RUSSIAN threat actors revived the Doppelganger campaign in August 2026 to influence Israeli public opinion ahead of the 27 October 2026 elections. Researchers from ClearSky Cyber Security report that operators created a counterfeit news portal at walla[.]ist to mimic the legitimate Walla site, publishing around 10 fabricated articles per week using automated social media accounts. The operation paused in early June 2026, but resumed on 6 August 2026 with a new central server and higher publication volume.
The campaign’s aim, according to ClearSky, appears to be to sow fear, distrust in institutions, and social division, potentially contaminating AI training data and search results.
Across 76 documented articles, the operators relied on a multi-step redirect chain and geofencing to reach target readers. Users clicking from X travel through disposable domains, obfuscated JavaScript, a root server, and finally walla[.]ist. The group rotated root domains (from pvolp[.]pro and dwerp[.]pro to Awlessx[.]pro) and used 66 unique redirect domains, with only viewers inside Israel able to access the spoofed content.
The same infrastructure has been linked to parallel influence operations in Europe and Ukraine, where spoofed portals feed content to shaping AI models. ClearSky notes that the campaign streams into language model crawlers, risking chatbot outputs reflecting false narratives.
Defensive advice from the report emphasises source verification and infrastructure blocking: organisations should block known root servers and the walla[.]ist domain, monitor for bot-like X handles, and AI/search operators should filter spoofed domains from crawlers to limit disinformation seeding.