Vietnam-linked AI clickbait network spreads fake political content in Europe

Highly sensational fake political content is spreading across dozens of Facebook pages operated from Vietnam. Although the content flooding Hungary, France, and Poland is cloaked as political, the underlying motive is likely not a disinformation campaign or ideological influence aimed at benefiting any specific actor. The network appears to operate primarily as an AI-driven clickbait business model: they steer users to ad-heavy websites using emotionally charged, patently false stories. Although the motivation here is financial, the same method could be used to carry out foreign information manipulation and interference operations in Europe.

Until our data collection concluded on 18 May, we identified 10 Hungarian, 11 French, and 4 Polish pages, but the network has continued to expand dynamically since then; by the publication of our analysis on 20 May, we have already found ten additional similar platforms.

 

The direct link between the pages and the central coordination became clear as early as the first stage of the investigation:

• Out of the 25 identified pages, 14 were created on the exact same day, 6 April.
• The pages follow one another not only within countries but also across borders. For example, the French Stratége Moderne simultaneously follows the Hungarian Napi Történések (‘Daily Events’) and the Polish Warsaw Political Desk
• Most of the pages started with entirely different names and switched to their current, public-interest-sounding names immediately before publishing their first post. Thus, for instance, ‘Dan Prohaska’ became ‘Közéleti pillanatok’ (‘Moments from Public Life’), ‘Clement Pagac’ became ‘Cél és Elszántság’ (‘Purpose and Determination’), or ‘Ken Vega’ became ‘Głos Polityki’.
• The location of the administrators is visible for 11 pages. In 10 of these cases, the system indicates Vietnam. Two pages list Bangladesh and Canada, while one features the United States and Sierra Leone. There is no trace of Hungarian, French, Polish - or any European - administrators.
• The profile and background images were created using artificial intelligence (AI), often in a strikingly similar, uniform style.

Our detailed content and network analysis conclusively proves centralized orchestration and highlights the probable objective of the operation. The detailed data of the pages is available at the end of the analysis.

Content: Emotional Manipulation and the AI Production Line

The network's content production is based on a single uniform template: well-known, popular political figures in the given country are placed into life situations guaranteed to trigger strong emotional reactions from news consumers. The focus of the posts is on birth, death, severe illness, parent-child relationships, romance, or highly polarized political situations.

Every aspect, from content to design, appears to be AI-generated. This is indicated by the highly standardized posts, which only differ from each other in their actors and linguistic context.

 

The featured political figures were chosen from among the most prominent in each country. The Hungarian pages feature current politicians like Péter Magyar, Viktor Orbán, Márk Radnai, Péter Szijjártó, Ágnes Forsthoffer, Ervin Nagy, László Kövér, and Alexandra Szentkirályi, among others. In the French posts, Marine Le Pen, Jordan Bardella, Emmanuel Macron, and Pierre de Villiers appear most frequently, while the Polish posts focus on Donald Tusk, Jarosław Kaczyński, and Mateusz Morawiecki.

For the sake of emotional manipulation, they frequently present extreme, highly exaggerated scenarios. For instance, a long and touching story recounts how a young girl battling a brain tumor uses her final strength to ask her mother to let her meet Ágnes Forsthoffer, Donald Tusk or Pierre de Villiers. Among the stories with a positive tone, a frequent element is when politicians' children surprise their parents with public singing performances, leaving them visibly moved to tears.

Texts built on the same topic typically do not appear as literal translations on the country-specific pages. The differences lie in the phrasing, while the core messages remain identical - which is also a classic hallmark of generative AI deployment. This is also proven by technical errors slipping into the system: in the posts about the opening of the fictitious free Radnai Sanctuary Medical Center for the homeless in Hungary and the French Sanctuaire Médical de Villiers the exact same 62-year-old construction worker named ‘László’ was the first patient, who according to both versions had not seen a doctor in over a decade.

Advertisements: Reach Paid in Vietnamese Dong

Another common characteristic of the pages is the use of paid Facebook advertisements to rapidly scale their follower bases. The visual scheme of the advertisements was completely identical; only the language and the country-specific figures were swapped.

Since 18 April, the 25 pages launched a total of 175 advertisements, averaging 4-6 ads per page. The Hungarian Lépjünk tovább (‘Let's move on’, 23 ads), the French Rising Political Voice (19 ads), and the Polish Warsaw Political Desk (14 ads) stand out in the dataset.

 

Based on Meta's ad transparency data, there are only six declared financing entities behind the 175 advertisements:

• Kids KingDom - Khu Vui Chơi Trẻ Em Ngay Chợ Đà Lạt: This account financed half of the ads (87 items) across 12 different pages covering all three countries. The name is linked to a legitimate children's play center in Vietnam, which likely has nothing to do with the campaign; its credentials were misused.
• Dream House Creations: Responsible for a quarter of the ads (46 items) across a total of 5 Hungarian and 2 French pages.
• Smaller ad accounts: Metaconex Technology Company Limited paid for 17 ads for 3 Polish pages, while MB88 - Mở Bát Phát Tài and Dew financed 8 ads each for specific Hungarian and French pages. Seagal Legacy Hub ran just 6 advertisements on a single French page.

Based on their names, the advertising accounts are not connected either geographically or thematically to the supported Facebook pages. They were clearly set up as a means of obfuscation.

Since certain advertisements depicted political figures, Meta classified a portion of them as political content during review and removed them. Due to EU regulations, the expenditure logs for such advertisements must be made public. These disclosures revealed that Kids KingDom, Dream House Creations, Dew, and MB88 all settled their accounts in Vietnamese Dong (VND), providing further evidence that the network's operational center is located in (or outsourced to) Vietnam.

Systemic errors also occurred with the ads: the L'Élan Français site briefly ran two ads that promoted the image used on the Hungarian sites to French users. Furthermore, the account of a Brazilian real estate company was listed as the payer for this advertisement, which was billed in Brazilian Real (BRL).

Links Behind the Posts: 38 Domains, Two Final Destinations

A significant common feature of the network's posts is that almost without exception, they contain a link encouraging clicks (either within the post text or in the comment section) promising further details. The surreal and patently false context serves precisely the purpose of inducing users to click on these links through heightened curiosity.

The pages typically contain links pointing to a few different domains. Each domain appears in the posts of a maximum of two Facebook pages. During a comprehensive review of the entries, we identified 38 unique domains. According to WHOIS data, 19 of them were registered on 3 April, and an additional 10 on 4 May, with a highly uniform naming structure.

• The domains registered on 3 April include: bramora.info, clovermere.info, dewfield.info, duskvalley.info, forestnest.info, goldenfern.info, goldenpath.info, hazelhaven.info, hazellyn.info, hazelshade.info, honeyfield.info, meadowlark.info, meadowyn.info, mossora.info, petalfield.info, pineora.info, sunhavenly.info, sunora.info, wildpetal.info
• The domains registered on 4 May include: azurecraft.info, driftlore.info, emberthread.info, mintframe.info, monolight.info, pixelcanvas.info, pixelquill.info, pixelvector.info, quietnova.info, velvetcanvas.info

What these domains have in common is that their landing pages are blank, containing absolutely no content. However, the unique links found in the posts trigger immediate server-side redirects. For instance, clicking the link https://mintframe.info/posts/tamadas-az-elo-adasban-ennek-kovetkezmenye-lesz-radnai-mark-allitolag-tram123-team-eta-798e-hungary redirects traffic to the https://uss.daily24.world/posts/tamadas-az-elo-adasban-ennek-kovetkezmenye-lesz-radnai-mark-allitolag-tram123-team-eta-798e page.

The links across the 28 investigated domains exclusively funnel traffic to just two final destination websites:

1. Predominantly to the website uss.daily24.world,
2. To a lesser extent to the website wealth.cafex.biz.

Both portals display identical English-language, US-focused articles within the same visual layout. The Hungarian, French, or Polish articles arriving from Facebook are completely orphaned from the main landing page navigation and cannot be accessed via the standard menu systems. The destination articles themselves are visually fragmented and poorly formatted, but are densely saturated with Google programmatic advertisements.

Conclusion

Based on our analysis, it is clear that the network's primary objective is financial monetization and content arbitrage. They redirect massive amounts of traffic to the two target websites using AI-generated, emotionally manipulative content, subsequently converting this traffic into profit via the Google advertising ecosystem. The automated workflow allows the network to operate with minimal human overhead while maintaining an extremely high operational tempo on an international scale.

The selection of the three target countries - Hungary, France, and Poland - is likely strategic: political discourse is heavily polarized in all three states, making these markets particularly susceptible to the dissemination of algorithm-optimized content built on emotional manipulation.

This operation simultaneously circumvents Meta's moderation systems, exploits Google's advertising infrastructure, deceives users, and directly contravenes the spirit of the European Union's Digital Services Act (DSA) and Transparency and targeting of political advertising regulation (TTPA). Furthermore, the network illustrates how rapidly and at what scale AI-driven content generation can produce manipulative political assets.

Although the primary motivation in this instance appears to be financial, the underlying methodology serves as a critical warning. The exact same infrastructure - with only minor modifications - could be seamlessly deployed to execute targeted political influence or Foreign Information Manipulation and Interference (FIMI) operations in Europe.

 

The granular, structured database of the pages and domains is accessible via this Google Document.