Loading signal...
Signal
Submitted
Mar 11, 2026, 12:08 UTC
From May to October 2023, scammers impersonated major Lithuanian and Estonian brands on META platforms, running 568+ fake ads with 7.5M+ impressions to lure users into fake investment scams stealing login credentials and money.
The campaign exploited Facebook, Instagram, and Messenger to disseminate fake ads mimicking leading Lithuanian portals (Delfi, LRT, InfoTV, LNK) and the Estonian broadcaster ERR, along with major corporate brands Ignitis and Orlen Lietuva. Scammers used 93 fake Facebook accounts and 81 fraudulent domains designed to look like legitimate news sources, tailoring content in multiple languages to regional contexts. The fake ads leveraged sensational but often real criminal cases (e.g., murder and drowning incidents) manipulated to suggest financial opportunity, enticing less literate and financially vulnerable users into investments. After clicking ads, victims were redirected to counterfeit investment platforms such as Ignitis Profit Sense, Oil Profit, and Orlen Lietuva, where they were asked for bank login and card details that were stolen. Attempts to remove fake profiles met with META's initial refusals, but by October 2023, 28 of 31 fake profiles were deleted following Lithuanian government intervention. The scam also falsely linked Lithuania's president and parliament to investment schemes to build deceptive credibility. This represents a sophisticated hybrid warfare information operation with financial exploitation components affecting Lithuania and neighboring states.
Confidence: High
The article details a large-scale, coordinated disinformation and scam campaign by unidentified hostile actors impersonating legitimate media and corporate brands to defraud Lithuanian citizens and others using fake Facebook pages and cloned websites, clearly indicating hostile aggressor activity. There is no mention of defensive measures or counteractions by Lithuania or allied forces as part of the incident.
Source URL
https://www.debunk.org/the-largest-disinformation-and-scam-attack-ever-recorded-in-lithuania-part-i
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "bf89b44c-0f15-4e6d-849e-9eae5bd0701f",
"url": "https://www.debunk.org/the-largest-disinformation-and-scam-attack-ever-recorded-in-lithuania-part-i",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Information Operations",
"incident_type": "Fake NGOs / shell media outlets",
"country": "Lithuania",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"disinformation",
"scam",
"fake news",
"investment fraud",
"Facebook scams",
"META advertising abuse",
"brand impersonation",
"Lithuania",
"Estonia",
"financial theft",
"hybrid warfare",
"information operations"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [
"Lithuania"
],
"where_text": "Cyberspace",
"headline": "Largest Disinformation and Scam Attack Ever Recorded in Lithuania Targets Facebook Users with Fake Investment Schemes",
"description": "Between May and October 2023, unidentified scammers conducted a large-scale disinformation and scam campaign targeting Lithuanian and neighboring countries' citizens via Facebook, Instagram, and Messenger. They impersonated major Lithuanian and Estonian media and corporate brands—such as LRT, Delfi, InfoTV, LNK, Ignitis, and Estonian broadcaster ERR—using fake Facebook accounts and cloned websites. More than 568 fake ads generated over 7.5 million impressions, employing scandalous criminal news and financial incentives to lure victims into fake investment platforms promising high returns. The fake platforms stole users' banking login credentials and funds after authentication, causing substantial financial harm. Despite Lithuanian government efforts to remove fake profiles, META delayed action, only removing most fake profiles after a government report. The scheme exploited real high-profile criminal events and falsely implicated Lithuanian political figures, including the president, to increase clicks and trust fraudulently.",
"summary_short": "From May to October 2023, scammers impersonated major Lithuanian and Estonian brands on META platforms, running 568+ fake ads with 7.5M+ impressions to lure users into fake investment scams stealing login credentials and money.",
"summary_extended": "The campaign exploited Facebook, Instagram, and Messenger to disseminate fake ads mimicking leading Lithuanian portals (Delfi, LRT, InfoTV, LNK) and the Estonian broadcaster ERR, along with major corporate brands Ignitis and Orlen Lietuva. Scammers used 93 fake Facebook accounts and 81 fraudulent domains designed to look like legitimate news sources, tailoring content in multiple languages to regional contexts. The fake ads leveraged sensational but often real criminal cases (e.g., murder and drowning incidents) manipulated to suggest financial opportunity, enticing less literate and financially vulnerable users into investments. After clicking ads, victims were redirected to counterfeit investment platforms such as Ignitis Profit Sense, Oil Profit, and Orlen Lietuva, where they were asked for bank login and card details that were stolen. Attempts to remove fake profiles met with META's initial refusals, but by October 2023, 28 of 31 fake profiles were deleted following Lithuanian government intervention. The scam also falsely linked Lithuania's president and parliament to investment schemes to build deceptive credibility. This represents a sophisticated hybrid warfare information operation with financial exploitation components affecting Lithuania and neighboring states.",
"actor_primary": "Unidentified scammers",
"target_primary": null,
"location_text": "Lithuania and neighboring Central and Western European countries",
"location_region": null,
"location_coordinates_lat": 55.169438,
"location_coordinates_lon": 23.881275,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article details a large-scale, coordinated disinformation and scam campaign by unidentified hostile actors impersonating legitimate media and corporate brands to defraud Lithuanian citizens and others using fake Facebook pages and cloned websites, clearly indicating hostile aggressor activity. There is no mention of defensive measures or counteractions by Lithuania or allied forces as part of the incident.",
"event_time_utc": "2023-05-28T00:00:00.000Z",
"end_time_utc": "2023-10-31T23:59:00.000Z",
"event_time_confidence": "pm24h",
"created_at": "2026-03-11T12:08:00.098Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "moderate",
"attribution_confidence_band": "medium",
"attribution_basis": "independent_sources"
}Source reliability
B
Info credibility
3
Event time
May 28, 2023, 00:00 UTC
End time
Oct 31, 2023, 23:59 UTC
Event time confidence
pm24h
Location
Lithuania and neighboring Central and Western European countries
Primary actor
Unidentified scammers
Country
Lithuania
Countries
Lithuania
Tags
disinformation, scam, fake news, investment fraud, Facebook scams, META advertising abuse, brand impersonation, Lithuania, Estonia, financial theft, hybrid warfare, information operations
Nodes
Node 2: 5th Column
Signal
Submitted
Mar 11, 2026, 12:08 UTC
From May to October 2023, scammers impersonated major Lithuanian and Estonian brands on META platforms, running 568+ fake ads with 7.5M+ impressions to lure users into fake investment scams stealing login credentials and money.
The campaign exploited Facebook, Instagram, and Messenger to disseminate fake ads mimicking leading Lithuanian portals (Delfi, LRT, InfoTV, LNK) and the Estonian broadcaster ERR, along with major corporate brands Ignitis and Orlen Lietuva. Scammers used 93 fake Facebook accounts and 81 fraudulent domains designed to look like legitimate news sources, tailoring content in multiple languages to regional contexts. The fake ads leveraged sensational but often real criminal cases (e.g., murder and drowning incidents) manipulated to suggest financial opportunity, enticing less literate and financially vulnerable users into investments. After clicking ads, victims were redirected to counterfeit investment platforms such as Ignitis Profit Sense, Oil Profit, and Orlen Lietuva, where they were asked for bank login and card details that were stolen. Attempts to remove fake profiles met with META's initial refusals, but by October 2023, 28 of 31 fake profiles were deleted following Lithuanian government intervention. The scam also falsely linked Lithuania's president and parliament to investment schemes to build deceptive credibility. This represents a sophisticated hybrid warfare information operation with financial exploitation components affecting Lithuania and neighboring states.
Confidence: High
The article details a large-scale, coordinated disinformation and scam campaign by unidentified hostile actors impersonating legitimate media and corporate brands to defraud Lithuanian citizens and others using fake Facebook pages and cloned websites, clearly indicating hostile aggressor activity. There is no mention of defensive measures or counteractions by Lithuania or allied forces as part of the incident.
Source URL
https://www.debunk.org/the-largest-disinformation-and-scam-attack-ever-recorded-in-lithuania-part-i
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "bf89b44c-0f15-4e6d-849e-9eae5bd0701f",
"url": "https://www.debunk.org/the-largest-disinformation-and-scam-attack-ever-recorded-in-lithuania-part-i",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Information Operations",
"incident_type": "Fake NGOs / shell media outlets",
"country": "Lithuania",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"disinformation",
"scam",
"fake news",
"investment fraud",
"Facebook scams",
"META advertising abuse",
"brand impersonation",
"Lithuania",
"Estonia",
"financial theft",
"hybrid warfare",
"information operations"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [
"Lithuania"
],
"where_text": "Cyberspace",
"headline": "Largest Disinformation and Scam Attack Ever Recorded in Lithuania Targets Facebook Users with Fake Investment Schemes",
"description": "Between May and October 2023, unidentified scammers conducted a large-scale disinformation and scam campaign targeting Lithuanian and neighboring countries' citizens via Facebook, Instagram, and Messenger. They impersonated major Lithuanian and Estonian media and corporate brands—such as LRT, Delfi, InfoTV, LNK, Ignitis, and Estonian broadcaster ERR—using fake Facebook accounts and cloned websites. More than 568 fake ads generated over 7.5 million impressions, employing scandalous criminal news and financial incentives to lure victims into fake investment platforms promising high returns. The fake platforms stole users' banking login credentials and funds after authentication, causing substantial financial harm. Despite Lithuanian government efforts to remove fake profiles, META delayed action, only removing most fake profiles after a government report. The scheme exploited real high-profile criminal events and falsely implicated Lithuanian political figures, including the president, to increase clicks and trust fraudulently.",
"summary_short": "From May to October 2023, scammers impersonated major Lithuanian and Estonian brands on META platforms, running 568+ fake ads with 7.5M+ impressions to lure users into fake investment scams stealing login credentials and money.",
"summary_extended": "The campaign exploited Facebook, Instagram, and Messenger to disseminate fake ads mimicking leading Lithuanian portals (Delfi, LRT, InfoTV, LNK) and the Estonian broadcaster ERR, along with major corporate brands Ignitis and Orlen Lietuva. Scammers used 93 fake Facebook accounts and 81 fraudulent domains designed to look like legitimate news sources, tailoring content in multiple languages to regional contexts. The fake ads leveraged sensational but often real criminal cases (e.g., murder and drowning incidents) manipulated to suggest financial opportunity, enticing less literate and financially vulnerable users into investments. After clicking ads, victims were redirected to counterfeit investment platforms such as Ignitis Profit Sense, Oil Profit, and Orlen Lietuva, where they were asked for bank login and card details that were stolen. Attempts to remove fake profiles met with META's initial refusals, but by October 2023, 28 of 31 fake profiles were deleted following Lithuanian government intervention. The scam also falsely linked Lithuania's president and parliament to investment schemes to build deceptive credibility. This represents a sophisticated hybrid warfare information operation with financial exploitation components affecting Lithuania and neighboring states.",
"actor_primary": "Unidentified scammers",
"target_primary": null,
"location_text": "Lithuania and neighboring Central and Western European countries",
"location_region": null,
"location_coordinates_lat": 55.169438,
"location_coordinates_lon": 23.881275,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article details a large-scale, coordinated disinformation and scam campaign by unidentified hostile actors impersonating legitimate media and corporate brands to defraud Lithuanian citizens and others using fake Facebook pages and cloned websites, clearly indicating hostile aggressor activity. There is no mention of defensive measures or counteractions by Lithuania or allied forces as part of the incident.",
"event_time_utc": "2023-05-28T00:00:00.000Z",
"end_time_utc": "2023-10-31T23:59:00.000Z",
"event_time_confidence": "pm24h",
"created_at": "2026-03-11T12:08:00.098Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "moderate",
"attribution_confidence_band": "medium",
"attribution_basis": "independent_sources"
}Source reliability
B
Info credibility
3
Event time
May 28, 2023, 00:00 UTC
End time
Oct 31, 2023, 23:59 UTC
Event time confidence
pm24h
Location
Lithuania and neighboring Central and Western European countries
Primary actor
Unidentified scammers
Country
Lithuania
Countries
Lithuania
Tags
disinformation, scam, fake news, investment fraud, Facebook scams, META advertising abuse, brand impersonation, Lithuania, Estonia, financial theft, hybrid warfare, information operations
Nodes
Node 2: 5th Column