Investigation: Russia-aligned campaigns amplify negative sentiment towards Ukrainians in Poland ahead of a decisive presidential vote 

30 May 

Russia-aligned actors are inflaming and exploiting anti-Ukrainian refugee sentiment in Poland ahead of the second round of presidential elections on 1 June. This ISD Investigation reveals a cross-platform effort involving elements of Russia-aligned information operations such as Operation Overload and Pravda/Portal Kombat. These operations use a variety of deceptive tactics to disseminate pro-Kremlin messaging, including impersonation, AI-generated content (AIGC) and coordinated amplification.  

---

Key findings 

• Throughout the election campaign period, Russian and pro-Russian actors have inflamed negative sentiment towards Ukrainians in Poland (the largest migrant group in the country).  

• Russia-aligned campaign Operation Overload (also known as Matryoshka) spread false content on X (formerly Twitter) and Bluesky accusing Ukrainian refugees of preparing terrorist attacks targeting the elections in Poland, with posts receiving more than 654,100 views and 5,725 likes and shares on X. 

• A parallel Operation Overload effort falsely claimed Ukrainians were plotting attacks on leading politicians in neighbouring countries. This content garnered 533,000 views and 4,530 likes and shares on X, with the engagement again coming from an amplifier network. 

• ISD found that ChatGPT reproduces misleading claims from a Russian network of websites known as ‘Pravda’ or ‘Portal Kombat’, for example allegations that Ukrainians are responsible for rising violent crime rates in Poland. 

• A satirical video was picked up and spun by a pro-Kremlin influencer to promote the claim that Ukrainians are taking advantage of the Polish welfare system. This was spread through a coordinated network of Facebook pages and groups, and accounts on Telegram and X. These accounts called for the deportation of Ukrainian refugees, sparking a wave of online hate and threats. The influencer’s response received 161,500 views, 900 shares and 380 comments on Facebook alone, with many of the comments containing hateful and derogatory language. 

Key recommendations 

• Immigration has become highly contested in Polish election discourse. The government must remain alert to sustained efforts by Russia-aligned actors to promote negative sentiment towards Ukrainian migrants and refugees in Poland and take action to protect these vulnerable groups from targeted discrimination and attacks.  

• Platforms such as X must effectively implement their existing obligations under the EU’s Digital Services Act (DSA) to mitigate systemic risks to electoral integrity, as reinforced by the European Commission’s guidelines for Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs). 

• Considering the rapid spread of AI-generated content made to deceive, platforms need to clearly label AI-generated/synthetic and manipulated content, rather than leaving this to users (via Community Notes), and should reflect existing obligations and recommended measures under EU law. 

• The European Commission must expand sanctions enforcement on Russian entities to include aggregators that share content from restricted outlets. The EC should also maintain engagement with internet service providers (ISPs) to enforce existing EU sanctions on foreign information manipulation and interference (FIMI) actors more comprehensively. 

Introduction 

Ukrainians are the largest group of foreigners in Poland, accounting for 1.5-1.7 million of a total 38 million people, including migrants and refugees. The issue of migration, and therefore of Ukrainians’ presence, has become central to the presidential election campaign in Poland. A study by Polish NGO Res Futura found a sharp growth in anti-Ukrainian refugee sentiment on social media in Poland since the start of the electoral campaign. This study found that allegations of criminal activity featured in 41 percent of mentions of Ukrainian refugees. 

In the first round of elections on 18 May, candidates who expressed strong criticism about Ukrainians in Poland (Slawomir Mentzen and Grzegorz Braun) came third and fourth respectively, gaining more than 21 percent of votes. During the campaign, they claimed Ukrainian refugees are a burden on Poland’s budget (despite evidence pointing to the contrary) and exploit the welfare system. Braun campaigned against what he called “the Ukrainization of Poland” and even tore down a Ukrainian flag from a city hall building. 

The two remaining candidates for presidency have also proposed policies targeting Ukrainians in Poland. Rafał Trzaskowski, the candidate for the ruling centrist Civic Platform party, called to stop child benefit payments to Ukrainian refugees who do not work in Poland. Meanwhile, the candidate endorsed by the opposition PiS (Law and Justice) party, Karol Nawrocki, said Ukrainian refugees should be placed at the end of the queue when applying for public services including medical care or school places.  

Against the backdrop of this election campaign rhetoric, an ISD investigation reveals that pro-Kremlin and Russian actors have launched a cross-platform campaign aimed at stoking negative sentiment towards Ukrainians in Poland. By discrediting Ukrainian migrants and refugees in Poland, they aim to undermine support to Ukraine and incite societal divisions.  

Methodology 

To identify specific posts and narratives, ISD monitored more than 4,000 accounts on X (formerly Twitter) during April and May 2025, filtering content to focus on Ukrainian refugees and the upcoming elections in Poland. Analysts identified overlapping content by manually examining content from several pro-Kremlin Telegram channels (in Russian) and from the Pravda network websites in both Polish and English. The Meta Content Library was used to find posts that had been simultaneously published across multiple pages and/or groups on Facebook. 

ISD identified three main narratives targeting Ukrainian migrants and refugees in Poland, which are discussed in greater depth below.  

Russia-aligned Operation Overload falsely accuses Ukrainian refugees of planning terrorist attacks 

Ahead of the first round of presidential elections in May, a series of posts from anonymous accounts on X alleged Ukrainian refugees were planning terrorist attacks in Poland on election day. These posts were identified by ISD as a part of a Russia-aligned information operation known as Operation Overload or ‘Matryoshka’, which has previously targeted the Paris 2024 Olympic Games and the February 2025 German elections. 

Between 22 April and 14 May, seven posts appeared on X, with at least five of them replicated on Bluesky. As of 14 May, the posts on X garnered a combined total of more than 654.1k views and 5,725 engagements (likes and shares). Only one of the Bluesky cross-posts received any engagement (one like), with most posts later removed by the platform.  

Six of the seven X posts were published between 12 and 14 May (ahead of the first round of elections in Poland) and contained videos of law enforcement officers from the UK and France. The videos followed a common content pattern for Operation Overload – fake AI-generated audio of the supposed narrator – which stated that Ukrainian nationals had been arrested for planning terrorist attacks on the day of the first round of Polish election on 18 May. Text accompanying one post falsely claimed that up to 10 percent of Ukrainian refugees in Poland had links with terrorist organisations. Posts also alleged that news about potential attacks being planned by Ukrainians had been covered up.  Some posts were attributed to large European media organisations like the BBC, France24, Der Spiegel and Les Echos. 

 

A similar video, which appeared on 22 April, contained a fabricated news story about the arrest of a Ukrainian refugee for planning a poison gas attack on election day. The video alleged the individual was protesting “a lack of Poland’s involvement in the military conflict in Ukraine”. No such arrest was reported by Polish authorities or media outlets. Other posts that week spread claims about terrorist threats and claimed Polish authorities were unable to secure the vote – similar to narratives from the same network released ahead of the German federal elections in February. 

Other tactics associated with Operation Overload are the inclusion of QR codes and the tagging of multiple media, government and international organisations. Previous studies have suggested the aim of this tagging tactic is to further increase the visibility of content and force tagged organisations to spend time on fact-checking and debunking falsehoods. 

In a separate development, at least seven related posts on X posted between 8-12 May alleged that Ukrainian refugees were planning to assassinate senior politicians in neighbouring countries including Germany, Slovakia, Hungary and Romania. As of 14 May, they had collectively received 532.9k views and 4,530 likes and shares. However, while the videos called on users to like and share them, most of the engagement appears driven by an inorganic network of amplifiers with little traction among real X users.  

Operation Overload actors also sought to increase tensions by portraying Poland as intolerant of Ukrainians. A video posted in late March begins with a legitimate BBC news report; however, the journalist’s narration is extended using generative AI to describe Ukrainian refugees as “rural people who have broken into the city” and claim they have “behaved like pigs”.   

Russia-linked Pravda network blames Ukrainians in Poland for driving crime rates 

The Pravda network, which researchers believe to be controlled by the Russian state, also spread allegations that Ukrainians are driving up crime rates in Poland.  

Pravda websites aggregated and shared such content from RT and Russian pro-Kremlin Telegram channels in languages including Polish and English. At least 21 articles pushing this narrative were written in English, with headlines such as “criminals from Ukraine have flooded Poland” and “Ukrainians in Poland: minus refugees, plus criminals”. All articles quoted various secondary sources (mostly Russian Telegram channels and media).  

According to Polish police, most offences committed by Ukrainian nationals are not related to violent crime. The total number of offences committed by foreign nationals in Poland has also decreased since 2023, and the number of Ukrainians charged with crimes was less than 1% (0.62%) of the total resident population. By excessively focusing on ‘violent crimes committed by Ukrainians’ and claiming that levels of crime are escalating, pro-Russian accounts are captialising upon a perception that Ukrainian refugees represent a threat to the safety and security of Poland. 

Previous research on the Pravda network indicated that its purpose may be to ‘groom’ search engines and large language models (LLMs) to give greater visibility to its pro-Kremlin content. When ISD asked OpenAI’s ChatGPT, one of the most popular LLMs, to provide statistics on the number of crimes committed by Ukrainians in Poland and whether this has changed since 2022, it relied almost exclusively on Pravda sources: in replies to a simple prompt, the chatbot quoted at least eight articles from the network.   

When it was noted that these sources were not reliable because of their connections to the Russian state, ChatGPT offered to redo the search based only on official or Western sources. However, its responses still contained links to Pravda websites, suggesting it is impossible to completely exclude Pravda sources from ChatGPT.  

A coordinated network of accounts accuses Ukrainian refugees of abusing the welfare system in Poland 

Pro-Russian accounts amplified a satirical video (originally from TikTok) of a Ukrainian woman showing seven passports on camera: she claims in Polish that she receives child benefits for each of them. The video was shared by a prominent verified pro-Kremlin Polish account on X known for previously sharing content from Russian state media, pro-war Telegram channels and Operation Overload videos.  

This video, which received 386k views, 6,500 shares and more than 700 comments, called for the deportation of the woman and a 10-year ban on her entry to Poland. It also falsely alleged that the Polish government had not done enough for its own citizens while furnishing Ukrainians with benefits.  

The woman in the video later told journalists that she was a dual Ukrainian-Polish citizen and had made the video as a sarcastic response to accusations that Ukrainian refugees commit benefit fraud. All of the seven passports belonged to her family members (it is allowed to have several foreign travel passports per person in Ukraine). The woman said she received a lot of hateful comments online since her video was shared by pro-Russian accounts. She lodged the complaint with the police due to personal attacks and arson threats online.   

This video with identical text was shared on Facebook in both Polish groups and by individual accounts, receiving at least 161.5k views, 900 shares and 380 comments. It was also reposted in English and in Russian on X and Telegram.  

Subsequent posts referencing this video spread false information that Ukrainians automatically receive benefits in Poland based on their passport, with hateful remarks attacking Ukrainian refugees in the comment section. 

Recommendations 

ISD’s research shows that Russia-aligned information operations are promoting hateful narratives against Ukrainian migrants and refugees ahead of the second round of presidential elections in Poland, presenting them as a threat to Poland. These Kremlin-aligned actors actively exploit political discourse in Poland and may have an impact on the outcome of the election campaign. This type of propaganda weakens democratic discourse and presents real-life consequences for the lives and livelihoods of the more than 1.5 million Ukrainians in Poland. 

For governments: 

• Governments, political parties, platforms and other relevant stakeholders should remain vigilant to coordinated influence operations, including sustained efforts by Russian actors to foster negative sentiment and undermine public support for Ukrainian refugees in Poland and across the EU.  

• It is vital to institutionalise structured information exchange before, during, and after elections, in line with the European Commission’s Guidelines for VLOPs and VLOSEs on mitigating systemic risks to electoral processes. This includes coordination between civil society organisations, regulators, electoral authorities, platforms, researchers and fact-checkers to ensure timely identification and response to domestic as well as cross-border influence campaigns.  

• Governments must create robust avenues for ongoing interaction between oversight bodies and the research community to support the continuous exchange of knowledge related to threats facing electoral systems and the effectiveness of current strategies aimed at addressing them. 

• Where feasible, insights should be shared internationally to strengthen democratic resilience and facilitate a unified response to foreign information manipulation and interference. This can be achieved through mechanisms including the EU’s Rapid Alert System or the G7 Rapid Response Mechanism. 

• The Polish government has a responsibility to protect vulnerable groups, including refugees and ethnic minorities, from targeted online abuse and hate campaigns. Under the Charter of Fundamental Rights of the EU and the Polish Constitution, it must enforce DSA obligations (together with the EC), such as requiring the largest platforms to assess and mitigate systemic risks to fundamental rights, including risks related to the dissemination of illegal hate speech (Articles 34–35). This also entails supporting the EU Code of Conduct on Countering Illegal Hate Speech Online, which complements these obligations. 

• National efforts should include investing in national media literacy and pre-bunking programs at educational institutions and workplaces. Other measures include strengthening the capacity of law enforcement and relevant public institutions to recognise and appropriately respond to online harms targeting vulnerable groups, in cooperation with platforms and civil society. 

For the European Union: 

• The European Commission should expand the enforcement of sanctions on Russian entities to include aggregators like the Pravda network which share content from restricted outlets. This will also require maintaining sincere engagement with internet service providers (ISPs) to enforce existing EU sanctions on FIMI actors more comprehensively. 

• The European Commission and Parliament should consider stronger transparency and accountability rules for influencer activity, especially given their increasing use in FIMI campaigns. While influencers can serve as key vectors for hostile state propaganda to enter mainstream discourse, their activity is not comprehensively regulated, particularly when acting outside formal commercial arrangements. It is essential that upcoming legislative processes such as the Digital Fairness Act or Advertising Code of Conduct address this vulnerability. 

For industry: 

• VLOPs must clearly label AI-generated and manipulated content, rather than relying on user-led initiatives such as Community Notes. This is a requirement under the DSA’s risk mitigation (Article 35) and transparency (Article 42) obligations and is reinforced by the EU AI Act’s provisions on disclosure and watermarking of synthetic media (Article 50). Once Poland passed legislation implementing DSA provisions, the designated Polish Digital Services Coordinator (DSC) and the European Commission should scrutinise platform compliance and apply regulatory pressure to ensure these obligations are met. Until a national DSC is designated, the Commission has the power to undertake such investigations.  

• Under the EU’s Digital Services Act (DSA), and additional guidance from the European Commission, VLOPs like X are required to fully carry out their responsibilities to address widespread threats to democratic processes stemming from their services. This includes developing crisis protocols that ensure users are provided with verified, credible information in critical moments such as elections. These protocols should include surge capacity during high-risk events, improved coordination with authorities, and a balance between swift action and human rights safeguards. 

The sole responsibility for any content supported by the European Media and Information Fund lies with the author(s) and it may not necessarily reflect the positions of the EMIF and the Fund Partners, the Calouste Gulbenkian Foundation and the European University Institute.