Accounts linked to the Russian military reached more than 500,000 people with far-right messaging during the early days of the Ceuta migration crisis, according to an analysis by the counter-disinformation group 411. The finding shows how a coordinated network of accounts spread misleading information during one of the worst migration shocks Europe has seen in years.

The crisis began on 31 July 2026, when about 49,000 people tried to cross from Morocco into the Spanish city of Ceuta overnight. Ceuta is a small piece of Spain located on the coast of North Africa, right next to Morocco. Because it is European territory on the African continent, it is a place where many people try to cross into Europe. Over several days, about 72,000 migrants entered the city, according to The Guardian. Reuters reported that more than 70 people died by 2 August. Euronews reported that before the mass crossing, videos on social media had promised people an easier route into Europe.

How the Misinformation Spread

The misinformation campaign studied by 411 began on 1 August, the day after the first mass crossing. The group looked at about 4.5 million social media posts and found that far-right messages were shared in seven languages, reaching more than 720,000 views in just six hours on that one day. The accounts described the events as a planned "assault" and claimed that authorities were secretly allowing it to happen. Some posts also included anti-Muslim or antisemitic conspiracy theories.

One source of the propaganda was Rybar, a Telegram channel connected to Russian intelligence. Its parent company has been sanctioned (officially punished) in Europe. A network of "repeater" accounts then copied and spread Rybar's posts more widely. Some of these accounts were tied to the Pravda network, a group that spreads Russian government propaganda around the world. The Guardian previously reported on the Pravda network's English-language websites.

Ukraine's government noticed the campaign early. On 31 July, Ukrainian Foreign Minister Andrii Sybiha said Russia was using photos from Ceuta for a propaganda campaign across Europe, as reported by Ukrainian Pravda and Liga.net. The Atlantic published an analysis on 2 August titled "The Far Right Is Distorting Ceuta," looking at how far-right narratives shaped the crisis.

Two Separate Problems at Once

What makes Ceuta unusual is that two different things were happening at the same time, and each one made the other worse.

On one side, social media rumors made young Moroccans believe the border was open. Reuters told the story of 16-year-old Ayoub El Abyad, who saw Instagram videos showing migrants crossing. 411's analysis found regular conversations between potential migrants sharing tips on how to make the crossing, mostly in the comments under viral Ceuta videos. This sharing seemed to come from ordinary people, not from one central account directing others.

On the other side, some far-right accounts called for nationalists to gather in Ceuta and "patrol" businesses and homes. Some of these calls appeared to be coordinated.

Saman Nazari, lead researcher at Brussels-based nonprofit Alliance4Europe, said the misinformation efforts after the Ceuta crisis appeared coordinated. He said groups spreading misinformation are more organized and powerful than they were several years ago.

The broader context here is that this case shows how Russia's information-warfare system has grown more sophisticated. Rybar produced the content. Repeater accounts spread it across platforms and languages. And the real events on the ground — people filming themselves crossing the border — gave the propaganda real footage to work with. The UK government has already sanctioned parts of this network. What the Ceuta crisis shows is how fast this system can shift to a new migration emergency, reaching hundreds of thousands of people within hours.

The Ceuta case also raises a question that 411's data cannot fully answer: whether the social media rumors that prompted people to migrate were completely organic, or whether outside actors helped start or speed them up. The analysis found that the migrant-side sharing came from small, anonymous accounts, which looks like normal activity. But that does not rule out the possibility that influence operations were designed to look like ordinary people.

For European policymakers, the Ceuta episode is a challenge that existing laws are not built for. The EU's Digital Services Act requires large online platforms to be transparent about how they handle content, but 720,000 views in six hours across seven languages is faster than most content moderation systems can respond to. The calls for nationalist "patrols" in Ceuta move the threat from online misinformation into the possibility of real-world violence. Whether that escalation actually happened is not covered in the available reporting, but the coordination 411 detected in those calls deserves attention.