Skip to main content

Storm-1516 in Hungary: Fake Outlets Built to Smear the Opposition

Manipulation Breakdowns · 6 min read · By D0

A Fake Euronews Report About Trump

In late March 2026, a website styled as Euronews published a report. It said Hungarian opposition leader Péter Magyar had insulted Donald Trump at a campaign rally. It quoted him calling Trump a “senile grandpa” and promising to reverse key agreements with Washington.

The report used a real byline. Videos repeating the claim, with Euronews branding, circulated on social media. Several accounts posted them in quick succession. Some videos reached thousands of views.

Euronews said it had not published the report. The fake site was taken down. The accounts that spread it were mostly anonymous, and their location data pointed to the United States and Africa.

The Gnida project, which tracks Russian disinformation, linked the campaign to Storm-1516. That is the name researchers use for a Russian operation active since late 2023. It has targeted the 2024 US election and Germany’s 2025 election.

Hungary voted on April 12, 2026. This article breaks down what Storm-1516 did in the weeks before.

1. Impersonated Authority

The operation borrowed the credibility of outlets readers already trust. It copied Euronews and Sky News. Gnida also documented a video branded “Times of Ukraine,” a name real Telegram and YouTube channels use, linked to a site registered three days before the campaign.

Readers who recognise a logo tend not to check the web address.

The Institute for Strategic Dialogue, cited by Euronews, found six new websites linked to Storm-1516, all registered within two weeks. The fake Euronews site was one of them. Another campaign, styled as a Sky News report, claimed he had withdrawn from the election after JD Vance endorsed Viktor Orbán.

2. A New Outlet for Each Accusation

Gnida documented three separate campaigns, each with its own fake source:

  • The “European Center for Investigative Journalism.” The domain was registered on January 20, 2026. The campaign launched on January 29. It accused Magyar of helping divert €16.7 million of EU aid meant for Ukraine.
  • A fake Times of Ukraine. The domain was registered on February 1. The campaign launched on February 4. It claimed a Ukrainian anti-corruption probe found more than €40 million in EU aid diverted, with Magyar involved.
  • “Oknyomozó Riport.” The name means “Investigative Report” in Hungarian. The domain was registered on February 18. The campaign launched on February 21. It accused Gábor Iványi, an Orbán critic and leader of the Hungarian Evangelical Fellowship, of paedophilia.

Look at the gaps. Each domain was registered three to nine days before its campaign began.

That timing is evidence. A real investigative outlet has a history: archived pages, earlier stories, staff who can be named. These outlets had none. Each one was built for a single accusation.

The operation also targeted people near Magyar. Lakmusz, a Hungarian fact-checker, reported Storm-1516-linked posts tying Tisza vice president Ágnes Forsthoffer to Jeffrey Epstein’s trafficking ring.

3. Narrative Laundering

The fake outlets were the first step. The claims then moved through a chain. The chain below is a general description of how narrative laundering works, not a finding from the sources on Hungary.

A fabricated outlet publishes an allegation. A vertical-format video repeats it in the style of a leaked investigation. Anonymous accounts post the video. Then the allegation appears elsewhere with a citation, and the citation points back to the fake outlet.

By the end, a reader sees a claim that has a source, a video and many sharers. Each element looks like independent confirmation. All of it traces to one place.

Clemson’s Media Forensics Hub published its report on the Hungary campaign on April 10, 2026. Its authors are Ella Murray, Darren Linvill and Patrick Warren. They describe the campaign as combining “established narrative laundering techniques with new amplification strategies.”

The new strategies are the next section.

4. Likely Paid Amplification

The Clemson report says the operation used “likely compensated influencer accounts” and “a network of commercial marketing accounts with links to Africa.”

Euronews found that the accounts spreading the fake Euronews video were largely anonymous, and X’s location tool placed them in the US and Africa.

5. Paid Ads Aimed at Older Voters

Storm-1516 also bought Facebook advertising. Euronews reported two Facebook ads claiming a Tisza government would bring back conscription. They reached more than 20,000 people, mostly over 50.

One ad read: “Every 18-year-old should know: conscription is coming back.” Separately, a post on X claimed that “Magyar thinks forcing 90,000 young men into army boots will solve Hungary’s problems.” Tisza’s platform says the party “will not reintroduce conscription.”

The ads came from an account posing as a beauty salon. The page has since been removed. Euronews found no salon by that name operating in Hungary.

6. Attribution and Funding

Gnida, citing Washington Post reporting and a US Treasury sanctions designation, says Storm-1516 is run by the Center of Geopolitical Expertise, founded by Aleksandr Dugin, which receives funding and direction from GRU unit 29155.

The US government made this finding by sanction, not by a court ruling.

What the Influence Tactics Score Would Show

Running this campaign through the Influence Tactics Protocol, several factors rate high:

  • Source Credibility Exploitation: Very high. Real outlet names and bylines were used on fake pages.
  • Missing Information: Very high. No real source, no documents, no named witnesses.
  • Emotional Manipulation: High. Fear of conscription, accusations of child abuse, and insults to a foreign leader.
  • Tribal Division: High. The aid claims cast Magyar as serving Ukraine at Hungary’s expense, and the conscription ads cast Tisza as a threat to young Hungarians.

What This Is Not

This is not proof that the campaign changed the result. Tisza won 141 of 199 seats, a two-thirds majority, on turnout of almost 79 percent. The campaign reached some voters, but the public reports do not measure how many believed it or whether it changed a single vote. This article does not claim that effect.

What to Watch For

The campaign failed to stop the opposition. It still left a method that other operations can copy. Four checks work on a single page.

  • Check the domain age. A site that claims years of reporting but was registered last month is not what it says. A free WHOIS lookup shows the registration date.
  • Go to the outlet directly. If a Euronews story is real, it appears on Euronews. Type the address yourself. Do not follow the link you were sent.
  • Search for the claim without the outlet name. If the only sources are the fake outlet and accounts repeating it, the story has one origin.
  • Look at who is sharing it. Anonymous accounts that do not live where the story is set are a reason to wait.

The next election will bring the same pattern. If a shocking claim about a candidate arrives with a familiar logo and a site you have never visited, check when the site was registered before you share it.

This article is part of Decipon’s Manipulation Breakdowns series, examining specific influence operations through the Influence Tactics Protocol.

Sources: