Russia-aligned actors are inflaming and exploiting anti-Ukrainian refugee sentiment in Poland ahead of the second round of presidential elections on 1 June. This ISD Investigation reveals a cross-platform effort involving elements of Russia-aligned information operations such as Operation Overload and Pravda/Portal Kombat. These operations use a variety of deceptive tactics to disseminate pro-Kremlin messaging, including impersonation, AI-generated content (AIGC) and coordinated amplification.  

---

Key findings 

• Throughout the election campaign period, Russian and pro-Russian actors have inflamed negative sentiment towards Ukrainians in Poland (the largest migrant group in the country).  

• Russia-aligned campaign Operation Overload (also known as Matryoshka) spread false content on X (formerly Twitter) and Bluesky accusing Ukrainian refugees of preparing terrorist attacks targeting the elections in Poland, with posts receiving more than 654,100 views and 5,725 likes and shares on X. 

• A parallel Operation Overload effort falsely claimed Ukrainians were plotting attacks on leading politicians in neighbouring countries. This content garnered 533,000 views and 4,530 likes and shares on X, with the engagement again coming from an amplifier network. 

• ISD found that ChatGPT reproduces misleading claims from a Russian network of websites known as ‘Pravda’ or ‘Portal Kombat’, for example allegations that Ukrainians are responsible for rising violent crime rates in Poland. 

• A satirical video was picked up and spun by a pro-Kremlin influencer to promote the claim that Ukrainians are taking advantage of the Polish welfare system. This was spread through a coordinated network of Facebook pages and groups, and accounts on Telegram and X. These accounts called for the deportation of Ukrainian refugees, sparking a wave of online hate and threats. The influencer’s response received 161,500 views, 900 shares and 380 comments on Facebook alone, with many of the comments containing hateful and derogatory language. 

Key recommendations 

• Immigration has become highly contested in Polish election discourse. The government must remain alert to sustained efforts by Russia-aligned actors to promote negative sentiment towards Ukrainian migrants and refugees in Poland and take action to protect these vulnerable groups from targeted discrimination and attacks.  

• Platforms such as X must effectively implement their existing obligations under the EU’s Digital Services Act (DSA) to mitigate systemic risks to electoral integrity, as reinforced by the European Commission’s guidelines for Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs). 

• Considering the rapid spread of AI-generated content made to deceive, platforms need to clearly label AI-generated/synthetic and manipulated content, rather than leaving this to users (via Community Notes), and should reflect existing obligations and recommended measures under EU law. 

• The European Commission must expand sanctions enforcement on Russian entities to include aggregators that share content from restricted outlets. The EC should also maintain engagement with internet service providers (ISPs) to enforce existing EU sanctions on foreign information manipulation and interference (FIMI) actors more comprehensively. 

Introduction 

Ukrainians are the largest group of foreigners in Poland, accounting for 1.5-1.7 million of a total 38 million people, including migrants and refugees. The issue of migration, and therefore of Ukrainians’ presence, has become central to the presidential election campaign in Poland. A study by Polish NGO Res Futura found a sharp growth in anti-Ukrainian refugee sentiment on social media in Poland since the start of the electoral campaign. This study found that allegations of criminal activity featured in 41 percent of mentions of Ukrainian refugees. 

In the first round of elections on 18 May, candidates who expressed strong criticism about Ukrainians in Poland (Slawomir Mentzen and Grzegorz Braun) came third and fourth respectively, gaining more than 21 percent of votes. During the campaign, they claimed Ukrainian refugees are a burden on Poland’s budget (despite evidence pointing to the contrary) and exploit the welfare system. Braun campaigned against what he called “the Ukrainization of Poland” and even tore down a Ukrainian flag from a city hall building. 

The two remaining candidates for presidency have also proposed policies targeting Ukrainians in Poland. Rafał Trzaskowski, the candidate for the ruling centrist Civic Platform party, called to stop child benefit payments to Ukrainian refugees who do not work in Poland. Meanwhile, the candidate endorsed by the opposition PiS (Law and Justice) party, Karol Nawrocki, said Ukrainian refugees should be placed at the end of the queue when applying for public services including medical care or school places.  

Against the backdrop of this election campaign rhetoric, an ISD investigation reveals that pro-Kremlin and Russian actors have launched a cross-platform campaign aimed at stoking negative sentiment towards Ukrainians in Poland. By discrediting Ukrainian migrants and refugees in Poland, they aim to undermine support to Ukraine and incite societal divisions.  

Methodology 

To identify specific posts and narratives, ISD monitored more than 4,000 accounts on X (formerly Twitter) during April and May 2025, filtering content to focus on Ukrainian refugees and the upcoming elections in Poland. Analysts identified overlapping content by manually examining content from several pro-Kremlin Telegram channels (in Russian) and from the Pravda network websites in both Polish and English. The Meta Content Library was used to find posts that had been simultaneously published across multiple pages and/or groups on Facebook. 

ISD identified three main narratives targeting Ukrainian migrants and refugees in Poland, which are discussed in greater depth below.  

Russia-aligned Operation Overload falsely accuses Ukrainian refugees of planning terrorist attacks 

Ahead of the first round of presidential elections in May, a series of posts from anonymous accounts on X alleged Ukrainian refugees were planning terrorist attacks in Poland on election day. These posts were identified by ISD as a part of a Russia-aligned information operation known as Operation Overload or ‘Matryoshka’, which has previously targeted the Paris 2024 Olympic Games and the February 2025 German elections. 

Between 22 April and 14 May, seven posts appeared on X, with at least five of them replicated on Bluesky. As of 14 May, the posts on X garnered a combined total of more than 654.1k views and 5,725 engagements (likes and shares). Only one of the Bluesky cross-posts received any engagement (one like), with most posts later removed by the platform.  

Six of the seven X posts were published between 12 and 14 May (ahead of the first round of elections in Poland) and contained videos of law enforcement officers from the UK and France. The videos followed a common content pattern for Operation Overload – fake AI-generated audio of the supposed narrator – which stated that Ukrainian nationals had been arrested for planning terrorist attacks on the day of the first round of Polish election on 18 May. Text accompanying one post falsely claimed that up to 10 percent of Ukrainian refugees in Poland had links with terrorist organisations. Posts also alleged that news about potential attacks being planned by Ukrainians had been covered up.  Some posts were attributed to large European media organisations like the BBC, France24, Der Spiegel and Les Echos. 

 

A similar video, which appeared on 22 April, contained a fabricated news story about the arrest of a Ukrainian refugee for planning a poison gas attack on election day. The video alleged the individual was protesting “a lack of Poland’s involvement in the military conflict in Ukraine”. No such arrest was reported by Polish authorities or media outlets. Other posts that week spread claims about terrorist threats and claimed Polish authorities were unable to secure the vote – similar to narratives from the same network released ahead of the German federal elections in February. 

Other tactics associated with Operation Overload are the inclusion of QR codes and the tagging of multiple media, government and international organisations. Previous studies have suggested the aim of this tagging tactic is to further increase the visibility of content and force tagged organisations to spend time on fact-checking and debunking falsehoods. 

In a separate development, at least seven related posts on X posted between 8-12 May alleged that Ukrainian refugees were planning to assassinate senior politicians in neighbouring countries including Germany, Slovakia, Hungary and Romania. As of 14 May, they had collectively received 532.9k views and 4,530 likes and shares. However, while the videos called on users to like and share them, most of the engagement appears driven by an inorganic network of amplifiers with little traction among real X users.  

Operation Overload actors also sought to increase tensions by portraying Poland as intolerant of Ukrainians. A video posted in late March begins with a legitimate BBC news report; however, the journalist’s narration is extended using generative AI to describe Ukrainian refugees as “rural people who have broken into the city” and claim they have “behaved like pigs”.   

Russia-linked Pravda network blames Ukrainians in Poland for driving crime rates 

The Pravda network, which researchers believe to be controlled by the Russian state, also spread allegations that Ukrainians are driving up crime rates in Poland.  

Pravda websites aggregated and shared such content from RT and Russian pro-Kremlin Telegram channels in languages including Polish and English. At least 21 articles pushing this narrative were written in English, with headlines such as “criminals from Ukraine have flooded Poland” and “Ukrainians in Poland: minus refugees, plus criminals”. All articles quoted various secondary sources (mostly Russian Telegram channels and media).  

According to Polish police, most offences committed by Ukrainian nationals are not related to violent crime. The total number of offences committed by foreign nationals in Poland has also decreased since 2023, and the number of Ukrainians charged with crimes was less than 1% (0.62%) of the total resident population. By excessively focusing on ‘violent crimes committed by Ukrainians’ and claiming that levels of crime are escalating, pro-Russian accounts are captialising upon a perception that Ukrainian refugees represent a threat to the safety and security of Poland. 

Previous research on the Pravda network indicated that its purpose may be to ‘groom’ search engines and large language models (LLMs) to give greater visibility to its pro-Kremlin content. When ISD asked OpenAI’s ChatGPT, one of the most popular LLMs, to provide statistics on the number of crimes committed by Ukrainians in Poland and whether this has changed since 2022, it relied almost exclusively on Pravda sources: in replies to a simple prompt, the chatbot quoted at least eight articles from the network.   

When it was noted that these sources were not reliable because of their connections to the Russian state, ChatGPT offered to redo the search based only on official or Western sources. However, its responses still contained links to Pravda websites, suggesting it is impossible to completely exclude Pravda sources from ChatGPT.  

A coordinated network of accounts accuses Ukrainian refugees of abusing the welfare system in Poland 

Pro-Russian accounts amplified a satirical video (originally from TikTok) of a Ukrainian woman showing seven passports on camera: she claims in Polish that she receives child benefits for each of them. The video was shared by a prominent verified pro-Kremlin Polish account on X known for previously sharing content from Russian state media, pro-war Telegram channels and Operation Overload videos.  

This video, which received 386k views, 6,500 shares and more than 700 comments, called for the deportation of the woman and a 10-year ban on her entry to Poland. It also falsely alleged that the Polish government had not done enough for its own citizens while furnishing Ukrainians with benefits.  

The woman in the video later told journalists that she was a dual Ukrainian-Polish citizen and had made the video as a sarcastic response to accusations that Ukrainian refugees commit benefit fraud. All of the seven passports belonged to her family members (it is allowed to have several foreign travel passports per person in Ukraine). The woman said she received a lot of hateful comments online