Iraq News Now

A pro-Iranian disinformation group is mimicking media brands

as it spreads fake news about Israel and Saudi Arabia, according to a new

report.

Dubbed “Endless Mayfly,” the group is capitalizing on the

shortening attention spans of social-media users, according to the University

of Toronto’s Citizen Lab.

In a 43-page report released on Tuesday, the researchers at

the Lab, which studies how the internet affects human rights and security,

describes the development of this disinformation group.

In 2016, a hoax article about a former spymaster got

traction in Russia after it was published on a copycat site resembling that of

Britain’s Guardian newspaper. In 2017, writers at the French newspaper Le Soir

wrote that someone was impersonating them. Last year, Facebook, Google and

Twitter deactivated several user accounts, alleging they were all controlled by

a group involved in “state-sponsored activity” and “coordinated manipulation.”

According to the Citizen Lab, a group likely from Iran is

behind all of these campaigns and it has a signature technique.

First, the group places fake news on websites whose design

and domain names are made to mimic those of legitimate media sites. It

amplifies such messaging by circulating screenshots of the articles on sites

such as Facebook and Twitter.

The original hoax articles are then taken off the internet,

leaving only images of the media brand and the article’s headline, photo, and

lead paragraphs surviving on social media. The group then encourages readers to

recirculate these screenshots even though the original false stories have

disappeared. Replacement links redirect social-media users to the home pages of

credible media sites. While the hoax article cannot be found, that can escape

the attention of people who reflexively repost whatever they see as they scroll

through Twitter or Facebook.

The technique "leads people to believe it is actually

authentic because the trace of inauthenticity is removed,” said Ron Deibert,

founder of the Citizen Lab, which is housed within U of T’s Munk School of

Global Affairs and Public Policy. “We know from studies of how people use

social media that, generally speaking, users have short attention spans, they

tend to focus on high-level details.”

Other researchers first identified the existence of this

group and attributed its origins to Russia. But the Citizen Lab says that it

concludes “with moderate confidence” that Endless Mayfly is Iran-aligned.

The Lab reviewed about 100 disinformation narratives spread

by the group. Common themes were unflattering portrayals of Saudi Arabia and

Israel. Such narratives could potentially bolster Iran’s standing in the Middle

East compared with that of its regional rivals.

Although no one can say whether the Iranian government

actually runs the disinformation campaign, the Citizen Lab says it found that

the group stockpiled at least 73 potential fake-news sites through a practice

known as “typosquatting.”

The squatters register domain names that are just a few

keystrokes removed from those of bona fide media brands. Domain names

copycatting those of two Canadian organizations – The Globe and Mail and the

National Post – were created by the group, the Citizen Lab says. But Mr.

Deibert says these sites were likely being held “in reserve” – his researchers

found no evidence they were used to disseminate any fake news.

Mr. Deibert says Endless Mayfly may be a sign of things to

come in an era when unsuspecting readers are increasingly preyed upon by

far-flung factions out to manipulate the public discourse with disinformation

spread by social media.

“I think there’s probably too much attention looking at it

in terms of election disruption specifically," Mr. Deibert said.

"When what we should be thinking about is the global public sphere and how

campaigns like this are toxic.”