Four General Elections, Four Information Battlegrounds: Comparing Vulnerabilities Across Hungary, Bulgaria, Cyprus and Malta
July 2026 Overview of Emerging Disinformation Trends
This text has been published as part of the fourth edition of the new monthly EDMO Signals & Noise newsletter. Sign up here to receive future editions directly to your inbox.
Author: Paolo Cesarini, Chair of the Executive Board, European Digital Media Observatory (EDMO)
The general elections in Sweden next September will mark the start of a new electoral period. In a significant number of EU member states and neighbouring countries, citizens will be called to the polls in the coming months and, predictably, foreign and domestic actors will try again to exploit systemic vulnerabilities of local information environments to spread disinformation and undermine the integrity of democratic processes. Understanding the evolving and adaptive dynamics of electoral disinformation is key to foster preparedness, anticipate foreseeable incidents, and raise voters’ awareness. At this juncture, therefore, it may be useful to look back at the recent elections in Hungary, Bulgaria, Cyprus and Malta during the 2nd quarter 2026 and draw some lessons from the EDMO Network’s electoral monitoring.
Overall, EDMO’s Weekly Pulse coverage and the hubs’ investigations highlight a general trend: electoral disinformation is less about pushing isolated, high-profile false stories, and more about coordinated operations blending AI, opaque political advertising, algorithmic amplification and foreign influence to shape public perceptions and impair voters’ ability to critically asses competing political programs. But the similarities stop there. The following overview highlights certain differences and specific vulnerabilities across the four countries.
AI and automated coordination are part of a wider toolbox
Artificial intelligence emerged as one of the defining features of all four electoral processes, with noticeable differences, however, from country to country.
Hungary was the clearest laboratory for AI-driven manipulation. HDMO found troves of AI-generated content on different social media platforms, including synthetic content engineered to trigger fear and anger around sensitive topics like the war in Ukraine, immigration and EU policies, mainly spread by Fidesz-aligned networks. A large part of manipulative content consisted of cheapfakes, combining authentic footage with manipulated subtitles, altered audio, synthetic imagery or deceptive editing. HDMO also identified hundreds of high-reach TikTok accounts, all created in March 2026 and operating in a coordinated fashion, in which AI personas – including a Péter Magyar avatar supposedly dosed with “truth serum” – pushed anti-Tisza messages.
Malta and Cyprus saw lower-stakes but still corrosive versions of the same phenomenon. In Malta, “AI slopaganda” flooded social media feeds with mass-produced synthetic images and videos meant to ridicule opponents. The two major parties were both targeted, with material against the opposition Nationalist Party focused on its leader personally, and pro-Labour content attacking the governing party’s reputation more broadly. Cyprus also saw manipulated audiovisual material, notably during the so-called Videogate affair. There, however, the techniques were comparatively conventional: rather than deepfakes, investigators found selective editing, misleading sequencing of authentic footage, overlaid synthetic audio and omissions of context. The manipulation laid less in fabricating reality than in reframing it.
Bulgaria stood apart: AI played only a minor direct role in shaping campaign narratives – except a significant case of AI-generated content used in a gender-based smear campaign against a woman journalist. Instead, automated coordination appeared as a central feature. For example, BROD detected nearly 49,000 Telegram posts across 42 coordinated channels, and posting volume up 75% from February to March.
Different actors, different objectives
Hungary presents the clearest example of a domestic disinformation ecosystem operating through coordinated fake social media profile networks, in close alignment with governing political interests. Foreign influence came to further reinforce these domestic efforts. Researchers linked several operations to Russian networks, including Storm-1516‘s, which fabricated scandals against opposition figures, and the separate Matryoshka bot network, which amplified anti-Tisza video across X, TikTok and Telegram. Foreign political pressure came from further afield too: US Vice President J.D. Vance, visiting Budapest to back Orbán, accused the EU of “one of the worst examples of election interference” he had seen, and the US House Judiciary Committee sent a letter the day before the vote wrongly accusing the EU’s Rapid Response System of censoring pro-Orbán voices. A further, domestically-focused strand in Hungary was Mathias Corvinus Collegium – a private institution tied to Orbán – which launched a “Democracy Interference Observatory” to allege EU and NGO meddling in Hungary’s vote.
Bulgaria’s pattern was dominated by foreign information manipulation exploiting domesitic political instability and societal polarisation. BROD researchers identified pro-Kremlin disinformation actors – notably a reactivated Pravda ecosystem – as the principal source of coordinated influence. Their messaging consistently portrayed the European Union as responsible for Bulgaria’s economic and social problems, framed NATO as dragging Bulgaria into the war in Ukraine and promoted narratives depicting Russia as a reliable strategic partner. The monitoring of Facebook throughout the campaign documented recurring manipulation patterns centred on electoral delegitimisation – including false or misleading claims questioning the integrity of voter registration or alleging widespread electoral fraud without credible evidence. Researchers describe these narratives as forms of cognitive shaping, designed not necessarily to convince citizens of a specific falsehood or promote a specific candidate, but to gradually reduce confidence in democratic institutions and electoral processes.
Cyprus combined domestic partisan actors (such as in the Sandygate case) with an unconnected layer of Chinese-driven propaganda. In the latter case, influencer accounts on Facebook, Instagram, TikTok and YouTube, operating in Greek language and funded via Hong Kong intermediaries or directly through China Media Group entities, mostly promoted pro-Beijing narratives without intervening in the election directly.
Malta’s manipulation was largely domestic and partisan, sharpened by a wave of xenophobic rhetoric after Prime Minister Robert Abela said a €1,000 “super bonus” pledge for workers was designed to exclude most foreigners, prompting an equally charged reply from a Nationalist MEP.
Some narratives travelled across borders, others stayed local
Several narratives spread in multiple countries and languages. For example, a vicious hoax accusing Péter Magyar of horrific private conduct spread virally in German, French, Italian, Spanish, Polish (fooling Polish opposition leader Jarosław Kaczyński), Dutch, Portuguese, Bulgarian, Greek, Slovenian, Slovak, Czech and Croatian within weeks of his taking office – an apparent escalation of anti-Magyar smear campaigns from the Hungarian to the European level, resembling years of similar attacks on Volodymyr Zelensky. Similarly, AI-manipulated images exaggerating a real Hungarian seizure of Ukrainian cash and gold circulated in Hungarian, Bulgarian, Italian, Romanian, Slovak and Czech, spread by vaccine-sceptic accounts and inflaming Orbán-Zelensky tensions ahead of the vote.
Other narratives stayed local. Cyprus’s Sandygate – disputed corruption and abuse allegations from a Volt Cyprus candidate, later debunked by forensic fact-checking that traced the “evidence” to a German quiz site, an ARTE documentary and machine-translated text – never travelled beyond Cypriot politics. Similarly, Malta’s controversies (illegal Polymarket election betting, xenophobic sparring over a “super bonus” pledge for non-foreign workers) stayed domestic. Bulgaria’s institutional-delegitimisation narratives – the “hijacked Constitution” – were also country-specific.
This split is instructive: narratives that attach to a recognisable international figure (Zelensky, Magyar, the EU, “Brussels”) travel easily across language borders, while narratives built around a country’s own institutions, personalities or legal disputes tend to stay contained.
Platforms as part of the battleground
All four cases show platform architecture, not just individual posts, becoming a manipulation vector. In Hungary, proxy pages and intermediary advertisers routed political ads around Meta’s ban, while coordinated fake-profile networks amplified content on TikTok, with accounts reappearing after takedowns. Bulgaria’s core vulnerability was Telegram, which sits outside the Digital Services Act’s strictest obligations despite hosting the densest pro-Kremlin ecosystem of the four countries. Moreover, BROD documented the recurring practice of buying and repurposing Facebook groups to redirect existing audiences toward party messaging. It also found sanctioned Russian broadcast content still circulating on Facebook and TikTok, geo-blocked in some member states but still visible elsewhere in the EU.
In Cyprus, MedDMO documented five separate anonymous or pseudonymous advertising operations running more than 450 political ads in the campaign’s final weeks, with duplicate account structures and sequential account replacement after enforcement; one operation distributed fabricated opinion-polling data in the days immediately before the 24 May vote, and platform enforcement was largely reactive. In Malta, MedDMO found Google’s Ads Transparency Center had mislabelled hundreds of election ads paid for by ONE Productions Ltd – the Labour Party’s own media company – as “Arts and entertainment” or “Travel and Tourism” rather than political content, while a Facebook page belonging to the Nationalist-owned outlet Net News was taken down after a wave of coordinated mass reporting, later restored after direct contact with Meta [16].
A structural theme emerges across the reporting: researcher access to data remains a bottleneck. For instance, BROD found that Meta’s Content Library follower thresholds (≥15,000 for pages, ≥25,000 for profiles) excluded 291 Bulgarian-language election posts from 210 producers that had accumulated more than 12 million combined views. This means that a significant share of civic discourse falls outside what independent monitors can systematically capture.
Conclusion: three models, one shared toolbox
Three broad models emerge from the above comparisons. Hungary saw the most systemic manipulation ecosystem, with coordinated domestic networks tied to Orban’s party, Fidez, AI-assisted propaganda and at least two distinct Russian-linked operations converging into a dense campaign. Bulgaria’s ecosystem centred on a persistent, state-adjacent pro-Kremlin amplification infrastructure aimed at eroding institutional trust and deepening existing domestic polarisation, rather than boosting one specific party. Cyprus and Malta faced more fragmented, issue-specific manipulation exploiting gaps in platform governance, with a weaker domestic disinformation ecosystem but real vulnerabilities in anonymous advertising, ad-transparency mislabelling and an emerging layer of Chinese state-sponsored propaganda.
Despite these differences, the underlying toolbox was strikingly consistent: emotionally charged framing outperformed balanced communication everywhere; AI-generated content co-existed alongside more classic manipulated material; coordinated amplification substituted for persuasive content on its own merits; and narratives were sustained across platforms and weeks rather than relying on single viral moments. Platform data-access limits compounded all of this: Meta’s follower thresholds hid millions of views’ worth of Bulgarian content from researchers, and reactive, post-hoc enforcement was the norm in all four electoral contexts.
Protecting future elections will likely need more genuine transparency in political advertising, researcher access to platform data not gated by arbitrary follower thresholds, concrete operational benchmarks for what “adequate” platform mitigation means under the DSA, and faster, better-resourced cooperation between platforms, regulators and civil society. EDMO recently contributed to these efforts by setting out a consistent and transparent approach to boost the efficiency of the Rapid Response System embedded in the Disinformation Code: a concrete way to protect electoral integrity and strengthen the EU Democracy Shield. However, the 2026 cycle in Hungary, Bulgaria, Cyprus and Malta shows that Europe faces not one model of electoral disinformation but several, adaptive and sharing a common toolkit – a diversity that any future safeguard will need to match.
