“Now, how long will this take? The Ukrainians behave like charlatans and we continue to pay,” reads a quote in French next to a picture of Taylor Swift on what looks like a promotional poster for an upcoming tour. “That is not right.”

“Every time the Ukrainians get money, everything goes wrong,” reads another quote in German next to a picture of Selena Gomez on what appears to be a page taken from a fashion magazine.

“It’s just disappointing how the Ukrainians use our help,” a quote, also in German, reads next to a picture of Kim Kardashian speaking on stage. “Someone needs to stop this, seriously.”

Though the images make it look like these quotes were said by Swift, Gomez, and Kardashian, they weren’t. They were the product of a pro-Russian network of fake Facebook and X accounts that created and disseminated an ad campaign suggesting that some of the most famous people in the world back Russia and detest Ukraine. Among the celebrities included are Beyoncé, Oprah, Gigi Hadid, Lady Gaga, Jennifer Lopez, Justin Bieber, Shakira, Gwyneth Paltrow, and Cristiano Ronaldo. “Supporting Ukrainians is unacceptable,” reads a quote next to a photo of Oprah. “Their actions destroy lives and societies.”

The disinformation campaign, which was launched in November, reached at least 7.6 million people on Facebook alone, according to a database of the ads reviewed by WIRED and collected by Reset, a nonprofit that provides grants to those tackling disinformation. It’s still in progress, and two separate groups of disinformation researchers believe the campaign is run by a notorious Russian influence operation dubbed Doppelganger that has in the past been linked to the Kremlin. New information shared exclusively with WIRED suggests the campaign has links to Russia’s GRU military spy agency.

At the beginning of November, researchers at Reset discovered what they described as a “blitz campaign” by two networks of fake Facebook pages. Over the course of a week, the researchers saw at least 560 Facebook ads that feature images of celebrities alongside pro-Russian and anti-Ukrainian quotes. While some of the ads reached only thousands of users, others spread far more widely. One featuring Cristiano Ronaldo reached over 115,000 people before it was deactivated. Alongside the image of Ronaldo was the quote “It’s frustrating to see how the Ukrainians use our aid. Someone needs to stop this, seriously.”

Researchers at Reset believe that the campaign “exploits loopholes in Facebook’s ad verification and content moderation systems to foster hostility against Ukrainians and undermine EU support for Kyiv.” Including fake quotes from celebrities within images makes it harder for Facebook to spot a coordinated campaign, they added. The campaign, which specifically targeted people in France and Germany, also removed any links or additional text in the ads, making it harder for Meta to track it.

Doppelganger has been actively spreading disinformation on both Facebook and X for some time. The organization was unmasked in September 2022 by EU DisinfoLab, a nonprofit working to combat disinformation against the EU, but it had been operating since at least May 2022. The group used clones of media websites, including The Guardian and Bild, to spread disinformation, filling the fake sites with articles, videos, and polls designed to push pro-Kremlin talking points about Russia’s invasion of Ukraine.

Iin June 2023, another campaign targeting major French websites including Le Parisien, 20 Minutes, Le Monde, and Le Figaro was exposed by the French government. “French Minister supports the murder of Russian soldiers in Ukraine,” read one fake headline on a page that looked like Le Monde during that campaign.

Despite being repeatedly found out, the operators of Doppelganger have managed to continue their work: They also created fake versions of Fox News and other news websites to seed chaos and confusion during the Israel-Hamas war.

While Doppelganger campaigns in the past have been linked to the Kremlin in some media reports, new information from researchers tracking the disinformation campaign shows a link to Russia’s GRU.

A network of bot accounts on X, which in the past have been used to push Doppelganger’s fake websites, has also been used to push people to websites with direct links to Russia’s military spy agency. “Doppelganger bots promoted two sites recently, which both have strong connections to GRU,” researchers at Antibot4Navalny, a Russian anti-disinformation research group that has been closely tracking Doppelganger activity on X, tell WIRED. The researchers did not want to be identified due to security concerns.

The first site promoted by the Doppelganger bots was ObservateurContinental.fr. The Whois data, a public record of information related to the registration of a website, for this site shows that it is connected to InfoRos, a news agency previously linked to the GRU that operates hundreds of websites to push Kremlin propaganda. InfoRos was first reported to be a front organization for GRU Unit 54777 by The Washington Post in 2018. At the time, the group was said to have been active as far back as 2014 to spread disinformation about Russia’s annexation of Crimea.

The second site pushed by Doppelganger bots targeted Germans. In October 2022, an investigation by the German newspaper Die Welt found that the author of content on the EuroBRICS site was being paid directly by InfoRos, which is registered as the operator of the EuroBRICs website by the German domain registrar.

Many of the same images from Doppelganger’s campaign, along with others targeting an English-speaking audience, were also shared on X by the same network of bots that have previously shared links to the Doppelganger campaigns.

“We collected a whopping 75-plus fake quotes by celebrities from the US and EU, all massively posted recently by bots of Doppelganger, the pro-Kremlin influence campaign,” one of the researchers at Antibot4Navalny tells WIRED.

The campaign on X, which coincided with the Facebook campaign, used over 10,000 bot accounts, according to the researchers. In the space of one eight-hour period, the bots posted over 27,000 messages. At one point, the bot accounts were posting 120 messages every minute.

The posts on X are identical to those posted as ads on Facebook identified by Reset, except that some of these posts were in English. The X campaign also featured mocked-up versions of celebrities’ verified Instagram accounts, making it seem as if screenshots of celebrity Instagram accounts, using similar anti-Ukraine quotes, were being shared.

X did not respond to a request for comment from WIRED about the Doppelganger campaign. Since Elon Musk took control of the platform in October 2022, he has eliminated most of the company’s trust and safety team, and disinformation has flourished on the site, especially around breaking news events like the recent Israel-Hamas war.

One of Reset’s researchers, who did not want to be identified to protect their identity from retaliatory attacks, tells WIRED that, in recent days, researchers have seen Doppelganger’s celebrity-based campaign evolve. Some ads on Facebook now, like the ones on X, feature screenshots that appear to show verified Instagram accounts of the same celebrities, adding a further layer of authenticity to the campaign. In one case, a screenshot of a fake Instagram post from the entrepreneur Richard Branson suggests that he believes America was behind the Nord Stream explosion.

The researcher also found video ads that feature real footage of celebrities with fake audio dubbed over the top, which they say have been created with text-to-speech apps. The researchers at Reset were unable to identify which app was being used to automate the creation of the videos. One example reviewed by WIRED showed footage of German filmmaker Wim Wenders speaking in English about his own films, dubbed to make it appear as if he was speaking in French about how “the Ukrainians are ruined.” The ad was posted to Facebook on November 25 and was seen by up to 3,000 people before it was removed for failing to have the “required disclaimer,” according to Facebook’s ad library.

​While Facebook has taken down the majority of the pages, some of them remain active, and the campaign shows glaring gaps in Meta’s ability to deal with disinformation on this scale.

Meta declined to respond on the record to WIRED’s request for comment about the campaign and the network of fake accounts created to disseminate the false ads.

The automated creation of accounts on Facebook is a well-known problem, and Meta has deployed a variety of artificial intelligence systems to combat efforts to mass-create fake pages and accounts. By its own admission, Facebook deletes millions, and sometimes billions, of fake pages every quarter, sometimes within minutes of their creation. Meta claims that around 5 percent of its monthly average users are fake, but outside experts say that figure is substantially higher.

While the Doppelganger group ran the campaign, the fake Facebook pages it used were purchased from an agency that specializes in creating massive networks of inauthentic pages on Facebook, according to Reset. They are still investigating who created these initial networks, but the researchers say this campaign was pushed out by two separate networks they identified containing 52,000 and 25,000 pages respectively. In October, Reset published a report identifying even larger networks of inauthentic Facebook pages, including one that had over 340,000 inauthentic pages. Despite having been identified publicly, these networks are still operating today.

With a number of major elections taking place in 2024, experts are again concerned about Meta’s ability to reign in disinformation.

“Meta’s sloppy product safety is a security liability for both Europe and the US as we approach next year’s elections,” Felix Kartte, EU director at Reset claims to WIRED. “Threat actors will continue exploiting loopholes in Facebook’s advertising systems to target deceptive and inflammatory content at millions of voters in the world’s biggest democracies.”