The 2026 Midterms: What Foreign Influence Operations Have Been Documented So Far

On 20 October, a video appeared on X showing a woman accusing a Democratic Senate candidate in Texas of sexual assault. The account that posted it used a real man’s name and photographs, had been created weeks earlier and had almost no followers. Within minutes a cluster of bot-like accounts shared it. About twelve hours later, three large accounts reshared one of the videos, one of which had been soliciting paid partnerships. By the next day the threat intelligence firm Alethea estimated one video had drawn around 857,000 views. Researchers at Graphika and Clemson University’s Media Forensics Hub attributed it to Storm-1516, a Russian operation that specialises in exactly this kind of staged smear.

That episode is a useful lens on the 2026 midterms foreign influence landscape as the vote on 3 November approaches. It shows the method, the speed and the dependence on a few large amplifiers. This analysis sets out what has been documented in open sources so far, separates it from what is claimed but unverified, and identifies what to watch in the days around the vote. It deliberately does not assess the domestic political consequences of the federal changes described below, which remain contested.

The documented operations

The table summarises operations publicly documented by researchers, platforms or companies between September and late October 2026. “Measured reach” reflects what was reported, not independently verified impact.

Sources listed at the end. Confidence follows our analytic standards and reflects source quality and corroboration.

Matryoshka: quantity over quality

Matryoshka’s signature is the counterfeit news artefact: a video or front page that borrows the logo and visual identity of a trusted outlet. In this cycle it has impersonated CNN, ABC, CBS News and others, and fabricated celebrity clips. In one documented case, a video branded with the Mother Jones logo falsely claimed that the Democratic National Committee had paid a television executive to promote “gender transition among children”. Some Matryoshka products also claim that reporting on Russian disinformation is itself fake, a reflexive move designed to inoculate audiences against exposure.

The operation’s breadth is striking: Democratic candidates in more than half of all Senate races and most governor’s races. Its depth is not. Researchers repeatedly describe the same pattern: a burst of views in the first hour, followed by a flatline, with the amplifying accounts dormant for years, nearly follower-less and generating almost no genuine reposts or likes.

Storm-1516: the smear and the laundromat

Storm-1516 works differently. Instead of flooding the zone, it produces a small number of high-impact fabrications, often staged with actors whose faces may be swapped with AI, and then relies on laundering: getting the content picked up by large, authentic-looking accounts that give it reach and apparent credibility. The 20 October video followed that sequence precisely. It is the same playbook the operation used in 2024 against the Democratic vice-presidential candidate and with fake videos purporting to show ballots being destroyed, as described in our analysis of the influence operation kill chain.

Darren Linvill of Clemson has described the consistent method: seed a false claim on social media or a fake news or think-tank site, then push it through state media, bot accounts or paid influencers. Alethea’s Lisa Kaplan has argued that in the final stretch the aim is less to change minds than to inflame anger or fear and so affect who turns out.

Doppelgänger: patient infrastructure

Alethea’s 16 October report on a new Doppelgänger wave is notable less for its US content, which the public summary does not detail, than for its patience. The cloned news sites used in the wave were built around 17 months before it launched, and some of the fabricated articles are already indexed by Google. Alethea also warns of a newer risk: AI assistants citing those fake articles when users ask about the elections. Russian information operations have long played the long game, as our case study of Project Lakhta shows; Doppelgänger now appears to be optimising for search engines and chatbots as well as for people.

Who is being targeted, and why

The publicly documented fabrications in this cycle overwhelmingly target Democratic candidates. On 21 October, the senior Democrats on the congressional intelligence committees, Senator Mark Warner and Representative Jim Himes, described a classified intelligence report received the day before as showing Russia targeting Democrats and Ukraine supporters in both parties. They did not name the Republican candidates concerned, and the assessment itself is not public, so the “both parties” element cannot be independently assessed.

The pattern is consistent with a long-standing assessment: Moscow’s primary interest is Ukraine, and it acts against politicians of any party who support Kyiv. Linvill’s reading is that Russian operations mostly amplify beliefs people already hold rather than persuading them from scratch. That matters for defence: the most effective fabrications are the ones that confirm what a target audience already suspects about the other side.

China and Iran: less visible, less documented

Open-source documentation of Chinese and Iranian activity aimed specifically at the midterms is thin compared with Russia.

• China. Warner and Himes described Chinese efforts as more targeted, often at local or smaller races, but identified no specific operations. Recent public prosecutions involving Chinese influence in US local politics concern conduct from earlier election cycles. Researchers have also flagged China-based commercial AI tools designed to make influence content more convincing. None of this amounts to a documented 2026 midterm campaign.
• Iran. Iran has been in open conflict with the United States since late February 2026, and its documented information operations this year have focused on that war. On 8 October OpenAI reported disrupting an Iranian operation, “Bogus Bylines”, in which seven fake journalist personas pitched nearly 100 articles about the US-Iran conflict to around a dozen outlets. Himes and some analysts have suggested that Iran could sway US voters through pressure on oil prices, but the evidence of electoral intent rests on anonymous sourcing and is better treated as a hypothesis than as a documented influence operation.

AI: an accelerant, not a revolution

Generative AI is present in almost every documented operation this cycle, from face-swapped actors to synthetic celebrity clips and AI-drafted articles. But the evidence so far supports a more measured conclusion than the headlines. OpenAI’s October report on “false front” operations found that AI-enabled campaigns closely resemble pre-AI ones: the technology makes parts of the workflow cheaper and faster, and is sometimes used mainly to write internal reports inflating the operators’ own success. The operations with the greatest reach were those that got content into real media outlets, not those that produced the most content.

In other words, AI has lowered the cost of production. It has not solved the problem of distribution. That is why Storm-1516 still depends on large human accounts to make a fake travel, and why Matryoshka still needs bots to make its numbers look impressive.

What has not been documented

Two absences are as important as the findings. First, officials and lawmakers across the spectrum have said there is no evidence of foreign attempts to alter ballots or compromise voting machinery in this cycle. Warner was explicit that disinformation is expected but that no interference with voting machinery has been seen. Second, there is no public evidence that any of these operations has changed votes. Researchers are careful to say they measure exposure and engagement, not electoral effect.

This distinction is not academic. One of the aims of influence operations is to make citizens believe the system itself is compromised. Overstating the effect of foreign operations can do part of their work for them.

The defensive posture

The federal apparatus built after 2016 has changed substantially since early 2025. The main documented changes, with the rationales given at the time where one was stated, are:

• February 2025: the FBI’s Foreign Influence Task Force was disbanded, with the stated aim of redirecting Justice Department resources towards cartels and transnational criminal organisations.
• March 2025: CISA scaled back parts of its election-security work and support for the election information-sharing centre, amid wider staff reductions.
• April 2025: the State Department closed its counter foreign information manipulation office; the Secretary of State argued its work had become entangled with censorship.
• Mid-2025: ODNI was restructured and its Foreign Malign Influence Center ceased to exist as a standalone body.
• Funding: federal election-security grants fell from $55 million in 2024 to $15 million in 2025, before being partly restored to $45 million for 2026.
• Autumn 2026: the Defense Secretary directed Cyber Command and defence intelligence agencies to prioritise election defence, and Himes described intelligence sharing with Congress under the current Director of National Intelligence as a “sea change”. Several legally required pre-election threat assessments nonetheless remained outstanding as of 21 October.

Interpretations of these changes diverge sharply. Supporters argue that parts of the previous apparatus strayed into policing domestic speech and that resources were better spent elsewhere. Critics, including the Brennan Center and former intelligence officials writing in Just Security, argue that the cuts have shifted the burden to state and local officials, three-quarters of whom told a Brennan Center survey they had received no extra resources to compensate. What is not in dispute is the practical consequence for this cycle: much of the public detection and attribution described in this analysis has come from private firms, academic researchers and platforms rather than from government.

Implications for cognitive defence

1. Treat media logos as decoration, not verification. Matryoshka’s entire method relies on borrowed branding. Check whether the outlet itself published the item.
2. Distrust the perfect scandal. A shocking accusation against a candidate, surfacing late, from an account with no history, fits the Storm-1516 pattern almost exactly.
3. Read view counts sceptically. A large number with few genuine replies or reposts is a signal of inflation, not popularity.
4. Large accounts are the real vulnerability. The decisive step in the Storm-1516 chain is the reshare by an influential account. Influencers and journalists are the last line of defence.
5. Ask the chatbot where it got that. With fake articles now indexed by search engines, AI assistants can repeat them. Check the cited source, not just the answer.

Indicators to watch around Election Day

• Videos purporting to show ballots being destroyed, altered or discarded, especially in swing states, as Storm-1516 produced in 2024.
• Fake notices from election offices or impersonated local media about changed polling places, hours or procedures.
• Fabricated “leaks” or “intelligence” claiming foreign hacking of voting systems during the count, which would serve to undermine confidence in the results whatever they are.
• Sudden synchronised posting waves from dormant accounts, the signature of both Matryoshka and Doppelgänger.
• Reuse of the same infrastructure against Israel’s election on 27 October, which Doppelgänger is targeting in parallel, as a preview of techniques likely to be turned on the US.

For official voting information, the National Association of Secretaries of State directs voters to their state and local election offices through its TrustedInfo initiative.

Confidence and limitations

This assessment relies on open sources available as of 26 October 2026: reports from Alethea, Graphika and OpenAI, academic researchers, platform announcements and reputable news reporting. Some reports could only be consulted through summaries and secondary coverage. Attribution to Russian operations is high where several independent research teams concur. Attribution of X’s takedown rests on the platform’s own claims. Statements about classified assessments are second-hand and cannot be verified. Views and engagement figures are estimates, often affected by the very inflation they describe. Finally, this analysis covers foreign activity only: domestic actors who amplify foreign content, knowingly or not, play a decisive role but fall outside its scope. The situation is moving quickly and this analysis will not capture developments after its publication date. For context on how a previous cycle was later documented, see Russian interference in the 2020 US election.

Frequently asked questions

Is Russia interfering in the 2026 midterms?

Several independent research teams have documented Russian influence operations targeting the midterms, chiefly Matryoshka, Storm-1516 and a new Doppelgänger wave, using fabricated videos, fake news front pages and cloned news sites. There is no public evidence of interference with voting systems.

What is Storm-1516?

A Russian influence operation known for producing staged, often AI-assisted videos making false accusations against politicians, then spreading them through fake accounts and large influencer accounts. It was active in the 2024 US election and has been attributed to new fabrications in 2026.

Are China and Iran targeting the midterms?

Lawmakers briefed on classified intelligence say China is targeting some local and smaller races, but no specific operations have been made public. Documented Iranian operations this year have focused mainly on the US-Iran conflict rather than the midterms specifically.

How can I spot a fake election video?

Check whether the outlet whose logo appears actually published it, look at the posting account’s age and history, compare the view count with genuine engagement, and be especially cautious with shocking accusations or “evidence” of fraud that appears close to or on Election Day.

Sources

1. NPR / Bond, S. (23/10/2026, updated 26/10/2026). Russia steps up election influence efforts in final stretch of midterms (npr.org, via apr.org)
2. Alethea (16/10/2026). Operation Doppelgänger: inside the Russian influence network targeting the US midterms, Israel’s election, and France’s 2027 race (alethea.com)
3. Kyiv Post (18/10/2026). Russian bot farm uses AI and fake views to target US midterms, reporting a Bloomberg review (kyivpost.com)
4. Mother Jones (24/09/2026). How Russia is attacking the midterms with a Mother Jones deepfake (motherjones.com)
5. Al Jazeera (15/10/2026). X suspends 13,000 accounts, alleging foreign influence ahead of US midterms (aljazeera.com)
6. OpenAI (08/10/2026). Disrupting AI-enabled “false front” operations (openai.com)
7. Nextgov/FCW / DiMolfetta, D. (21/10/2026). Russia targets Democrats and Ukraine supporters ahead of midterms, top intel lawmakers say (nextgov.com)
8. Just Security / O’Neill, B. (20/10/2026). Foreign threats to U.S. elections are maturing faster than the defenses (justsecurity.org)
9. Brennan Center for Justice / Lurie, K., & Kharazian, Z. (02/07/2026). Threat of foreign influence on U.S. elections remains as federal defenses recede (brennancenter.org)