25 min of reading
25 min of reading
Campaign Out of Control: From Madrid to Warsaw – Who’s really behind the suspicious ads?
Thanks to the cooperation of an international analytical team, we have detected activities that may bear the hallmarks of a coordinated political campaign and a possible attempt to interfere in the democratic electoral process in Poland.
Thanks to the cooperation of an international analytical team, we have detected activities that may bear the hallmarks of a coordinated political campaign and a possible attempt to interfere in the democratic electoral process in Poland.
- The pages Wiesz jak nie jest and Stół Dorosłych promoted ads on social media during the election campaign. Their activity bears the hallmarks of external interference in the democratic process. We discovered strikingly similar profiles operating in Spain, and according to our findings, similar initiatives may have been carried out in other European countries as well.
- The trail behind these pages leads to Hungary, specifically to a company called Estratos, founded by two former liberal politicians – Ádám Ficsor and Viktor Szigetvári. This company was involved in campaigning during the Hungarian elections in 2019 and 2022.
- The Hungarian firm provides services for social organizations, including Polish ones, related to organizing fundraising campaigns and supplies them with software called Lunda, used for collecting donations. Estratos processes data obtained through this software, giving it access to information about donors who typically have well-defined political and ideological views.
- Estratos is part of the WPC Group, an international alliance that supports progressive political campaigns and social organizations.
- The NASK Institute reported possible external interference in the electoral process only on May 14, even though the ads had been running since April 10. The peak of their activity coincided – though not necessarily connected – with a drop in campaign spending by Rafał Trzaskowski’s official committee. Moreover, a video nearly identical to the one promoted by the two described profiles was initially shared by politicians from Civic Coalition (KO).
For more than a week, all of Poland has been buzzing over the issue of a mysterious campaign of political ads that promoted Rafal Trzaskowski and criticized his rivals Karol Nawrocki and Slawomir Mentzen. Nearly half a million zlotys were spent on promoting these ads, leading to accusations of attempts to illegally finance the election campaign. The NASK (the government body monitoring cyberspace) warned in its notice that the ads may have been paid for from abroad, although the Meta indicated that it had found no evidence of external interference.
And although in its notice NASK warned of possible external interference in our country, it turns out that Poland was not the only country that may have been the target of such a campaign. According to our findings, similar activities may also have been carried out in several other European countries. In our article we present the so far unknown side of the case.
In one of the videos that the NASK warned against, speakers accused Slawomir Mentzen of objectifying women and warned that voting for this candidate would contribute to restricting their freedom. Another clip urged people not to vote for Karol Nawrocki – arguing that he would not act independently, but instead would follow Jaroslaw Kaczynski’s orders. Another video accused Nawrocki of having ties to criminals and to gangsters, and followed hese accusations with the rhetorical question of whether this is the kind of president voters want].
Broken microphone of a pissed off Spanish pensioner
We have determined that the case of political advertisements on the fan pages of Wiesz Jak Nie Jest (You know How it is Not) and Stol Dorosłych (Adults’ Table) is not the only such case. We have spotted similar activities in another European country.
The profiles in question share many characteristics with at least two Spanish sites set up a month earlier. We identified confusingly similar accounts and domains named Micrófono Roto (Broken Microphone) and Pensionista Cabreado (Annoyed Pensioner). At first glance, it is clear that all four use an almost identical graphic template and follow a similar style.
They all publish content that is critical of right-wing parties or their leaders and positively portrays liberals – but the connections run much deeper than that. At a purely technical level, Micrófono Roto and the two Polish sites also share a favicon, a small image that appears in a browser tab and acts as the site’s logo or identifier.
We found the same logo on another Polish site – Tarcza Wschód Polska (East Shield Poland), which, to our knowledge, has not yet been used for any advertising campaigns so far.
The fact that all four sites use an identical favicon (which is also the Micrófono Roto logo) is by itself suspicious, but even more puzzling is that the file is hosted on all the sites in question at the exact same URL.
The file name “signal-2025-02-04-164150_005.jpeg” suggests that it was sent through the Signal application and received by a person who uploaded it to the Spanish site on February 4, 2025 – a day before the Spanish sites were registered and three weeks before the Polish ones were launched. The sites also share commonality in the fact that the same website builder, Wix, was used to create them.
The sites were created at a similar time. DNS analysis shows that the domains microfono-roto.com and pensionistacabreado.com were registered on March 22, 2025, and the domain tarczawschodpolska.pl – 5 days later. On the other hand, the aforementioned sites wieszjakniejest.pl and stoldoroslych.pl have been online since April 3, 2025.
Same code, different language
We also compared the source codes of Polish and Spanish websites, and found that they exhibit very high structural similarity. The websites wieszjakniejest.pl, microfono-roto.com, stoldoroslych.pl, tarczawschodpolska.pl and pensionistacabreado.com have identical scripts, class names and HTML structures generated by the Wix platform, suggesting that they were built using the same Wix template.
These sites are nearly indistinguishable at the layout/code level; only the textual content differs. This reduces the uniqueness of the sites and makes it easier to identify them as part of the same network or campaign. Given the uniform structure of the sites, there is a high probability that they are managed or created by the same entity or group. They may be part of a multilingual campaign with a different front-end message (the content you see on the site), but with an identical technical background.
Identical HTML skeletons generated by Wix for microfono-roto.com (left) and for wieszjakniejest.pl (right).
Hundreds of thousands of zlotys for advertising – both in Poland and Spain
Another similarity: all four sites, both the Spanish and including the Polish ones, were surprisingly active in publishing political ads on Meta platforms. If the Polish parties spent as much as €100,000 before the elections, the Spanish ones – even though it was not an election year in the country – invested €40,000 on promotion from February 8 to May 10, 2025. That’s more than the currently ruling Partido Socialista party is allocating (20,913 euros) and the same amount that the main opposition party, the Partido Popular, is spending on advertising (40,242 euros).
In one video, a narrator accuses right-wing politicians of cowardice and running away from problems. Another ad criticizes politicians Alberto Núnez Feijóo and José Maria Aznar for cynically utilizing the power outage that occurred on the Iberian Peninsula in April in their political struggle. Meanwhile another image accuses the Spanish right of having ties to Donald Trump
Who was really behind these campaigns? The three advertising profiles in the Meta system not only had a local administrator (in Spain or Poland), but also a second one who was located in the United Arab Emirates. In the case of the Polish sites, the UAE administrator was removed from the system when the first articles about the controversial ad campaigns began to appear.
Information about a UAE-based administrator may (but not necessarily) be the result of using a VPN (Virtual Private Network). Free versions of such networks often offer an access point located in the UAE (1, 2, 3). It could either be an attempt to cover the foreign tracks (if the administrator did not connect from Poland), or an attempt to remove information about the connection from a specific location (e.g., a specific place in Poland).
Who took part in the campaign? Video participants recruited by the Action Democracy Foundation
For now, on the search for those responsible for the advertising campaign in question, let’s return to Poland. Investigative journalists from Wirtualna Polska – Szymon Jadczak and Patryk Słowik – identified three people who appeared in videos published by the accounts Wiesz jak nie jest and Table of Adults. It was revealed that they were people invited to participate in the campaign by activists of the Akcja Demokracja foundation.
It is a non-governmental organization that purports to work for democracy, civil society and a “better, more just society.” In recent years, it has become well-known for its pro-frequency campaigns, conducted, for example, before the European elections. Also now, ahead of the presidential elections, the foundation has organized such activities.
In a conversation with WP, a representative of the board confirmed that AD members collected volunteers for the recordings and did so at the request of “people acting on behalf of a company that has been a provider of IT services to Akcja Demokracja for several years.” At the same time, the foundation disassociated itself from the profiles publishing the spots.
The foundation’s head is Jakub Kocjan, in the past a social assistant to Iwona Karolewska, a KO politician and MP. Among other things, he participated in a meeting organized by NASK concerning the “Parasol Wyborczy” project, a government initiative to secure elections against disinformation and cyber attacks.
Was it an external interference in the election?
The domain registrant for the domains wieszjakniejest.pl and stoldoroslych.pl is supposed to be an unidentified KFT organization with an address in the center of Warsaw. It may be an abbreviation for the Hungarian words korlátolt felelősségű társaság, the equivalent of a Polish limited liability company. The registration data for this company includes a phone number with a Hungarian area code (+36). A search with the help of the LocateFamily service linked this number to Ádám Ficsor, the CEO of DatAdat, a software and data company that works with political and social organizations.
DatAdat is the former name of the currently operating company Estratos Digital GmbH (changed in 2023). There also exists an Estonian company, DATADAT OÜ, registered on March 12, 2019, whose shares are distributed as follows: 80 percent belongs to Estratos Digital GmbH, and 10 percent each to Ádám Ficsor and Viktor Szigetvári.
WP journalists have determined that the aforementioned IT service provider for Akcja Demokracja is Estratos. The company’s website mentions that it works with NGOs and helps them organize fundraising campaigns. It also supplies Lunda software, which is used by various Polish NGOs, including Akcja Demokracja itself.
Hungarian services and Estratos in the shades
One of Estratos’ strategic partners is Action for Democracy (A4D). This is an American foundation that financially supports progressive NGOs around the world. Action for Democracy acknowledges that it is thanks to their grant that Estratos has built its organizational and IT capacity.
Estratos and A4D, however, are tied not only by their business partnership, but above all by the person of Gordon Bajnai, the former leftist prime minister of Hungary. Indeed, Estratos is headed by Ádám Ficsor, minister of special services in his government in 2009. A4D’s chairman, on the other hand, is another Hungarian, David Koranyi, who was at one time… Prime Minister Bajnai’s advisor on security and foreign policy.
Estratos and A4D, however, are tied not only by a business partnership, but above all by the person of Gordon Bajnai, the former leftist prime minister of Hungary. Indeed, Estratos is chaired by Ádám Ficsor, Minister of Civilian Intelligence Services in his government in 2009. A4D’s chairman, on the other hand, is another Hungarian, David Koranyi, who was at one time… Prime Minister Bajnai’s advisor on security and foreign policy.
Akcja Demokracja received money for its operations from Action for Democracy, according to the foundation 2023 financial report. Such grants also went to other Polish NGOs. Some of these entities use Lunda software in their fundraising activities. These include:
Thanks to the Lunda system Estratos thus has access to data about donors with usually well-defined political and ideological views. The company is under investigation by various state authorities in Hungary. The Hungarian Tax Office is investigating, or has investigated, suspected financial fraud, while the Hungarian Police are verifying, or have verified, suspected money laundering and embezzlement. It is worth mentioning here that in the current situation in Hungary, these departments may be used as an instrument of political struggle.
Controversy over DatAdat and campaigning in Hungary
Ádám Ficsor founded DatAdat after his departure from Hungarian politics. Thanks to the findings of investigative journalists from the VSquare portal, we now know that during the 2019 municipal elections campaign it used ads based on political targeting and reached Hungarian voters through the Ezalényeg news service. Three years later, it was also involved in Hungary’s parliamentary elections.
According to Vsquare, about 7.75 from roughly $9 million donated to Hungary by Action for Democracy eventually went to members of the DatAdat group or Oraculum 2020 Kft. In 2022 Hungary’s security services declassified a presentation which tells about the illegal processing of personal data and the concealment of sources of funding for political advertising campaigns.
A report by the NAIH, Hungary’s data protection authority, mentions the action of sending mass text messages to voters (p. 40), which is also reported by Nagy Gergely Miklós in an investigation awarded by Transparency-Soma. The action described took place during the 2022 parliamentary election campaign. According to the report, the order was performed by LINK Mobility Kft. but it was DatAdat that provided the list of numbers and the content of the messages (p. 42).
According to the NAIH’s latest report, published in 2024, no definitive evidence has been found to indicate that DatAdat is responsible for sending the SMS, while the entity that carried out the operation has not been identified. In the document, NAIH reports that there was a violation of RODO standards. DatAdat denied all accusations in a statement in 2022.
No up-to-date information is currently available regarding the investigation by the Hungarian Police, and nothing is known about any findings by the Tax Authority. The authorities are not responding to questions posed by the 24.hu portal on the matter.
The trail leads from Armenia to the US
Estratos and Lunda have one more thing in common – the WPC Group. On the official website we can read that this is an international alliance supporting progressive political campaigns and civic organizations. The entire network consists of 10 organizations and companies, and at least some of them are directly affiliated with Estratos. Estratos is also listed in the WPC Group’s privacy policy as the sole processor of personal data of the site’s users. Also in the information provided when registering the domain, we will find data tying the site to Estratos.
According to our findings, another entity featured on WPC Group’s website, The Public Agency, may have been involved in the suspicious advertising campaign. It was this company that may have been responsible for recording the videos, later published on the profiles of Wiesz jak nie jest and Stół Dorosłych.
The company was registered in Yerevan, Armenia in June 2023. According to the Armenian Public Register, the sole owner and shareholder is Aryan Keshishian. Public Agency’s profile on LinkedIn indicates only one employee, which is Arin Keshishian. To verify our findings we have attempted to contact.
Following the publication of the article, we received a response from Estratos’ CEO, who confirmed his cooperation with Arin Keshishian of The Public Agency on the advertising campaign.
American sources, meanwhile, show that Arin – referred to in some documents as Aryan – was paid for his work for Steve Bennett (a Democratic member of the California State Assembly) during the 2022 election campaign.
We also discovered that https://thepublic.agency/safezone/ leads to a system that allows the transmission of digital content. It allows the transfer of materials adapted for smartphones. Supported platforms are: YouTube, Facebook, TikTok and Instagram.
WPC Group’s footprints in Poland
According to our findings, at least four entities that are part of the WPC Group have operated in Poland. These are:
Meanwhile, in the tab describing the WPC alliance, which can be found on the website of the European Center for Digital Action, we can read that:
Members of WPC have worked on elections in more than four dozen countries, gathering knowledge of the tactics and strategies that work […] With confidence, we can say that no group of practitioners around the world has access to as much immediate knowledge on the intricacies of campaigns.
WPC is not an agency. Some of our members are firms and commercial enterprises (committed to work exclusively with progressive candidates and causes) and some, like ECDA, are nonprofits or social enterprises.
Who works at Estratos?
For DatAdat, which is today’s Estratos, works a Pole, Ewelina Kycia, who, by her own admission, helps NGOs raise funds. She does this by posting links to the Lunda site (that is, Estartos’ payment tool). Previously, journalists Szymon Jadczak and Patryk Slowik wrote about her role in this context on Wirtualna Polska.
Ewelina Kycia is associated with Estratos. She is also the author of a text about Poland featured in the magazine “Digital Progressive,” published by the European Center for Digital Action. Public records show that Kycia serves as Country Lead for Poland at DataDat (Estratos).
In 2023, Kycia participated in a webinar hosted by Mar Garcia of ECDA, which was also attended by another Pole, Paulina Gruda. During the introduction, Gruda was introduced as a specialist in paid advertising. Further analysis of publicly available information suggests that in April 2024 Gruda served as an advisor on digital campaigns at ECDA. According to Wirtualna Polska, it was she who, on behalf of Estratos, contacted Akcja Demokracja representatives – for help in filming the videos.
Ads, data and links – Estratos at the center of the network
Available digital evidence points to the involvement of Estratos and its affiliated organizations in election advertising related activities in Poland. Data from the Meta platform suggests that the person who uploaded and paid for the ads went through a full verification process in Poland. As such, it is plausible that local employees affiliated with Estratos or its partners may have been responsible for these activities. This, in turn, raises questions – though does not prejudge – about their handling of the payment process.
The webinar (in which Kycia and Gruda participated) was organized by the European Center for Digital Action, whose CEO is Mar Garcia Sanz. It was also she who led the online meeting. What’s more, it is at ECDA that Paulina Gruda works. It should be considered important information that ECDA is one of the organizations listed on the WPC website.
According to the Belgian Public Register, the director of the European Center for Digital Action (in addition to Mar Sanz) is also Ádám Ficsor, currently the owner of Estratos, the company formerly operating as DatAdat. Notably, ECDA is currently using the Lunda system (owned by Estratos) and the Action Network database (to which Estratos contributes data).
Both Akcja Demokracja and ECDA use templates provided by Action Network. Meanwhile, on its website, Estratos states that it acts as a reseller of Action Network’s Records Management Policy. This means that Estratos acts as an authorized intermediary for Action Network’s platform and offers its tools for organizing digital activities – such as petitions, email campaigns and event management.
This description also suggests that Estratos is responsible for managing the data and records related to the use of Action Network’s services. As a data processor, Estratos handles personal data on behalf of its clients (i.e., data controllers). At the same time, it ensures that its operations comply with data protection regulations, such as the General Data Protection Regulation (GDPR).
Estratos appears to serve a dual role – it is not only a distributor of Action Network’s services, but also the entity responsible for managing related data in accordance with applicable laws and regulations. There are other Polish organizations working with both Estratos and the Action Network platform, which we present on the connection map.
Estratos: we operate legally and in compliance with RODO
In a statement sent to us, Viktor Szigetvári, COO-CFO of Estratos Digital GmbH, conveys that the company operates transparently and in compliance with the law. He reports that the company complies with RODO standards and the sale of Action Network software licenses. He also stipulates that Estratos has not worked with Rafal Trzaskowski or any other candidate.
The company confirms that it is co-operating with Ewelina Kycia on the basis of a civil law contract. We also received information about the partnership and the commercial relationship existing between ECDA and The Public Agency company. Szigetvári admits that the company managed the indicated advertisements and took an active part in the creation of the profiles in question. Estratos declared that it is committed to maintaining the confidentiality of the data of those organizations on whose behalf the campaign was conducted.
The information about Estratos’ sale of the Action Network service license confirms our findings. At the end of the text, we attach the original text of the response sent to us.
Akcja Demokracja: “We have never cooperated with The Public Agency”.
In response to our questions, Akcja Demokracja reports: “We have never cooperated with The Public Agency, we have no contract with this entity. We cannot answer questions about the individuals listed here and below due to the data protection laws that apply to us.” Akcja Demokracja, meanwhile, confirmed that it has been working with Estratos since 2022. The company provides services of an IT and consulting type for them.
Influencers as a political campaign tool?
We already know that both Wiesz jak nie jest and Stół Dorosłych are sites linked to Estratos. We have also detected another site, existing as of April 29, 2025, that may be related to the whole case – zabierzglos.eu.
This site, too, was made using the Wix wizard, just like the previous ones. What’s more, all of the pages have the same server name pairs (Ali and Sid), which are responsible for redirecting the domain to an IP address.
The owner of a domain can set so-called nameservers for it, i.e. DNS servers that respond to queries directed to his domain. When using Cloudflare to manage the so-called DNS zone, the operator designates a pair of its servers (e.g. ali & sid). This is assigned to the domain when the domain is first configured in the Cloudflare panel. The pair of servers used to configure domains in a single account is usually the same. This pair cannot be changed, and there are at least 2500 possible configurations (as of 2013).
The zabierzglos.eu website is a domain established by the Fundacja Impuls dla Młodych, which ran a campaign under the same name (Zabierz Głos!). On its site, the organization declared that it was a non-partisan initiative promoting social justice, equal rights and sustainable development.
As part of the project, the foundation intended to pay influencers to post political posts. The editors of the popular science group Crazy Nauka also received an invitation for cooperation on May 9, 2025. According to their story, the message aroused their suspicion due to its generic appearance, lack of signature and spelling errors.
Influencers were used in a similar way during the recent presidential campaign in Romania, the first round of which was eventually invalidated due to suspicions of “external interference.” Because of these doubts, a representative of the Crazy Science team forwarded information about this proposal to the NASK, which responded to their notification.
The personal data on the Fundacja Impuls dla Młodych website is processed by companies we already know. In the privacy policy we will see the name Datadat OÜ, the former name of the Hungarian company Estratos. It is worth noting that the datad.at website is no longer operational. Moreover, a further data processor is Action Network. Payment processing (and thus – data acquisition) on zabierzglos.eu has been entrusted to Estratos Digital GmbH, which uses the Lunda system we described earlier for this purpose.
Where did KO politicians get the video with Big Bu used in Facebook ads?
NASK’s Center for Disinformation Analysis reported in a notice about possible interference in the election campaign only on May 14. We know from the Ministry of Digital Affairs’ release, however, that the case was detected as early as May 9, even though the ads shared by the Wiesz jak nie jest and Stół Dorosłych pages had been promoted on social media since April 10. Let us take a look at the timeline.
Back on April 28, 2025, the profiles of Koalicja Obywatelska politicians published a video criticizing Karol Nawrocki and his acquaintance with freak fighter and former gangster Wielki Bu (1, 2, 3, 4, 5, 6, 7, 8). They included: Cezary Tomczyk – Deputy Minister of Defense, Adam Szłapka – Minister of EU Affairs, and Slawomir Nitras, Minister of Sports and Tourism. The video shared by these politicians was strikingly similar to the one that the Wiesz jak nie jest profile promoted in the form of a Facebook ad from May 6 to 14. We found only minor differences between the two materials due to editorial changes.
Moreover, after NASK described the ads from the aforementioned profiles in the release as “external influence attempt,” more politicians affiliated with KO published this video about Wielki Bu on social media. This was noted by WP journalist Patryk Slowik, although the posts disappeared from the web soon after (1, 2).
It is worth noting that the period of the highest advertising activity of the profiles Wiesz jak nie jest and Stół Dorosłych coincided with a big drop in spending by Rafal Trzaskowski’s election staff. The chart below shows that after April 28, 2025, more money for the promotion of this candidate flowed from the accounts in question than from funds from the official, registered committee. However, the observed correlation does not necessarily imply a cause-and-effect relationship – it could be due to various factors, including those unrelated to the advertising campaign of the mentioned parties.
Was it legal?
During the electoral campaign before the first round of elections, advertising spots, prepared in cooperation with a foreign company, which interfered with the electoral process, found their way into the Polish infosphere. Our findings showed that the same pattern was used in political agitation in Spain. All of these activities were financed outside the official budgets of election committees and political parties.
Our findings so far also indicate that similar activities may also be carried out in other countries, but this still requires further verification. For a comment on the legality of such activities on Polish soil, we asked Szymon Osowski, president of Watchdog Poland:
“According to the Kodeks Wyborczy, election canvassing is publicly urging or encouraging people to vote in a certain way, including, in particular, to vote for a candidate of a specific election committee. In these ads there was encouragement to vote for a specific candidate or in a specific way.”
Our correspondent adds that any individual in Poland has the right to conduct canvassing, even without the consent of the election committee’s plenipotentiary. However, it must be a person and not a legal entity (e.g., a company or foundation), and the money used in the election campaign must come from Poland. In the case we are discussing, there are doubts about the fulfillment of these legal requirements.
Recall that since the ads promoting Rafal Trzaskowski and criticizing Karol Nawrocki and Slawomir Mentzen were clearly political, they had to go through verification of meeting community standards and through authorization for compliance with Meta (Facebook’s owner) regulations.
We add that company representatives explained that the administrator of both profiles has confirmed his identity and is located in Poland. We emphasize that the subject is the administrator, not the source of the funds themselves, which may have come from abroad. The platform did not raise objections to the ads, despite the lack of information about the sources of funding, false data on the pages linked to Meta’s accounts, and doubts about the nature of the message contained in the spots.
The case is being investigated by Polish authorities
There is no indication that a final resolution to the case can be expected any time soon. Above all, we do not know where exactly the nearly half a million zlotys allocated for the Polish ads came from. From the government’s information, we know that since May 10, this issue has been handled by the Internal Security Agency.
Our findings show that at a similar time to Poland, a similar scenario was also implemented in Spain, and perhaps in other countries as well.
Since we are committed to explaining this case as thoroughly as possible, all our findings to date, which we have written about in this article, as well as evidence that we could not publish for legal reasons, have been handed over to the relevant state authorities.
The article is the result of a joint effort by an international team of analysts, journalists and fact-checkers, coordinated by the Stowarzyszenie Demagog.
In addition to the authors, the team included Carlos Hernandez-Echevarria (Maldita Foundation), Kamila Koronska (Universiteit van Amsterdam), Jakub Kubś (independent OSINT researcher), Peter Benzoni (German Marshal Fund and Alliance for Securing Democracy), Maria Voltsichina (Debunk.org), Jesse Van Noort (independent analyst), Ani Avetisyan (independent open-source researcher) among others, whom we thank for their invaluable help and for their key findings – especially with the Spanish thread of the investigation.
We would also like to thank the other people who contributed to this article.
You can read more about the Spanish campaign in the Maldita’s article.
*If you find an error, highlight it and enter Ctrl + Enter
RECOMMENDED
