After  the beginning of a full-scale Russian invasion, Meta hid information about Ukrainian advertisers in the Facebook Political Ads Library. Although the rules for posting ads have not changed, Ukrainians get to see increasingly more Russian propaganda and posts with fraudulent content in their feeds.

OPORA analyzed active political ads in the Ukrainian segment of Facebook on April 4–5, and found a lot of harmful content.

Let's start with the post that first caught our eye and prompted us to explore the Political Ads Library in more detail. It is an ad for the newly created Tsumaki page that promotes the classic statements of Russian propaganda. However, they are in Ukrainian. Previously, similar publications were also captured by the Center for Information Security and Strategic Communications.

Such posts are designed to undermine trust for the authorities, international partners of Ukraine, and the Armed Forces of Ukraine. These pages use fake news, misinformation, and manipulation. They portray the authorities, the state, and society in a negative light, and raise doubts about their competence, capacity, or motives.

An example of Russian propaganda shared on Facebook

In addition to Russian propaganda, the Political Ads Library is expanding messages aimed at obtaining Ukrainian bank card data. The wrong-doers use phishing, a kind of online fraud intending to obtain confidential user data by imitating official messages, websites of well-known organizations, banks, or other companies.

We identified several dozen similar messages from different pages advertising the financial assistance options, imitating the design and name of the “Diia” app, or the state aid program “eSupport”.

All ads redirect you to Telegram channels that publish links to phishing sites imitating the web pages of the largest Ukrainian banks. While some of these websites have been blocked by the National Cybersecurity Coordination Center, others remain active. When the website is blocked, the user will receive a warning and cannot go directly to the page. 

Judging by the number of views of posts in the Telegram channels, thousands of Ukrainians fall for fraudulent resources every day with the help of Facebook ads. Although the ad texts often use the words "payments," "funds," "money" and the names of government programs, Facebook algorithms for ad verification do not identify them as fraudulent content. At the same time, the policy of the social network has separate rules for advertising financial services and loans, as well as for political ads.

It's important to keep in mind that while Facebook is responsible for properly moderating ads, users also need to be careful. OPORA encourages you to remain vigilant when engaging with ads, especially if it seems suspicious or promotes narratives similar to Russian propaganda. Do not click on dubious links and do not interact with unverified ads. It will help you protect yourself from fraud and other cyber threats.

Author: Robert Lorian