behavior. Whether any specific assistant has cited a cloned page is not shown in the summary we reviewed.
- Commercial interest. The report is offered alongside a briefing service. That does not make it wrong, and it is a reason to read it as one source.
What to Do Now
- Search for your own name the way an outsider would. Check search results and a few AI assistants for your organization, your leaders and your recent incidents. Look at the domain of every source, not the headline. Date-stamp and save what you see.
- Register and watch lookalike domains. Cloned outlets use near-identical names. Monitor new registrations that resemble your brand and the outlets you are usually quoted in.
- Publish a canonical, dated statement page. If a fake appears, you need one authoritative page on your own domain that search and assistants can find. Keep it factual and update it in place.
- Give staff a domain check. Before sharing an article about your company, confirm the address belongs to the outlet. A masthead is not proof.
- Know the takedown route. Keep contacts for the registrar, hosting provider and search engine reporting channels, and for the real outlet's editorial desk.
- Do not rely on keyword alerts alone. If evasion of keyword monitoring is real, monitoring should also follow domains, accounts and link patterns. See narrative threat monitoring.
Questions Leaders Should Ask This Week
- If a cloned outlet published a false story about us, how would we find out?
- What do the major AI assistants say about us today, and from which sources?
- Do we have one dated page that is clearly the source of truth?
- Who decides whether to respond, and who contacts the real outlet?
Organizations that want this built into an operating plan can read about our narrative and reputational threat intelligence work.
Confidence and Caveats
High confidence that cloned news sites are an established influence technique, given the earlier OpenAI and Doppelgänger reporting. Moderate confidence in the specific October 7 to 9 figures, which come from one vendor. Low confidence in any effect on audiences or on AI assistant answers. We will update this note when primary material is available.
Frequently Asked Questions
What is Operation Doppelgänger? A Russian state-backed influence operation that Alethea attributes to the Social Design Agency and Structura, known for cloning real news sites.
Can AI assistants cite a cloned news site? Alethea warns they could. Any system that retrieves web pages can return a convincing fake, so source domains need checking.
Could a cloned site target a company? Yes. The method works for any brand, executive or incident, not only elections.
What is the first step? Search your organization's name in search engines and AI assistants, check the domain of every source, and save dated evidence.
Kronus Intelligence Group builds and operates custom intelligence infrastructure for organizations that cannot afford to be wrong. If your environment requires it, we want to hear from you.
Start a Project →