The digital army in the shadows – how do imported bot farms shape Macedonian public opinion in favour of VMRO and against the opposition?

Every morning, while citizens read the first news on their phones, an invisible army is already at its workstation. Its task is not to debate. Its aim is to insult, to label, to fabricate false scandals and to silence anyone who speaks the truth about crime, corruption and political isolation in North Macedonia.

What looks like “the voice of the people” on social media is in fact an expensive, well-paid and coordinated manipulation machine.

According to the latest allegations and digital traces, North Macedonia has become a testing ground for the so-called “Castle” operation – a system of troll farms and bot networks that the ruling VMRO-DPMNE and Hristijan Mickoski have taken over from their sister party in Serbia, the SNS.

The evidence of this operation surfaces as soon as one scratches even slightly behind the mask of the profiles. An examination of digital traces on the social network X reveals startling data about who really stands behind the comments that glorify the government and attack the opposition.

Profiles presenting themselves as students, pensioners, patriots and ordinary citizens from Ohrid, Skopje, Prilep and other cities are technically located on an entirely different continent.

Analysis of the data shows a network created in the same period – August and September 2026. Just a few examples:

• The profile “Alex Novak”, which claims to be from Ohrid, is registered via the North Africa App Store.
• The profiles “Ivana” and “kristina”, which use pictures of women in Macedonian folk costumes to stir false patriotism, are systematically located in Egypt.
• Even profiles posing as media outlets, such as “Makedonija 24” (with a Macedonian flag as its profile picture), have their digital roots in North Africa.

This is a textbook example of an organised troll farm, where IP addresses are bought in bulk, generic photographs are used and commissioned posts are written in flawless Macedonian to create a false picture in public.

Such networks are rarely run manually. Advanced software exists for this (such as the Israeli AIMS system), with which a single operator can control hundreds of fake accounts at once. At the push of a button, dozens of profiles can share the same fake news, attack a journalist or poison the comments under a post by the opposition SDSM.

This machinery, which according to the opposition is financed with citizens’ money, has a clear target: SDSM and anyone who speaks out against the schemes, the corruption and the policies of isolation pursued by the government. A lie repeated a thousand times by these bots reaches real citizens through the algorithms, in order to be passed off as the truth.

While in Hungary the new political wave led by Péter Magyar is already blocking the accounts of Orbán’s propaganda empire, in North Macedonia this model is being used at full throttle. According to SDSM’s accusations, the system is complemented by dark methods – from hiring the private intelligence agency “Black Cube” to follow people and fabricate scandals, all the way to the use of the controversial Israeli spyware Pegasus to eavesdrop on citizens, a method already seen under the regime in Serbia against students there.

The public space is contaminated. The government is creating an artificial reality in which its policies are celebrated, while the opposition and critics are lynched by an army based on servers in North Africa.

Remember – every reaction, even mocking or arguing with these profiles, is read by the algorithm as legitimate interaction and helps the lies reach more people.

Citizens’ strongest weapon against these bots and fake profiles is to ignore them. Do not comment. Do not share. Report them and block them. The truth, as the digital traces show, always comes to light.

Context: The allegations about hiring “Black Cube” (21 April 2026) and about the Pegasus software (30 April 2026) were made by SDSM. The Ministry of Interior has previously rejected SDSM’s claims about procuring spyware as “untrue and unfounded”, saying it was a regular licence renewal for forensic software that does not enable wiretapping. The screenshots above show the data that the X network publishes about the location and registration of the profiles; on their own, they do not show who operates the profiles.

Sources: SDSM (bots, March 2026); 48 Chasa (Black Cube); Tocka/Makfax (Pegasus); Sloboden Pechat (Ministry of Interior); BIRN (“Castle”, 2020); Daily News Hungary (Hungary); BIRN (Pegasus in Serbia).

Photo: screenshots from the social network X