False claims about Saturday's shooting in Kraków were viewed more than 200 million times within a day, and several of the people and accounts that spread them had done the same during earlier national emergencies.
The Ministry of Digital Affairs said on 8 November that NASK, the state research institute that monitors Polish social media, had asked platforms to review more than 2,000 accounts. On Monday Deputy Prime Minister Krzysztof Gawkowski, the digital affairs minister, put the reach at 250 million views over the previous 24 hours. Both figures add together the views of each false story, so a person who saw several of them is counted several times. On X a view is recorded each time a post appears on a user's screen, whether or not the user reads it.
Fact-checks by Konkret24, Demagog and OKO.press, the ministry's own statements and Polish and Russian media reports make it possible to trace who started several of the stories and who carried them to large audiences. The earliest Polish post claiming that the gunman had fought as a mercenary for Ukraine came from an anonymous Instagram account that supports the far-right MEP Grzegorz Braun.
The claim that police were absent from the square began live on TV Republika. Four days earlier the channel, whose editor-in-chief is Tomasz Sakiewicz, had put the words "coup d'état" on screen over its coverage of the government's dispute with the Constitutional Tribunal. A PiS MP who spread false claims about German soldiers at the Sejm during the Tribunal crisis called for an inquiry into a fabricated Ukrainian link within days.
The digital affairs ministry said the Saturday evening surge in false posts came from individual posts accumulating, not from coordination. Gawkowski described the reach as largely organic, boosted by Russian bots and trolls and by Polish politicians and what he called pseudo-journalists. Fact-checks and monitoring reports show a small number of named figures and outlets appearing again and again, and a platform system that in the first half of 2026 ignored three-quarters of the state's reports.
Michał O., a 24-year-old licensed sport shooter from Ostrowiec Świętokrzyski, opened fire from his car on Rynek Główny, Kraków's main square, shortly after 15:00 on 7 November, killing six people. His parents and sister were found dead in the family flat. He died in hospital at 04:30 on Monday before he could be charged. Przemysław Nowak, a spokesman for the National Prosecutor's Office, said investigators had no information about his intentions or views.
The first hours
At about 15:25, less than half an hour after the first shots, Sakiewicz was broadcasting live from the Rynek for TV Republika. "There is still not a single police officer to be seen," he said, according to Konkret24's transcript. He told viewers that police reserves had most probably been sent to Warsaw, where officers had been deployed around the Constitutional Tribunal since 30 October. A uniformed officer was standing behind him in his own channel's footage, Konkret24 and the Polish Press Agency (PAP) found. Press.pl, the trade journal, reported that he also told viewers nobody knew where the police were. Konkret24 rated the claim false on 8 November.
Małopolska police said on X at 19:38 that they were denying reports of a late response, and that the first patrol had acted 23 seconds after the emergency call. Interior Minister Marcin Kierwiński said officers had fired at the gunman within three minutes. Two officers, Senior Constables Jakub Kulik and Artur Morański, were shot while stopping him. Press.pl reported that Sakiewicz repeated the claim several times on air that afternoon.
Sakiewicz also said on air that foreigners had taken part in the attack, Demagog reported. On X, Rafał Otoka-Frąckiewicz wrote that the attackers were supposed to have been foreigners, and Maciej Sagal wrote that two cars with Ukrainian number plates had left the scene. A profile called Szkodliwe Fale posted that the gunman was a Ukrainian vaccinated with an mRNA vaccine. Małopolska police confirmed about two and a half hours after the attack that he was a Polish citizen.
Krystyna Pawłowicz, a former PiS MP, and the right-wing journalist Marzena Nykiel echoed the claim that police had been absent, Konkret24 found. Claims that the shooting was connected to the Tribunal protests reached up to 14 million views, according to the ministry. They rested on the assertion that police had been moved to Warsaw.
At 18:46 and 18:50 Marcin Dobski, a journalist at TV Republika, posted on X that his findings from police pointed to neo-Nazi interests, and that there might be a bomb in the car. He also wrote that the gunman wore the insignia of a Territorial Defence brigade and would probably not survive. Defence Minister Władysław Kosiniak-Kamysz wrote on X that evening that the man was not and had never been a soldier of the Polish Armed Forces. The gunman survived for another day and a half.
Posts saying the gunman was a serving soldier, prompted by his camouflage uniform, reached nearly 18 million views. Dr Michał Marek, an analyst at NASK, wrote on X that Russian and Belarusian channels were claiming the Polish defence ministry had confirmed he was a soldier. He said Russia was likely to promote the story abroad to damage the image of the Polish army, PAP reported. The security website Terroryzm.pl said a Facebook post by a user named Sebastian Piekarek was the likely source of the Territorial Defence version.
Kierwiński told a press conference after 20:00 that everything pointed to the gunman being fascinated by far-right ideologies, though he said this still had to be checked. At 21:09 Ewa Zajączkowska-Hernik, an MEP for the Confederation party, posted that he had won the award for "the most disgusting hyena feeding on today's tragedy". Her post attacked the minister's statement.
The most widely seen story of the weekend held that the Polish government had planned the attack with help from the European Union. The ministry called it absurd and said it may have reached as many as 200 million views as other stories faded. Posts claiming the government had staged the attack as a pretext to cancel the Independence March on 11 November peaked on Saturday afternoon at 5.6 million views. Paweł Kukiz, a member of the Sejm, said on Sunday that he feared a "provocation" at the march, Do Rzeczy reported. On Sunday a new story appeared, that the attack had been staged with actors, and reached few people.
An X user passed off Instagram photographs of another man as the gunman's brother, reaching nearly 2 million views, PAP found. The man wrote that it was a stunt by foreign bloggers chasing attention, and condemned the attack. A post claiming a second gunman was on the roof of St Mary's Basilica drew about 1 million views. Police said officers had been responding to a priest who stepped out onto a terrace. Konkret24 found a post accusing men of looting a Zara shop, shared by an account called @BeataBerliska1 with more than 100,000 views. The men were looking for a tourniquet. Małopolska police also denied posts claiming that a police officer had been killed.
The ministry said on 8 November that most of the flagged accounts posted in Polish, English, French and Dutch, and that several dozen wrote in Russian, used Cyrillic in their names or profiles or referred to Russia. Activity peaked at about 18:00 on Saturday and picked up again at about 08:00 on Sunday, when most false posts were being shared by accounts with small followings, the ministry said.
Gawkowski told reporters on Monday that the disinformation began several dozen minutes after the attack and that reports from the public were still rising. The ministry's leadership met its disinformation team overnight on Saturday, and the team worked in a joint operations room with the counter-terrorism centre of the Internal Security Agency (ABW), passing material to platforms through rapid reporting channels.
Fact-checkers have identified the first posts for the claims about absent police, foreign attackers, the mercenary link, the serving soldier and the left-wing profile. For the police and mercenary claims, the route from the first post to a mass audience is documented.
From Instagram to Shot
Anna Mierzyńska, who analyses disinformation for OKO.press, traced the earliest Polish version to an Instagram account called @edgarkorona, which posted it shortly after 18:00 on Saturday. She describes the account as anonymous and supportive of Braun's party, the Confederation of the Polish Crown. A longer post followed 15 minutes later. The post pointed to a patch on the gunman's equipment and said it was the emblem of a foreign volunteer unit fighting for Ukraine.
About an hour later the X account @aleksthgrt, which Agentstvo, the Russian independent outlet, identifies as "Aleksey The Great" with 120,000 followers, repeated the claim. At 20:37 the Russian Telegram channel Shot published it. OKO.press says Shot belongs to News Media Holding, which is associated with Yuri Kovalchuk, a banker close to the Kremlin. About an hour after that, International Radio Belarus, a state broadcaster, carried the story. EADaily, a Russian news site, ran it at 23:30 Moscow time, in a report that also cited Kosiniak-Kamysz's statement that the gunman had never served in the Polish army. Within a day it had appeared on faktibg.com in Bulgaria, pronews.gr in Greece, a Spanish site, Chinese portals and a Vietnamese Facebook page, and circulated on Telegram, Facebook, TikTok, Reddit, X and VK, according to OKO.press and Agentstvo. The Russian news sites TopNews.ru and Bloknot.ru also carried it.
Demagog established on Sunday afternoon that the patch was a version of the pirate flag of Blackbeard, not the emblem of the Ukrainian unit. The military analyst Jarosław Wolski traced the design to a U.S. Navy SEAL team and found it on sale commercially, Interia reported.
Dariusz Matecki, a Law and Justice (PiS) MP, said the case should be fully explained, and compared the patch to one worn by a man detained near the Constitutional Tribunal, Demagog reported. On 5 November Konkret24 had checked a video Matecki posted of what he presented as German soldiers outside the Sejm, which had 750,000 views. The soldiers told Konkret24 they had come for an exhibition.
What the Fact, an automated fact-checking service, traced the collage of screenshots portraying the gunman as left-wing to an X account called @Edgar_Korona, where it had about 565,000 views. Hungarian Conservative, a Budapest outlet, quoted a commentator named Edgar Korona describing the gunman as an anarcho-communist and antifa sympathiser.
Two versions of the gunman
Kierwiński's remark on Saturday evening was the first official statement on ideology. On Sunday he told TVN24's Fakty po Faktach programme that early hypotheses and circumstantial evidence always surface in such cases, and that his remark had been based on them. "We are not passing any verdicts here," he said. Krzysztof Klęczar, the governor of Małopolska province, said on Sunday that a closed briefing had indicated the gunman belonged to "some organisation" whose name was not known, Wirtualna Polska reported.
Terroryzm.pl reported that the gunman appeared to be wearing a symbol of Falanga, a Polish ultra-nationalist group, during the attack. The site said it identified the motif through private editorial channels, and stood by the identification after it was challenged. It said the symbol is sold commercially. Karolina Gałecka, the interior ministry's spokeswoman, told TOK FM on Monday that she would neither confirm nor deny any emblem, and that the emblems investigators were examining related to various possible motives. Dobski's post citing police sources on neo-Nazi interests was published before Kierwiński spoke.
Prosecutors said on Monday that a Gadsden flag, the U.S. revolutionary-era banner showing a rattlesnake, hung in his room. Nowak said it had no obvious connotations. A prosecutor named Sokół said investigators had found no material showing active political or extremist activity, RMF24 and Wirtualna Polska reported.
Super Express reported on Sunday, citing several unnamed sources, that the services had found no links to the far right. Magna Polonia, a nationalist portal, wrote that the services had examined his online activity thoroughly and found no trace linking him to the far right, without saying how it knew. Hungarian Conservative reported on Sunday evening, citing a police source it said had spoken to Rzeczpospolita, that he might be on the far left. Officers from the Central Bureau for Combating Cybercrime are examining his online activity, including whether he belonged to any online groups, Onet reported.
At 21:13 on Saturday an X user, Czarek Czerwiński (@ckwadrat), posted screenshots from what he presented as the gunman's Facebook profile with the comment "Looks like a lefty". The profile showed a man posing with a Pride flag in a gas mask and beret and mocking Pope John Paul II. It was deleted soon after. Biały Kruk, a Catholic publisher, wrote that the screenshots proved left-wing and anti-Catholic views and said an official body had probably deleted the accounts, while acknowledging that half of the material circulating was fake.
PAP found that at least one image used to support the left-wing version was doctored. A photograph from his Facebook account had been edited to add a badge with three arrows, a symbol of the antifascist movement, which he was not wearing in the original. PAP also found that images of his face circulating online had been sharpened with artificial intelligence from video stills taken after he was shot. Using SynthID, Google's tool for detecting images made with its own AI, PAP established that Google software had been used. Gawkowski wrote on X that sharpened images were very often misleading.
George Simion, leader of the Alliance for the Union of Romanians (AUR), who campaigned for President Karol Nawrocki in 2025, wrote on X on 8 November that the gunman had clear extreme-left tendencies and that Kierwiński had "shamelessly lied". Jarosław Kaczyński, the PiS leader, called Kierwiński's remark a vulgar lie and wrote that only a clearly disturbed person could have carried out the attack, whatever his politics.
Mariusz Jan Frankiewicz, a 2024 candidate for Gdynia city council, posted an AI-generated image of Kierwiński shaking hands with the gunman on Facebook on Sunday evening, Konkret24 found. It was shared more than 900 times, including in a Facebook group called "Grzegorz Braun, geopolityka". The journalist Sławomir Jastrzębowski shared it and later deleted it, CyberDefence24 reported. Gałecka said profiles linked to TV Republika had also spread it and that the material was going to prosecutors.
Bartłomiej Pejo, a Confederation MP, shared on Facebook an AI-enhanced image of the arrest that reached at least 1.2 million views, Konkret24 found. Marcin Tyc of the fact-checking project Sprawdzam.to also shared it and apologised.
European Interest, a Brussels-based site, wrote that evidence had emerged confirming the gunman's connections to far-right extremism, and gave his age as 25. Prosecutors give his age as 24.
A minister's unexplained preliminary remark, a symbol reported by one website and a journalist's unsourced post are the basis of the far-right account. The left-wing account rests on an unauthenticated and deleted profile, a doctored photograph and the claims of anonymous and foreign accounts.
"Zamach stanu" at the Tribunal
TV Republika, wPolsce24 and opposition politicians had spent more than a week before the shooting telling audiences that Prime Minister Donald Tusk's government was carrying out a coup d'état, or "zamach stanu", at the Constitutional Tribunal. Sakiewicz's claim that police had been moved to Warsaw drew on that story.
In December 2015 the PiS-controlled Sejm elected judges to seats on the Tribunal that its predecessor had already filled. In May 2021 the European Court of Human Rights ruled in Xero Flor v Poland that a bench including one of those judges was not a tribunal established by law.
The Sejm passed a resolution in March 2024 questioning the legality of the court as constituted under PiS, and the government then stopped publishing the Tribunal's rulings in the Journal of Laws. From mid-2025 Nawrocki refused to swear in three of the six judges parliament had nominated, Al Jazeera reported. The Tribunal's president, Bogdan Święczkowski, refused to let five judges sworn in before the Sejm, among them Maciej Berek, take up their posts, according to OKO.press. On 16 October police gathered evidence on a suspected assault on Berek, on suspicion that Święczkowski had pulled him out of an office.
On 30 October Judge Anna Korwin-Piotrowska, the longest-serving member of the court, ordered Święczkowski and his deputy, Bartłomiej Sochański, to stop work and took over running the Tribunal. Police were deployed to the building after she reported a threat to judges. Warsaw police said officers did not enter the building, and three people were detained. Waldemar Żurek, the justice minister and prosecutor general, is seeking to lift the two judges' immunity. That night Nawrocki turned back a flight to Senegal, entered the Tribunal at about 01:00 past Korwin-Piotrowska and stayed until about 05:00, Konkret24 and OKO.press reported.
In February 2025 Święczkowski notified prosecutors that Tusk, the speakers of both chambers and others were attempting a coup, PAP reported, and prosecutors opened an investigation. Demagog documented coup accusations from both camps during a dispute over judicial nominations in April 2026. On 9 April 2026 Janusz Korwin-Mikke, a former MEP who now leads the small KORWiN party, wrote on X that the army should take power. On 29 September the lawyer Marcin Matczak, a critic of the president, said on TVP Info that Nawrocki was carrying out a coup.
Sławomir Mentzen, a Confederation leader, said on 30 October the government's actions were probably simply a coup. Zbigniew Ziobro, the former justice minister, called them an open and criminal attack on the constitutional order. Kaczyński wrote on X that Poland had become a police state. Zbigniew Bogucki, the head of the President's Chancellery, told Korwin-Piotrowska during the night of 30 to 31 October that she was carrying out a coup, Super Express reported. On 3 November TV Republika ran an on-screen caption reading "Coup d'état. We call on Poles to come to the Constitutional Tribunal", OKO.press reported. OKO.press wrote that U.S. influencers from the movement around Donald Trump joined the channel's coverage. Demagog and Konkret24 treated the coup accusation as a political charge in a legal dispute, and rated as false a long series of factual claims made to support it.
On 14 September Michał Woś, a PiS MP, posted a TikTok video of police shielding protesters with screens and presented it as police action at the Tribunal. Demagog found it was footage from a Women's Strike protest in March 2021. OKO.press reported that footage from the 2017 Independence March was used to illustrate the Tribunal protests.
Warsaw police denied on 14 October claims of a "storming" of the Tribunal, and denied a TV Republika report that officers had refused orders. On 16 October Kaczyński and Sakiewicz described a police "attack" on the office of Adam Borowski, an activist close to PiS. Police said they had responded to a man with a knife who injured a policewoman. Kierwiński filed a notice to prosecutors against TV Republika and Sakiewicz over the reports.
An X account called @Marek_Kuna_ posted an AI-generated picture of masked officers storming the Tribunal on 30 October. Janez Janša, the Slovenian prime minister, shared it, and the U.S. streamer Asmongold used it as the thumbnail of a video that passed 2 million views, Demagog found. An AI image posted by the U.S. actor Kevin Sorbo of police on the Tribunal steps drew more than 86,000 views. A Portuguese-language post presenting a 2026 concert marking the Warsaw Uprising as a crowd that had "stopped a coup" drew 2.6 million views. Konkret24 rated both false.
On 30 October Stanisław Janecki said on the broadcaster wPolsce24 that the landing of the president's plane had been blocked. Bogucki and the defence ministry denied it, and Konkret24 and Demagog rated it false.
A photograph taken that night by Dobski, which showed an officer marked "Policja", was altered with AI to read "Polizei", and spread as proof that German police were at the Tribunal. Demagog found a SynthID watermark, and Polish police denied the claim on 2 November. Zdzisław Krasnodębski, a member of Nawrocki's council for a new constitution, amplified claims about German police on 1 November, Konkret24 found. The claims rested on a misused photograph from Hamburg, helmet numbers that Polish riot police also use and video of police vans on the S8 expressway driving away from Warsaw.
Demagog found that a video shared as football fans marching to defend the Tribunal showed Wisła Kraków supporters on 10 October. wPolsce24 had run the headline "Fans set out to defend the Tribunal". Kanał Zero, the YouTube channel, illustrated a story about an acoustic weapon at the Tribunal with a vehicle belonging to Łódź police, which called the story fake. A TikTok video presenting German military vehicles as heading to the Tribunal passed 380,000 views and was rated false by Konkret24. Matecki's video of German soldiers at the Sejm reached 750,000 views, and Woś's Facebook share of it reached 1.1 million.
Politicians from the ruling coalition spread an AI-generated image of Nawrocki, Demagog found. It also found that Anna Krupka, a PiS MP, had copied a post from an account it described as suspicious.
Gen. Marek Boroń, the national police chief, wrote on 1 November that a nationwide state of readiness had been ordered because of attempts at destabilisation by Eastern intelligence services, and had nothing to do with the Tribunal. Kaczyński asked supporters on 7 November to call off the Tribunal protests planned for 8 and 9 November because of the Kraków killings.
Republika on both stories
Oskar Szafarowicz, a PiS activist and Republika journalist, posted on X on 15 July 2026, after a man abused Ukrainian teenage girls on a bus in Bielsko-Biała, that the media were silent about crimes committed by Ukrainians. Demagog rated the post false and said it listed incidents that did not support the claim. Maria Kurowska, a PiS MP, shared it. Dobski, a Republika journalist, posted the unsourced claims about neo-Nazi interests and Territorial Defence insignia on 7 November. Presenters at wPolsce24 and TV Republika also said on 7 November that police had been tied up at the Tribunal, the weekly Polityka reported.
Kaczyński backed Sakiewicz in a post on Sunday, about a day after the police correction. Polsat News published its report on the post at 22:54. Apart from one officer in an unusual uniform, he wrote, police had been missing for a long time. Only a handful of officers without long guns were on duty in the square, he added, even though the BRAVO terrorism alert, the second of four levels, was in force. Gałecka replied that he had taken his information from TV Republika rather than from police, and that 30 police patrols had been sent to the scene. Kierwiński told TVN24 that claims of a police absence were a lie from start to finish.
The Polish Media Council, which groups publishers and broadcasters, issued a statement on Sunday evening about the coverage, RMF FM reported at 18:07. The National Broadcasting Council, the constitutional body that licenses and supervises Polish broadcasters, opened proceedings against TV Republika on Monday. TVP Info reported the decision at 10:19. Żurek said prosecutors would examine the disinformation after the attack, including Republika's broadcasts, for possible criminal liability, according to OKO.press.
Earlier waves
On 31 May 2024 a false dispatch appeared on the wire of the Polish Press Agency at 14:00 and again at 14:20. It announced that Tusk would order a partial mobilisation from 1 July and call up 200,000 people to fight in Ukraine. PAP said it had been hacked. Jacek Dobrzyński, spokesman for the minister coordinating the special services, said the attack was probably Russian.
During the floods in southern Poland in September 2024, Gawkowski told the Sejm that disinformation traffic had risen 300 per cent in the first four days. He said most of it came from internet addresses that had also been active immediately after Russia's full-scale invasion of Ukraine. The false claims said the government was doing nothing, that embankments were being blown up deliberately and that deaths were being hidden. Krzysztof Bosak, a Confederation leader, said he did not believe the official death toll of seven.
In late April 2025 Anna Krupka posted a video on Facebook captioned as showing migrants brought into Kraków under cover of night. It showed tourists walking to a hotel. Her post was shared at least 2,100 times, and an anonymous repost on X drew about 800,000 views, Notes from Poland reported. Aleksander Miszalski, the mayor of Kraków, asked the speaker of the Sejm to refer her to the ethics committee. She deleted the post and blamed a member of her staff.
During the 2025 presidential campaign NASK's election programme reported more than 16,000 accounts to platforms between January and May. Military counter-intelligence found a network of several hundred inauthentic accounts on X in March and April, and the pro-Russian hacker group NoName057(16) attacked party websites on 16 and 18 May, according to the programme's report published on 17 September 2025.
On 9 and 10 September 2025 Russian drones entered Polish airspace and some were shot down. The ministry listed seven false claims within three days, the most widely seen being that the strike on a house in Wyrki had been staged, at about 1.7 million views. On 19 September Braun called the incursion a provocation at a press conference, and Korwin-Mikke said the drones were Ukrainian and filed a complaint against the foreign minister, Radosław Sikorski, Notes from Poland reported. Korwin-Mikke had posted the claim on X on 11 September. Gawkowski told Gazeta Wyborcza later that month that Russian and Belarusian accounts had achieved a reach of 60 million during the incursion, Forsal reported.
Explosions damaged the Warsaw to Lublin railway line on 16 and 17 November 2025, in sabotage that prosecutors attribute to people working for Russian intelligence. The ministry documented claims blaming a Ukrainian network, and a fabricated report that German media had alerted the railway operator days in advance. Res Futura documented Russian outlets promoting a story about Polish partisans. Demagog and IMM found Demirow, Ministerstwo Prawdy and Skalik among those blaming Ukrainians.
On 11 July 2026 a man abused Ukrainian teenage girls on a city bus in Bielsko-Biała. Res Futura counted about 14 million views of the video in two days and named Braun, Mentzen, Bosak and Przemysław Czarnek of PiS among the politicians in the discussion, Euronews reported. On 15 July Szafarowicz posted that the media were silent about crimes by Ukrainians, citing incidents in Płock, Bielsko-Biała and Kraków. Demagog rated the post false. Konrad Berkowicz, a Confederation MP, posted something similar. Berkowicz also appears in the Demagog and IMM report on anti-Ukrainian posting. Konrad Niżnik of the Confederation of the Polish Crown cited a beating that the city's own news service found had not happened.
At the end of July 2026 a Russian Kh-101 cruise missile came down at Tarnawa-Kolonia in Lublin province. Małgorzata Szumna of NASK said two false stories followed, one blaming Ukraine and one blaming the government. The General Staff said Russian channels pushed them between 04:00 and 09:00, Yevropeiska Pravda reported. A Facebook video calling the strike a Ukrainian provocation drew more than 11,000 reactions and almost 3,000 shares, and Panasiuk denied it was a Russian missile, Demagog found.
On 25 September 2026 a Ukrainian man, Ihor M., stabbed people at a monastery in Jarosław. Szumna said posts on X spread false claims about whether he had been handcuffed and about media silence. RMF24 attributed the spread to anonymous profiles and politicians linked to the Confederation and the Confederation of the Polish Crown.
After knife attacks at schools in Ostrołęka on 7 October and Leszczydół-Nowiny on 8 October 2026, rumours of a "bloody Friday" of further attacks spread on social media. Siemoniak said on 10 October that any Russian role was being examined but that evidence had to come first. Poland flagged 89 items to platforms in five days, and two-thirds were left up.
Claims that Ukraine or Ukrainians are to blame, that the government is lying or staging events and that official sources hide the truth run through these episodes. The actors named in them change from case to case. Only Braun, Korwin-Mikke, Skalik, Panasiuk, Krupka and the accounts in the Demagog and IMM rankings are documented by name in more than one episode before the Tribunal crisis.
The repeat names
Demagog and the Institute of Media Monitoring (IMM) rank the most active accounts in periodic reports on anti-Ukrainian propaganda. Their report for August to November 2025 counted 185,766 hostile posts reaching 66.4 million potential contacts, more than double the previous period. X carried 92.5 per cent of the posts. Seven of the 10 most active X accounts had been on the list for the previous period: Witold Gadowski, Martin Demirow, Marcin Rola, Ministerstwo Prawdy, the Confederation of the Polish Crown, Braun and an account called Chłop Antoni. Braun topped the Facebook list again.
Demagog and IMM documented Braun, his party colleague Włodzimierz Skalik and Korwin-Mikke pushing the claim that the Russian drones which entered Polish airspace on 9 and 10 September 2025 were a provocation or not Russian. They also documented Demirow, Ministerstwo Prawdy and Skalik blaming Ukrainians for the railway sabotage of November 2025, which prosecutors attribute to Russia.
Piotr Panasiuk, whom Demagog describes as known for promoting pro-Russian disinformation, called the drone explosion at Osiny in Lublin province on 20 August 2025 a Ukrainian provocation on Facebook. His denial a year later that the missile at Tarnawa-Kolonia was Russian makes him one of the few individuals Demagog has documented by name in two separate military incidents.
Sakiewicz and TV Republika are documented in both the Tribunal campaign and the Kraków claims, and so are wPolsce24 and Matecki. The Braun movement is documented at the top of anti-Ukrainian posting in 2025 and, through a supporter's account and a fan group, at the source of two false claims about Kraków. Braun posted questions on Facebook on 8 November, PCh24 reported. Korwin-Mikke appears across all three periods. His posts about Kraków attacked the police and the minister.
How the claims moved
Originators, the accounts or people first documented publishing a false claim, include Sakiewicz for the police absence claim, @edgarkorona for the mercenary claim, @ckwadrat for the earliest found left-wing screenshots and Frankiewicz for the AI image of Kierwiński. In the Tribunal campaign they include @Marek_Kuna_ for the AI image of the storming, Woś for the recycled 2021 video and Janecki for the blocked landing. In the 2025 drone incursion Re:Baltica traced the claim of Ukrainian drones to the Telegram channel INSIDER-T.
Amplifiers, which carried the claims to large audiences, include TV Republika and wPolsce24, which broadcast or headlined false claims in both the Tribunal crisis and the Kraków case. Shot, International Radio Belarus and EADaily moved the mercenary claim into Russian and Belarusian audiences, and from there it reached sites in Bulgaria, Greece and Spain. Asmongold's video carried the AI image of the Tribunal to an English-speaking audience of more than 2 million. Hungarian Conservative and Biały Kruk published the unauthenticated left-wing profile to readers abroad and in Poland.
Kaczyński, among the political figures who gave the claims a place in mainstream debate, repeated a version of the police claim a day after the police correction. Matecki called for an inquiry into the mercenary link. Pejo shared an AI-enhanced image of the arrest. Simion called the interior minister a liar without evidence. During the Tribunal crisis Woś, Matecki and Krupka posted false material, Krasnodębski amplified the German police claim and Janša shared the AI image.
Cross-platform distribution is documented in detail for the mercenary claim, which moved from Instagram to X, then to Telegram and state radio, and then to Facebook, TikTok, Reddit and VK. Matecki's video moved from X to Facebook through Woś's share, where it drew more views than the original.
Repeat participants, documented in more than one episode, are TV Republika and Sakiewicz, wPolsce24, Matecki, Woś and Krupka, Braun and his party and supporters, Korwin-Mikke, Skalik, Panasiuk and the accounts that recur in the Demagog and IMM rankings. For anonymous and automated accounts, recurrence can be shown only within the Demagog and IMM rankings and in the 2024 and 2025 reports on the Social Design Agency network, which tracked the same bot accounts over time.
Russia's part, as documented
In November 2024 OKO.press counted at least 2,000 Polish-language bot accounts on X that it tied to Russia's Social Design Agency, a Moscow firm sanctioned by the EU and the U.S. for running the Doppelganger operation. Doppelganger builds copies of real news websites and spreads their fake articles through networks of fake social media accounts. Mierzyńska matched their graphics to leaked internal documents of the agency. The accounts pushed claims that Tusk was close to Putin and promoted Polexit, often linking to genuine articles on bankier.pl, wpolityce.pl, fronda.pl, fakt.pl and salon24.
NASK attributed one of the eight influence operations it described during the 2025 presidential campaign to the Social Design Agency. Alliance4Europe, a research group, counted 321 Polish-language Doppelganger posts between 11 April and 21 May 2025 with an estimated 1.23 million views, some of them published during the electoral silence on 17 May. The posts linked most often to genuine articles on bankier.pl, wpolityce.pl and fronda.pl, which the operation used to give its claims a Polish source. Fifteen of the posts promoted Nawrocki. Alliance4Europe named accounts including @tammyjonesdea and @dorothymperfec.
After the drone incursion of September 2025 the Latvian investigative outlet Re:Baltica traced the claim that the drones were Ukrainian to the Telegram channel INSIDER-T and its amplification by Tsargrad and Moskovsky Komsomolets. One video on Dzen, the Russian platform, drew 422,000 views. Res Futura, a Polish analysis firm, counted about 179,000 posts published within hours of the incursion and found that 38 per cent blamed Ukraine and 34 per cent blamed Russia. Euronews found that the study was later misrepresented online as showing that Poles held the Ukrainian government responsible for the incursion.
Google's threat intelligence group named Portal Kombat, the network also known as Pravda, as an amplifier of claims after the railway sabotage of November 2025, Defence24 reported. In August 2026 the Polish Institute of International Affairs found that anti-Ukrainian mentions had risen 171 per cent to 364,000 between 26 May and 13 July. VK and Pravda network pages ranked high, and Dzen content had the largest reach on X. It found that the most active anti-Ukrainian accounts had earlier spread pandemic disinformation.
Three foreign links are documented in the Kraków case. The mercenary claim travelled through Shot and Belarusian state radio. Marek observed the soldier claim in Russian and Belarusian channels. Several dozen of the flagged accounts carried Russian-language markers. The ministry described the evening peak as uncoordinated. Tomasz Siemoniak, the minister who oversees the intelligence services, said military intelligence was examining disinformation coming from outside Poland.
Reports that go nowhere
NASK can report posts to social media companies but cannot make them remove anything. Radosław Nielek, NASK's director, told the Sejm's digital affairs committee in May 2025 that the institute was not a special service, had no police or investigative powers and worked only from open, publicly available sources. Paweł Olszewski, a deputy digital affairs minister, told the same committee that NASK had no tools to investigate who was funding disinformation.
"Platforms do not feel responsible, because we have no law to enforce it," Gawkowski said in March. In 2025 NASK reported 46,511 items of disinformation to platforms. The companies removed 12 per cent, applied labels, reach limits or other moderation to 68 per cent and rejected or ignored 20 per cent, according to NASK's report published on 5 March 2026. X received most of the reports and removed about 2 per cent of what it was sent, the report showed. NASK counts a label, a Community Note, partial removal or a restriction on an account as moderation, so a moderated post can remain online.
NASK reported 65,220 items in the first half of 2026, and 76 per cent drew no response, according to its report published on 21 October. X removed 2.4 per cent, Facebook 63.6 per cent and TikTok 55.7 per cent. NASK said X's low rate was probably due to a shortage of Polish-speaking moderators. Instagram removed 37.8 per cent and Threads 6.9 per cent. Gawkowski wrote that the platforms treated Poland's information security as a side cost of doing business, and threatened fines of tens of millions of złoty once the law allowed them.
A porter was killed at the University of Warsaw on 7 May 2025. Platforms turned down NASK's reports of posts blaming a Ukrainian for the killing. "The platform decided this was insufficient evidence that a Ukrainian was not the perpetrator," Izabela Jarka of NASK told Interia. Most of NASK's reports in a later case in Jelenia Góra, where posts again blamed a Ukrainian, were also rejected. After the school attacks in October 2026 Poland flagged 89 items of illegal content between 7 and 12 October, and the companies failed to act in about two-thirds of cases, Reuters reported. Google, Meta, TikTok, Discord and Telegram attended a meeting at the ministry. X was invited and did not attend, Gawkowski said.
The European Commission referred Poland to the EU Court of Justice on 7 May 2025 for failing to designate a regulator under the Digital Services Act, the EU's law on online platforms, by February 2024. Czechia, Cyprus, Spain and Portugal were referred at the same time. On 9 January 2026 Nawrocki vetoed a bill that would have allowed regulators to order the blocking of illegal content, calling it administrative censorship. Gawkowski said the president had vetoed safety on the internet.
Sylwia Gregorczyk-Abram, the Ombudsman, wrote to the president on 20 September urging him to sign a new version. On 25 September Nawrocki signed a narrower law making the president of the Office of Electronic Communications (UKE) Poland's digital services coordinator, with powers to fine platforms up to 6 per cent of global turnover. It took effect on 6 November, the day before the shooting, XYZ reported. A second bill would allow the UKE president, the chair of the National Broadcasting Council and the courts to order illegal content blocked or removed at the request of police or prosecutors. Some orders would be enforceable immediately, with appeals going to the courts. It was awaiting the president's signature as of 23 October.
At EU level, the Commission fined X €120 million on 5 December 2025 for breaches involving its blue check marks, its advertising repository and access for researchers, its first decision under the Digital Services Act. X has challenged the fine. The Commission's investigation into X's handling of illegal content and information manipulation, opened in December 2023, is still open.
Tusk signed an order on 29 September 2026 creating a Centre for Combating Disinformation within the digital affairs ministry, headed by Olszewski. Its members come from the special services, the Cyberspace Defence Forces, the Government Centre for Security, the police and the fire service. Its remit is to publish findings on identified campaigns, advise the administration and draft a national strategy.
The Confederation called the centre a de facto propaganda ministry. Olszewski said the Confederation of the Polish Crown was one of the sources and repeaters of Russian disinformation in Poland. RMF24 reported a plan to name publicly the people and groups repeating harmful claims, among them Braun's circle and the nationalist Kamraci movement. The movement's founder, Wojciech Olszański, has been in prison since 22 October 2026, serving a three-month sentence for antisemitic remarks made during an online broadcast, TVN24 reported.
Errors on the government side
In May 2025 NASK said Facebook advertisements it had flagged as possibly foreign-funded had been blocked after its intervention. Meta said it had removed nothing and the campaign had simply ended. OKO.press named the advertisers as "Wiesz Jak Nie Jest", which spent about 286,000 zł attacking candidates of the right, and "Stół Dorosłych", which spent more than 141,000 zł promoting the governing coalition's candidate, Rafał Trzaskowski. NASK distanced itself from Jakub Kocjan, president of the civic group Akcja Demokracja, which Wirtualna Polska linked to the ads, after it emerged that he had attended a NASK event.
NASK itself documented in July 2024 a network of 99 X accounts, created from December 2023, that posted more than 15,000 comments between 8 April and 22 July 2024 promoting the government's subsidised mortgage scheme and attacking its critics. The comments drew about 70,000 views.
Gawkowski told Interia in 2026 that a Russian trace was always visible whenever sabotage happened in Poland. NASK's own analysts have questioned inflated counts. A year into the war in Ukraine, NASK identified almost 1,600 accounts spreading disinformation. Mateusz Mrozek, who then headed its counter-disinformation unit, said some institutions had published fanciful figures early in the war. "There are not nearly as many of these accounts as it seems," he said, Tabletowo reported.
Grzegorz Rzeczkowski, director of the Centre for Disinformation Research at Civitas University, told Radio Kraków that the state was failing to build effective tools against disinformation and should use the ones already available instead of waiting for new laws.
Kierwiński described his remark on 7 November as a first hypothesis. Prosecutors say they have no information on motive and have found no material showing extremist activity.
Repeat participants and the cases before prosecutors
Polish fact-checkers, NASK and independent researchers have between them documented a stable group of named people and outlets who spread false claims across several national emergencies since 2024. TV Republika and its editor-in-chief appear in both the Tribunal campaign and the Kraków claims. The Braun movement and its supporters appear at the top of anti-Ukrainian posting in 2025 and at the source of two false claims about Kraków. Several PiS MPs appear in more than one episode. Russian state-linked channels picked up and spread at least one Kraków claim that began on a Polish account.
Social media companies received more than 110,000 reports from NASK in 18 months and removed a small fraction. The state agency that files the reports has no power to compel removal, and the law that would give a regulator that power took effect the day before the shooting.
Żurek said on Monday that prosecutors would examine the disinformation after the attack for possible criminal liability, including Republika's broadcasts, and Gałecka said the AI image of Kierwiński had been sent to prosecutors. Kierwiński's notice against TV Republika over its October reports from the Tribunal is also with prosecutors.
