Ben Gilbert describes himself on Bluesky, the social media app, as an “economist, lit and guitar geek, rugby fan, over-the-top pet owner.” A professor at the Colorado School of Mines, he rarely posts, but when he does, the subjects reflect his expertise in natural resources.
So it was strange when a video purporting to be a news report appeared on his account last month, citing France’s financial and political support for Ukraine due to a lack of police personnel at home.
Unbeknownst to him, Mr. Gilbert said, he had fallen victim to Russia’s latest tactics to try to spread its propaganda in the West.
His account, like hundreds of others on Bluesky, had been hijacked and used to post fake news articles, according to the company and researchers at Clemson University who work with a collective of Internet monitors tracking Russian influence operations called the dTeam.
The compromised Bluesky accounts included those of people who are influential in their fields, although they may not be famous. They were journalists and professors, a Texas pollster, an anime artist and a Hollywood filmmaker whose account posted a video using artificial intelligence to impersonate a Canadian police official criticizing French President Emmanuel Macron.
The campaign, which the Clemson researchers linked to the Social Design Agency, a Moscow firm, shows how Russia continues to seek new ways to erode public support for Ukraine, which Russian forces invaded in 2022.
Bluesky has become more prominent as a rival platform to X since X’s owner, Elon Musk, threw his political support behind President Trump ahead of the 2024 election. However, with 42 million users, Bluesky is far behind X’s nearly 600 million.
While the Russians have long flooded social media platforms with fake accounts and content, hacking into real accounts appeared to be a new strategy.
“They’re clearly still experimenting,” said Darren L. Linvill, director of Clemson’s Media Forensics Hub. “They’re always experimenting.”
Bluesky has tracked the activity and removed the posts – as many as a few thousand. They came in waves starting in April and continued until at least last week.
In a statement, the company called Russian influence operations “an industry-wide problem.” “We dedicate significant resources to detecting and disrupting coordinated fraudulent campaigns,” the statement said.
Mr. Gilbert, of the Colorado School of Mines, a public research university near Denver, learned about the position on his account when The New York Times contacted him. “I just deleted it,” he wrote in an email.
In other cases, Bluesky has suspended accounts until the owners came forward to reset them. Many targets only found out about the hacking when they were locked out of their accounts. One of them was Pamela Wood, a political reporter at The Baltimore Banner.
She was on vacation on April 28 when her account was suspended after it posted a short video with a caption saying The New York Post had linked Ukraine to the man charged with trying to assassinate Mr. Trump last month at the White House Correspondents’ Association dinner.
“Bluesky didn’t provide much information but hinted that my account may have been hacked or compromised,” Ms. Wood. “My account is pretty vanilla – I just post my stories pretty much – and I hadn’t posted or even looked at Bluesky for a few days, so it was best to get hacked.”
Clemson attributed the Social Design Agency’s campaign to a Kremlin influence operation that researchers have dubbed Matryoshka after the Russian nesting dolls.
The operation, which originated in 2024, specializes in creating fake articles that appear to be from real news organizations such as Reuters or France 24. The goal appears to be to spread the claims by encouraging fact-checkers to debunk them.
Russian news media also cite these fabricated posts, falsely implying that the content, mostly in English, originated in the West. The Social Design Agency did not respond to a request for comment.
Russian propaganda about Bluesky first became notable during Germany’s elections last year, when the Kremlin sought to strengthen Germany’s far-right, led by the Alternative for Germany party, known as the AfD.
Joseph Bodnar, a researcher at the Institute for Strategic Dialogue, an international organization that has also tracked Russian disinformation, said the hijacking of individual accounts on Bluesky had “a level of sophistication beyond what we normally see.”
“What we usually see is using hijacked accounts on X, but they’re random, obscure accounts with crazy avatars,” Mr. Bodnar, who was not involved in the Clemson research. “They’re not trying to get anyone moderately known or respected.”
Ukraine is almost always the main target of Matryoshka’s operations, but previous campaigns also sought to discredit preparations for the 2024 Summer Olympics in Paris and the Trump administration’s dismantling of the US Agency for International Development.
The latter was one of Russia’s most successful disinformation operations, Mr. Linville. It contained videos of fabricated news reports suggesting that USAID had paid celebrities, including actor Ben Stiller, to travel to Ukraine. Millions of people saw these posts.
Although Mr Trump was the subject of recent posts on Bluesky, most pointed to Russia’s preoccupation with France, which has emerged as the leader of European efforts to bolster Ukraine in the war, and Armenia, a former Soviet republic whose elections next month could move further from Moscow’s orbit.
“They just have to get lucky a few times for it to be worth it,” said Mr. Linville.
