The Result
On April 12, 2026, Peter Magyar’s Tisza party won 138 of 199 seats in Hungary’s parliament, ending Viktor Orbán’s sixteen-year rule. The margin was decisive enough to constitute a supermajority.
Before that result, Orbán’s party had deployed what analysts now describe as the most sophisticated domestic disinformation apparatus ever used against a domestic opposition within the EU. Fabricated policy documents. Coordinated influencer networks funded at scale. AI-generated war videos. A Russian-linked network running fake-persona TikTok channels. A real-time amplification infrastructure built from private Facebook groups with coordinated engagement protocols.
The operation failed. But before treating it as a curiosity, it’s worth examining what it tried to do, layer by layer — because each layer is a template that will appear elsewhere.
The Document
The most audacious tactic was structurally simple: Fidesz created a fake version of the Tisza party’s policy platform.
The forged document proposed a series of radical tax measures, including a levy on cats and dogs. This was not an accidental absurdity. Absurd proposals are deliberately embedded in fabricated documents as a dispersal mechanism. They travel because they’re memorable. The reader shares “did you see they want to tax your dog?” — not “did you see the policy platform on page 23.”
The forged document was leaked to Index, a Hungarian news site, which published a story treating it as genuine. The story was about the opposition’s plan for major tax hikes if it won. The plan was a forgery, but it moved as news.
The NCI Protocol scores this under Fabricated Evidence combined with False Attribution: content that didn’t originate with the attributed source, inserted into a media context that granted it initial credibility. Index served as an unwitting amplifier — its masthead lending credibility to manufactured claims before fact-checkers could assess the document.
The technique exploits a structural feature of media consumption: publication creates presumptive credibility. A story carried by a named outlet arrives with more initial trust than an anonymous claim. Fact-checkers don’t see the story until it’s already published and circulating. The forger doesn’t need the fabrication to survive scrutiny indefinitely — only long enough to reach a sufficient audience before the debunking narrows its spread.
The Infrastructure
The document was one element. The amplification system was the larger operation.
Megafon is an influencer hub tied to the Fidesz ecosystem. In 2024, it spent over €1.7 million on Facebook promotional content. The National Resistance Movement — a front group with documented ties to Megafon — ran AI-generated attack videos against Tisza on Facebook. Some videos reached millions of views.
The attack videos were not subtle. One showed Tisza party politicians in military uniforms, with young Hungarians being sent to the war front — a specific fear-amplification frame using the Ukraine conflict as context. The production quality was high enough to pass casual inspection during a feed scroll. The content was designed to trigger loss-aversion responses around military conscription: not “the opposition has bad economic policy” but “the opposition will send your sons to die.”
Alongside the video content, Fidesz-backed groups ran more than 4,000 Meta ads directing users to join coordinated private groups: “Fighters Club” (61,000 members), “Digital Civic Circles” (100,000+). These groups functioned as engagement amplification networks — coordinated likes, shares, and comments that improved algorithmic reach without triggering the inauthentic-behavior signals that public bot networks generate.
Private, invitation-only groups with real members performing genuine-looking engagement represent a specific adaptation to platform content moderation. The engagement is technically authentic — real accounts, real actions. The inauthenticity is in the direction, not the execution. Members receive signals about when and what to amplify; their individual actions look organic; the collective effect is coordinated.
This is Coordinated Inauthentic Behavior at the infrastructure layer, executed through invitation architecture rather than bot networks. It is harder to detect than mass fake-account operations precisely because the accounts are real and the behavior is individually plausible. The inauthenticity lives in the coordination layer, which is invisible in any single account’s activity.
The Synthetic Layer
In March 2026 — weeks before the election — investigators at EDMO and the Hungarian fact-checking site Lakmusz identified seventeen TikTok channels that had all launched within weeks of each other. Each channel operated through an AI-generated persona: a young woman, an elderly professor, a soccer fan. The channels delivered coordinated anti-Tisza messaging through formats calibrated for each persona’s apparent demographic.
The channels were assessed as part of Matryoshka — a Russian-linked operation that specializes in fabricating fake video news reports attributed to credible outlets. In Hungary, Matryoshka manufactured a video falsely attributed to French outlet Le Monde, claiming a Ukrainian artist had been poisoning Hungarian dogs. The fabricated attribution is the mechanism: Le Monde’s name provides credibility that “anonymous TikTok channel” would not. The operation borrows the outlet’s reputation without its knowledge or consent.
The same pattern — false attribution to credible sources — appeared in a mock TIME Magazine cover depicting Magyar as “Person of the Year,” deployed as a negative-framing device to imply that his rise was manufactured by foreign interests. The mock-up was designed to circulate as if real, seeding doubt about whether Magyar was an organic political figure or an imported product.
Each of these tactics maps to the same underlying principle: borrow the credibility of an established institution by falsely associating your content with it. The institution’s reputation becomes a resource the fabricator can exploit without cost — until the false attribution is exposed, at which point the institution’s name becomes associated with the fraud rather than the original claim.
Why It Failed
Sixteen years of Orbán’s rule had taught Hungary’s independent media to operate under sustained institutional pressure. Lakmusz, EDMO, and other fact-checking operations had developed specific pattern-recognition competencies for coordinated inauthenticity. The fake Tisza platform was identified as a forgery relatively quickly. The seventeen TikTok channels were flagged before they reached peak distribution. The Matryoshka attribution was documented and traced.
Speed matters here in a specific way. Fabricated content works best when it circulates before the counter-narrative exists. The window between fabrication and exposure determines how much of the audience forms beliefs based on false information. A fast fact-checking ecosystem compresses that window — and a compressed window means the fabrication reaches fewer people in its uncontested state.
But the failure wasn’t only about fact-checker velocity. The tactics appear to have undermined themselves through saturation.
When an audience encounters a fabrication — the forged platform, the AI dog-poisoning video, the war-front attack ad — and then encounters evidence that it’s fabricated, the response is not neutral. It becomes a data point about the fabricator. Each documented disinformation attempt functions as evidence about who was willing to fabricate. Accumulated over weeks, the pattern becomes legible not as isolated incidents but as a coordinated deception campaign run from identifiable institutions.
At sufficient density, disinformation doesn’t just fail to persuade. It persuades in the opposite direction.
The cat-and-dog tax was memorable enough that people searched for it. What they found was the debunking. The absurdity made the forgery viral on its own terms — but the viral spread of “the opposition wants a pet tax” became the viral spread of “Fidesz forged this document” once the debunking circulated. The memorable quality of the fabrication became the memorable quality of the fraud.
The Domestic Actor Problem
Analysts note that roughly 90% of the disinformation targeting Hungary’s election originated domestically, not from Russian actors. Matryoshka was present, but supplementary. The core operation was built and funded by entities connected to the governing party itself.
This is a different threat model than the foreign interference framing that dominates most public discussion of election disinformation. The canonical threat model is an external adversary inserting false content into a target country’s information environment. Hungary’s 2026 election illustrates something structurally more difficult: a ruling party deploying disinformation as a standard campaign tool against domestic opposition.
The resources available to a governing party — media relationships, institutional credibility, budget — can make the domestic disinformation actor more capable than an external one. The fake Tisza platform was published by Index before being debunked because Index still treated Fidesz-adjacent leaks as potentially credible. No external actor could manufacture that initial credibility without years of relationship-building.
When the government is the disinformation actor, the classic defense — rely on state institutions for accurate information — fails by design. The forged document moved through an outlet that had institutional reasons to be credulous toward the source that planted it.
The Complete Stack
The Fidesz campaign represents a full-spectrum disinformation deployment: fabricated documentary evidence, amplification infrastructure through coordinated private groups, AI-generated synthetic media, false attribution through fake outlet branding, and supplementary Russian-linked operations. Each layer corresponds to a distinct manipulation category. Each layer was designed to address a limitation of the others.
The forged document needed distribution — the Facebook group infrastructure provided it. The AI videos needed credibility — the fake attributions provided it. The TikTok channels needed messaging direction — Matryoshka’s operational framework provided it. The layers were not independent; they were mutually reinforcing.
What the operation lacked was what no amount of infrastructure can substitute for: fact-supported argument.
Each fabrication works best when it doesn’t need to survive scrutiny. When independent fact-checking organizations, international election observers, and opposition media create a functioning scrutiny environment, the operation faces a different cost structure. Debunking one fabrication requires deploying another. Each new debunking adds to the pattern that makes the fabricator legible. After sufficient iterations, the pattern itself becomes the story — not the individual claims, but the existence of a coordinated, institutionally-backed deception campaign.
Orbán’s apparatus was sophisticated by any external measure. It was also empirically falsifiable, and it was falsified.
The lesson is not that disinformation doesn’t work. It’s that disinformation deployed against an electorate that has developed pattern recognition for a specific operator becomes progressively less effective over time. Sixteen years of building the same apparatus, against the same opponents, using increasingly visible infrastructure, taught voters what the operation looks like from the inside.
This article is part of Decipon’s Manipulation Breakdowns series, which examines specific influence operations using the NCI Protocol framework.