Paris, 11 August 2026 – A striking burst of foreign interference has unsettled French politics just as the summer lull was expected to set in, with three declared or potential candidates for the 2027 presidential election targeted by hostile digital operations within the space of ten days. The centre-left MEP Raphaël Glucksmann, former prime ministers Gabriel Attal and Édouard Philippe – all figures with credible ambitions for the Élysée – have found themselves at the centre of fabricated online campaigns attributed to Russian networks. Glucksmann was the first to denounce the operation, writing on X that he had been targeted by Storm-1516, a disinformation group linked to the GRU, Russian military intelligence. The fake “investigation” produced by the network claimed that his partner, the prominent French journalist Léa Salamé, was seeking to secure favourable coverage for his presidential campaign. The operation included invented comments attributed to noted media figures, among them Edwy Plenel, the co-founder of Mediapart, who subsequently condemned what he called a “digital destabilisation” attempt. French prosecutors in Paris have confirmed that a criminal investigation has been opened into suspected Russian interference against Glucksmann, who has not yet officially declared his candidacy.
The second target, Gabriel Attal, is the former prime minister who now leads President Emmanuel Macron’s Renaissance party and has already announced his bid for the presidency. Attal has announced he filed a criminal complaint over “foreign interference” from “Russian networks”, with French authorities expressing a high degree of confidence that the attacks came from a pro-Russian operation known as Matryoshka, linked to the Kremlin. The fabricated allegations circulated against Attal included false claims about his health, his father and a spurious assertion that he was conducting a “war against women”. The third politician targeted is Édouard Philippe, also a former prime minister under Macron and a centre-right rival, who has declared his candidacy. Philippe was also subjected to Storm-1516 disinformation, specifically about his health, and his team has since created a “response cell” to monitor and counter online disinformation against him. Philippe is currently mayor of Le Havre and is widely considered a serious contender. The concentration of attacks against such high-profile political figures in such a short period has raised alarms about the coming presidential campaign and the methods hostile foreign actors may use to shape public debate.
The pattern has also revived a difficult conversation about how democracies should respond to digital interference. Cyber-threat expert Rayna Stamboliyska, a practitioner in residence at the Center for Internet and Society (CIS) at the CNRS research centre and founder of consultancy RS Strategy, urges caution in interpreting the recent spate of operations. Stamboliyska, author of La Face cachée d’Internet, specialises in the “information disorder” created by digital destabilisation operations. In an interview with Mediapart, she drew a clear distinction between two concepts that are often conflated: “influence” and “interference”. Influence, she argues, is the public activity carried out by pro-Kremlin propagandists such as Xenia Fedorova, who is now subject to a French expulsion order. Interference is something more sinister: covert action designed to exploit and manipulate public debate in a foreign country. She also highlighted the critical role of “attribution” – the process of identifying the foreign actor behind an operation and its probable purpose – and warned of consequences when that process is no longer left to specialist institutions. In France, that task falls to VIGINUM, the state body set up to detect and combat foreign digital interference, whose policy is to communicate about destabilisation campaigns at an early stage while withholding operational details to avoid amplifying them.
Asked whether the targeting of Glucksmann, Attal and Philippe signals a genuine threat to the 2027 presidential campaign, Stamboliyska said it is always difficult to answer such a question because doing so requires establishing a causal link between a clearly identified operation and a long chain of consequences – and such links are rarely provable. She pointed to the “Red Hands” operation as a textbook case: an operation that included an attack on the Holocaust memorial in Paris carried out by Russian proxies, where analysts were able to follow the operation and its consequences in real time and link everything to an election, with convictions. But, she stressed, such clear-cut cases are the exception. “Unfortunately, that’s the exception,” she said. She also noted that while interference issues regularly come up around elections, that does not mean such operations do not exist or are not being carried out outside pre-election periods. The real challenge, she said, is understanding where these operations fit into the wider public debate and how society functions, because often a digital operation amounts to little more than a shoddy website generated with ChatGPT, stuffed with keywords to make it appear in search engines, with no visible impact. In October 2025, for example, ahead of France’s municipal elections, one such operation was made public and was “incredibly shoddy”, making it difficult for researchers to turn signals and noise into a meaningful pattern linked to consequences, or the absence of them.
Stamboliyska also reflected on the timing and visibility of the recent disclosures. What was surprising about the past ten days, she observed, was that it was not VIGINUM that went public but the targeted candidates themselves. All three operations were detected by state services, yet no journalists had noticed them. “In fact, none of you would have written articles or carried out interviews if [the politicians] hadn’t gone public,” she told Mediapart. This represents a shift towards political messaging – turning attribution into a narrative. She outlined three consequences of this trend. First, being notified of such operations can be useful politically, without implying bad faith on the part of the candidates, because when state services confirm that an operation exists, it appears serious and tempting to publicise. Second, there is the danger of the boy who cried wolf: repeated claims of being targeted by “the big bad Kremlin” become part of a campaign narrative and a badge of seriousness, but risk breeding scepticism in the public mind and reducing the perceived seriousness of a genuine threat. Third, there is an operational dilemma: when all the media began discussing the deepfakes, a fabricated video seen by 5,000 people and 95,000 bots suddenly took on completely disproportionate importance in the middle of summer. As she put it, the “return on investment” for the people behind such low-cost, low-quality operations can be considerable, because the political impact is amplified by media coverage.
Stamboliyska concluded by highlighting the distinction between perception and intent. What do the people behind a possible interference operation actually want to achieve, and is that different from how it is perceived? She noted that nobody can know whether the creators of the deepfake involving Léa Salamé really wanted to stop Glucksmann from becoming the Left’s sole presidential candidate. There are very few situations, she said, in which a causal link between interference operations and the corrosion of public debate can be established with certainty. The situation is made even more complicated by the outsourcing networks known to operate on the Russian side, where young content producers may spend their days making TikTok videos that mix Edwy Plenel and Léa Salamé with videos of cats, without distinguishing between them. That makes it very difficult to tell which visible operations are actually serious. “It creates a very uncomfortable situation,” she said, “in which we have to avoid playing down the risk, while recognising political messaging for what it is, without at the same time speculating.” The episode, she added, shows that the threat is real but the response must be carefully calibrated: public disclosure can be a necessary countermeasure, but it also feeds a cycle of amplification and political exploitation. As France moves towards a presidential election, the balance between transparency, security and responsibility has rarely been more delicate.
