Back Gigazine

Bluesky removed 8526 'state-sponsored public opinion manipulation accounts' in one year.

Gigazine • May 28, 2026

Bluesky has announced that it has removed 8,526 'state- public opinion manipulation accounts' since May 2025.

Since May 2025, we have removed 8,526 accounts on Bluesky that were involved in state- manipulation of public opinion. Of these, 4,907 were dealt with in 2026, which is twice the rate compared to last year. The tactic of using hijacked real accounts to spread propaganda is a strategy these attackers have used on other platforms for years, but this is the first time it has been observed on Bluesky. Many of the affected accounts were old and inactive, but some active accounts were also included. 1/3🧵

Bluesky removed 8,526 'state- public opinion manipulation accounts' in the year from May 2025. Since January 2026, they have removed 4,907 accounts, doubling their removal pace compared to 2025. In most cases, removal is carried out within a few hours of the initial post, and the average number of views before removal is kept to around 50. It appears that the manipulation of public opinion was carried out by hijacking existing accounts. While many of the hijacked accounts were old, dormant accounts, active accounts were also sometimes compromised. The account hijacking was not carried out through an attack on the Bluesky system, but rather through unauthorized access using 'credentials that had been leaked in a data breach.' To prevent account hijacking, Bluesky recommends the following measures: 'Use a strong password specifically for Bluesky, rather than reusing it for other services,' 'Use a password manager,' and 'Enable two-factor authentication.' To enable two-factor authentication in Bluesky, first click 'Settings,' then click 'Privacy and security.' Clicking 'Enable' to the right of 'Two-Factor Authentication (2FA)' will take you to the two-factor authentication settings screen.

Clicking 'Enable' to the right of 'Two-Factor Authentication (2FA)' will take you to the two-factor authentication settings screen.

May 28, 2026 10:24:00 in Web Service , Posted by log1o_hf

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Bluesky Accounts Compromised in Russian Disinformation Campaign A Russian influence campaign has hijacked hundreds of Bluesky accounts, primarily belonging to journalists and academics, to disseminate propaganda against Ukraine. Researchers from Clemson University identified the Moscow-based firm Social Design Agency (SDA) as responsible for this operation, which utilized real accounts instead of fake ones. Affected individuals reported unauthorized posts on their accounts, with at least 200 accounts confirmed compromised. Bluesky has removed 4,907 accounts linked to state-backed influence activities in 2026, a significant increase from the previous year. The compromised accounts were primarily older and dormant, although some active accounts were also affected. Bluesky clarified that their systems were not breached; rather, the hijacking occurred through leaked credentials. The campaign is part of a broader strategy known as Matryoshka, which involves impersonation and disinformation tactics. 2 sources 76

Extracted Entities

Bluesky removed 8526 'state-sponsored public opinion manipulation accounts' in one year.

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)