The Setup
On February 12, 2026, Ukrainian skeleton athlete Vladyslav Heraskevych was disqualified from the Milan Cortina Winter Olympics. The reason was genuine and documented: he had planned to wear a helmet bearing images of soldiers killed during Russia's war in Ukraine. The IOC ruled the display violated neutrality guidelines. The disqualification was real. It was reported. It was already in the news cycle.
That real event became the entry point for something else. Within days, fake videos began circulating on X and Telegram, impersonating Euronews, CBC News, TF1 Info, Deutsche Welle, and E!News. The videos claimed Ukrainian fans had committed vandalism in Milan in response to the disqualification. They claimed eight Ukrainian athletes had not returned home after the Games. They claimed a Ukrainian interpreter had defected, framing it as the "52nd" such incident. None of it happened. All of it was attached to coverage that looked, sonically and visually, like the real thing.
Further reading: National Institute of Mental Health
The Mechanism: Credibility Parasitism
The tactic is a form of institutional identity theft. Rather than building a new channel and cultivating an audience, the operation borrows trust that already exists. A viewer who trusts Euronews does not extend that trust to an anonymous account. They extend it to the Euronews visual package: the logo treatment, the lower-third typography, the broadcast color palette, the pacing of the edit. Strip those elements away and the claims collapse under scrutiny. Leave them in and the viewer's established trust in the real brand transfers directly to the fabricated content.
Researchers tracking the campaign attributed it to an ongoing operation called "Matryoshka," linked to Russian state-aligned actors. The name is appropriate. Each layer of the structure conceals the actual source. The fabricated video impersonates the credible brand. The credible brand's reputation impersonates journalistic verification. The viewer's familiarity with the brand impersonates personal knowledge of the facts.
"The viewer does not trust the claim. They trust the container. Swap the container for one the audience already believes in and the claim inherits that belief automatically."
The Evidence: What Was Deployed
By the time Milan Cortina closed, researchers at Antibot4Navalny had documented at least 35 fabricated videos impersonating media brands, research organizations, and government bodies connected to the Games. The most widely circulated was a doctored version of a CBC News report using an AI-cloned voiceover based on a real network reporter. That video accumulated over one million views before CBC publicly confirmed it was fabricated. A single fake Euronews clip on X reached 114,000 views. Fabricated magazine covers and manipulated social media posts extended the campaign further.
The Milan operation was smaller in scale than a comparable Matryoshka campaign during the Paris 2024 Olympics, which generated roughly 190 linked posts versus approximately 60 in Milan. The distinction worth noting is the targeting shift. The Paris campaign spread across multiple subjects including French officials and Olympic organizers. Milan focused tightly on Ukraine: its athletes, its refugees, its military conscription policies. The narrative compression signals intentionality. This was not opportunistic content farming. It was a specific psychological objective with measurable target parameters.
The Counter-Read
The technique is detectable. Four structural markers appear consistently in brand-impersonation influence content:
Markers of This Tactic
- The video circulates as a standalone on social platforms with no traceable origin URL at the claimed outlet
- AI voice cloning artifacts: unnatural prosodic rhythm, low variation in stress patterns, absent or irregular breath pauses
- Narrative overshoot: every element in the story confirms the same political claim with no ambiguity or contrary detail
- A verifiable real event serves as the entry point, with the fabricated allegation attached behind it as if consequentially linked
- The story appears fully formed without any prior coverage from the brand being impersonated
The hybrid structure, real seed event plus fabricated allegation, is the most reliable tell. Genuine reporting on a controversy does not automatically include a second story confirming further wrongdoing by the same party. When the fabricated element and the real event appear in the same piece, framed as cause and effect, the architecture of the manipulation is visible.
The Takeaway
Brand impersonation as an influence technique exposes a structural asymmetry that is not going away. Media organizations spend decades and substantial resources building audience trust. That trust, once established, is a public asset with no access controls. Anyone with video editing capability and a template can access it. The asymmetry is not a bug in the information environment. It is a feature that any operator willing to accept the reputational cost of exposure will continue to exploit.
The Matryoshka operation's logic is also a compression of a broader principle covered in manufactured consent: when you cannot win the argument on its merits, borrow the authority of someone who already has the audience's trust. The mechanism here is more direct, but the underlying lever is identical. Trust, once built, can be picked up by others. The builder has no monopoly on its use.