A Russian-linked campaign hijacked hundreds of Bluesky accounts to spread pro-Russia propaganda, targeting influential Americans. The Social Design Agency orchestrated the effort, using compromised authentic accounts. Bluesky removed nearly 5,000 state-backed influence accounts in 2023. The campaign’s impact was limited but carried a perception effect.

Cyber & Information WarfareInformation OperationsPropaganda & disinformation campaigns

Aggressor

Summary

A Russian influence campaign hijacked hundreds of Bluesky accounts, many belonging to influential Americans, to spread pro-Russia propaganda. The campaign targeted journalists, academics, and filmmakers on Bluesky and was linked to the Moscow-based firm Social Design Agency (SDA). Researchers at Clemson University tracked the operation, which used legitimate accounts rather than fake ones, compromising older or dormant accounts and some active accounts, likely via credential leaks from other data breaches. Bluesky removed 4,907 accounts linked to state-backed influence activity in 2023, double the previous year. The SDA campaign impersonated celebrities, policemen, academics, journalists, and others. The SDA is sanctioned by the US, EU, and the UK for delivering interference operations designed to undermine democracy and weaken support for Ukraine. Despite the campaign’s sophistication, its impact was limited as posts averaged 50 views before removal, with impact driven more by public perception than actual reach.

Classification

Confidence: High

The activity involves a deliberate and coordinated hostile influence operation by a Kremlin-linked actor using hybrid methods in cyberspace to spread disinformation via hijacked authentic accounts, fulfilling criteria for aggressive hybrid warfare signals.

Source URL

https://france24.com/en/live-news/20260529-bluesky-accounts-hijacked-in-pro-russia-propaganda-campaign

Open source

Provenance

Publisher: extension
Submitted: May 29, 2026, 20:04 UTC
Last updated: Nov 4, 2026, 08:36 UTC
Event time: May 29, 2023, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "b08c4a15-4d05-45ed-ae4e-1085aef573b3",
  "url": "https://france24.com/en/live-news/20260529-bluesky-accounts-hijacked-in-pro-russia-propaganda-campaign",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Information Operations",
  "incident_type": "Propaganda & disinformation campaigns",
  "country": "United States of America",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "Bluesky",
    "Pro-Russia propaganda",
    "Social Design Agency",
    "information operations",
    "Disinformation",
    "Account hijacking",
    "Cyber influence campaign"
  ],
  "nodes": [],
  "countries": [
    "United States of America"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "A Russian influence campaign hijacked hundreds of Bluesky accounts, many belonging to influential Americans, to spread pro-Russia propaganda. The campaign targeted journalists, academics, and filmmakers on Bluesky and was linked to the Moscow-based firm Social Design Agency (SDA). Researchers at Clemson University tracked the operation, which used legitimate accounts rather than fake ones, compromising older or dormant accounts and some active accounts, likely via credential leaks from other data breaches. Bluesky removed 4,907 accounts linked to state-backed influence activity in 2023, double the previous year. The SDA campaign impersonated celebrities, policemen, academics, journalists, and others. The SDA is sanctioned by the US, EU, and the UK for delivering interference operations designed to undermine democracy and weaken support for Ukraine. Despite the campaign’s sophistication, its impact was limited as posts averaged 50 views before removal, with impact driven more by public perception than actual reach.",
  "summary_short": "A Russian-linked campaign hijacked hundreds of Bluesky accounts to spread pro-Russia propaganda, targeting influential Americans. The Social Design Agency orchestrated the effort, using compromised authentic accounts. Bluesky removed nearly 5,000 state-backed influence accounts in 2023. The campaign’s impact was limited but carried a perception effect.",
  "summary_extended": null,
  "actor_primary": "Social Design Agency",
  "target_primary": null,
  "location_text": "United States of America",
  "location_region": null,
  "location_coordinates_lat": 37.09024,
  "location_coordinates_lon": -95.712891,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The activity involves a deliberate and coordinated hostile influence operation by a Kremlin-linked actor using hybrid methods in cyberspace to spread disinformation via hijacked authentic accounts, fulfilling criteria for aggressive hybrid warfare signals.",
  "event_time_utc": "2023-05-29T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-05-29T20:04:00.063Z",
  "updated_at": "2026-11-04T08:36:03.522Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

May 29, 2023, 00:00 UTC

Event time confidence

pm24h

Location

United States of America

Primary actor

Social Design Agency

Country

United States of America

Countries

United States of America

Tags

Russia, Bluesky, Pro-Russia propaganda, Social Design Agency, information operations, Disinformation, Account hijacking, Cyber influence campaign

Loading signal...

{ "id": "b08c4a15-4d05-45ed-ae4e-1085aef573b3", "url": "https://france24.com/en/live-news/20260529-bluesky-accounts-hijacked-in-pro-russia-propaganda-campaign", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Information Operations", "incident_type": "Propaganda & disinformation campaigns", "country": "United States of America", "source_reliability": "C", "info_credibility": "3", "tags": [ "Russia", "Bluesky", "Pro-Russia propaganda", "Social Design Agency", "information operations", "Disinformation", "Account hijacking", "Cyber influence campaign" ], "nodes": [], "countries": [ "United States of America" ], "where_text": "Cyberspace", "headline": null, "description": "A Russian influence campaign hijacked hundreds of Bluesky accounts, many belonging to influential Americans, to spread pro-Russia propaganda. The campaign targeted journalists, academics, and filmmakers on Bluesky and was linked to the Moscow-based firm Social Design Agency (SDA). Researchers at Clemson University tracked the operation, which used legitimate accounts rather than fake ones, compromising older or dormant accounts and some active accounts, likely via credential leaks from other data breaches. Bluesky removed 4,907 accounts linked to state-backed influence activity in 2023, double the previous year. The SDA campaign impersonated celebrities, policemen, academics, journalists, and others. The SDA is sanctioned by the US, EU, and the UK for delivering interference operations designed to undermine democracy and weaken support for Ukraine. Despite the campaign’s sophistication, its impact was limited as posts averaged 50 views before removal, with impact driven more by public perception than actual reach.", "summary_short": "A Russian-linked campaign hijacked hundreds of Bluesky accounts to spread pro-Russia propaganda, targeting influential Americans. The Social Design Agency orchestrated the effort, using compromised authentic accounts. Bluesky removed nearly 5,000 state-backed influence accounts in 2023. The campaign’s impact was limited but carried a perception effect.", "summary_extended": null, "actor_primary": "Social Design Agency", "target_primary": null, "location_text": "United States of America", "location_region": null, "location_coordinates_lat": 37.09024, "location_coordinates_lon": -95.712891, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The activity involves a deliberate and coordinated hostile influence operation by a Kremlin-linked actor using hybrid methods in cyberspace to spread disinformation via hijacked authentic accounts, fulfilling criteria for aggressive hybrid warfare signals.", "event_time_utc": "2023-05-29T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-05-29T20:04:00.063Z", "updated_at": "2026-11-04T08:36:03.522Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }