As a suspicious campaign based on Iran, it has tried to convince the Canadian media to spread false news


An online disinformation campaign, believed to come from Iran, tried to convince the Canadian media to amplify the false news, found a CBC / Radio-Canada analysis. And in at least one case, it was successful.

The campaign was first discovered by researchers from the Citizen Lab of the University of Toronto, who detailed their findings in a report published last week. Dubbed the Endfly Mayfly, the campaign was based on short-lived false news that disappeared after being propagated by unconscious targets.

CBC has downloaded thousands of Endless Mayfly tweets identified by researchers at Citizen Lab and searched for references in Canada. CBC also inspected every account mentioned in the tweets to identify Canadian Twitter users. This revealed that while the campaign was aimed at thousands of Twitter users worldwide, part of the effort focused specifically on Canadian accounts.

Throughout 2016 and 2017, some of these accounts targeted 12 Canadian media, including CBC, to draw attention to a false story by claiming that the CIA supported a failed coup in Turkey.

Another tweet tried to get Le Journal de Montréal, a French-language newspaper, to cover up a false story that claimed Saudi Arabia supported the then presidential candidate Emmanuel Macron in the 2017 French elections. Article was hosted on a false version of the Belgian news site Le Soir and was eventually shared on Twitter by extreme right-wing French politician Marion Maréchal-Le Pen.

In some cases, this media-baiting has worked. Reuters, for example, reported on a false story invented by Endless Mayfly who said that six Arab countries had asked FIFA to prevent Qatar from hosting the 2022 World Cup. The story was published on a fake mock-up of a Swiss news site.

Global news collected the history of Reuters and later he corrected it.

This screengrab shows the false story published on a site designed to look exactly like The Local, a Swiss news site. (Internet Archive)

While researchers at Citizen Lab cannot point the finger at the Iranian government, they wrote that "they find with moderate confidence that Iran or an actor aligned with Iran is the most plausible explanation" based on the evidence gathered . Their analysis shows that the pieces of false news pushed by the network closely align with Iranian interests.

"It's difficult to define definitively what their goal is, but I think it was to put their stories into the mainstream media," said Gabrielle Lim, lead author of the report. "I think the goal was to sow the geopolitical division between the traditional adversaries of Iran, such as Israel, Saudi Arabia and Western countries like the United States."

The role of social media

Another member of Endless Mayfly was trying to get false news published by alternative media around the world. Twitter users who present themselves as independent reporters have tried to contact different points of sale, offering the possibility of collaborating. One of these stores was The Rebel, a Canadian far-right news and commentary site run by Ezra Levant.

There is no indication that anyone who uses The Rebel Twitter account has responded to the fake account associated with the name Brian H. Hayden, described in his profile as an "independent journalist".

However, the global research website of Montreal has done. The site publishes stories that promote theories that have been reduced, such as chemtrails. In 2017, Global Research published two papers supposedly written by Hayden, both identified by researchers as derived from Endless Mayfly.

An article claimed that Israel and Turkey were trying to sow the division in the Middle East by supporting an independent Kurdistan in Iraq. The other claimed that the former Pakistani Prime Minister Nawaz Sharif was a puppet of Saudi Arabia.

CBC contacted Global Research for a comment but has not yet received a response.

This screen shows "Brian H. Hayden" addressing Rita Katz, a noted terrorist expert, via Twitter. (Citizen Lab)

The Endless Mayfly campaign was based partly on the creation of fake web pages of real media, often copying their own layout and hosting URLs similar to those of the objectives. For example, the articles were published on "" rather than on the real The Guardian website,

Two domains very similar to the Canadian media – and – were also registered by the people behind the campaign. The researchers were unable to determine whether the contents were ever published on these websites and no traces of articles remain. But their URLs are almost identical to those of the National Post and the Globe and Mail. These sites were subsequently deleted.

Together with the Canadian media outlets and specific journalists, the campaign focused part of its energy on the imprisoned Saudi blogger Raif Badawi, arrested in 2012 and subsequently sentenced to 10 years in prison for "insulting Islam through electronic channels" .

Canada was involved in the struggle for its release after Badawi's wife, Ensaf Haidar, and the couple's children arrived in Canada as refugees in 2013. Haidar, in particular, was targeted by the disinformation network. Twitter accounts linked to Endless Mayfly mention and retweet Haidar 21 separate times in three different languages, more than any other single Canadian target.

& # 39; There are more players in this game & # 39;

Citizen Lab researchers said they could see Endfly Mayfly's tactics evolve in real time.

At the beginning of the campaign, various media in different countries realized that someone was spreading false news using copycat versions of their websites. To evade further detections, the actors behind the disinformation campaign would delete articles after a few hours, then redirect traffic to the actual media website that was impersonated. In this way, a skeptical user might think that the article was legitimate.

This example shows how those behind Endless Mayfly have published inauthentic articles forging original websites. In this case, the article was hosted on The fact that a "q" has replaced the "g" in "Bloomberg" may not be easily identifiable. (Citizen Lab)

Some parts of Endless Mayfly are still online and researchers believe the campaign may still be active.

"They have evolved so much from the mistakes of the past, it's much more difficult for researchers to keep track of these things," Lim said. "It is likely that we will see more interesting approaches to spreading misinformation: it is a good reminder that there are more players in this game, it is not just Russia, even Iran has a long history of computer trolls."

"The fact that disinformation campaigns are constantly evolving will make it more difficult to identify new attempts to influence political discourse as we head towards federal elections," said Fenwick McKelvey, associate professor of communications studies at Concordia University.

"That's why it's important to pay attention to this, because it's always about experiments, it's not like we see exactly the same type of technique or the same accounts," said McKelvey. "It's a cat and mouse game."

Send suggestions on this or other false news stories to or send us files securely and anonymously using SecureDrop.


Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.