Election watch
France 2027 Presidential Election
Dates approved by the Council of Ministers on 1 July 2026. The run-off is held only if no candidate wins an absolute majority in the first round — which has happened at every presidential election of the Fifth Republic.
The first French presidential election since 2017 at which the incumbent is not standing, Emmanuel Macron being barred from a third consecutive term. The 2017 contest ended with a hack-and-leak operation released 44 hours before polls closed, inside the legal reporting blackout; that case is documented here, and it is the reason this vote is worth watching early rather than in its final week.
What to watch
Each point is classified under the same five categories as a documented finding, so an upcoming election reads with the same frame as a past one.
- Foreign interference
Whether a hack-and-leak is attempted against a campaign again, and whether it lands inside the pre-election reporting moratorium, when French media are legally constrained from covering it. That timing was the operative feature of MacronLeaks in 2017, not the contents of the leak.
See the source - Information operations
Whether the Doppelganger network, which has cloned French outlets including Le Monde and Le Parisien, is active around the campaign, and whether platforms act on it faster than in previous cycles.
- Information operations
Whether synthetic audio or video of candidates circulates in the moratorium window, when a denial cannot be effectively reported. Slovakia 2023 is the documented precedent for exactly this timing.
- Foreign interference
Documented precedent, not an assertion of current activity: Storm-1516 and Rokh Solis targeted French political figures or the 2026 municipal debate. Watch for the same staged-source, false-site and coordinated-amplification techniques in 2027, while measuring actual reach.
See the source - Information operations
Documented infrastructure precedent, not evidence of 2027 campaign activity: Portal Kombat operated a France-targeted portal within a 224-site country network. Watch for localised domains, automated republication and search manipulation.
See the source - Information operations
Documented precedent, not evidence of 2027 activity: VIGINUM imputed seven information operations in the 2026 municipal cycle to Storm-1679/Matryoshka, using fabricated media and institutional reports to suggest voting could not proceed in good security conditions and to allege vote manipulation. Watch for renewed fake-report seeding while keeping actual audience reach and election-administration effects as separate questions.
See the source
Precedent, not prediction
Documented past → this vote
Each is a past, documented case linked to this vote as precedent — not a claim that it is active here. Watch for reuse of the technique, not the name.
Documented past
Russia · GRU (Units 26165 / 74455) · 2017
MacronLeaks
CorroboratedThe April–May 2017 hack-and-leak operation against Emmanuel Macron's En Marche campaign. Spear-phishing stole campaign emails; roughly nine gigabytes of them — salted with forged documents — were dumped online on 5 May 2017, hours before France's mandatory pre-vote media blackout, then amplified as #MacronLeaks by bot networks and US alt-right accounts. It did not change the result. French authorities were cautious on attribution at the time, but the United States later indicted GRU Unit 74455 officers for the operation.
Watch for reuse
Documented past
Russia · Social Design Agency; Structura · 2022 – ongoing
Doppelganger / RRN
ConfirmedA Russia-origin information-manipulation operation that clones the websites of legitimate European and North American media and government bodies to spread pro-Kremlin, anti-Ukraine content, attributed to the Russian firms Social Design Agency and Structura and targeted by EU and US sanctions and domain seizures.
Watch for reuse
Documented past
Russia · GRU Unit 29155 with support from the Center for Geopolitical Expertise; distribution support from CopyCop · 2023 – ongoing
Storm-1516
ConfirmedA persistent Russian information-operation method that manufactures source material, launders it through false news infrastructure and amplifies it across platforms. VIGINUM analysed 77 operations through March 2025 and documented activity targeting elections and political figures in France, the United States and Germany.
Watch for reuse
Documented past
Russia · TigerWeb and an unidentified commissioning operator · 2013 – ongoing
Portal Kombat
ConfirmedA structured network of country- and locality-targeted portals that mass-republishes Russian and pro-Russian sources. VIGINUM expanded its inventory from 193 to 224 portals in early 2024, covering almost every EU member state and additional European audiences shortly before the European Parliament election.
Watch for reuse
Documented past
Indicators involving Blackcore; exact operator role unresolved · 2026
Rokh Solis
AllegedA coordinated information operation that targeted France's March 2026 municipal elections with fabricated sites and inauthentic relays across TikTok, Instagram, X and Facebook, including false or misleading attacks on several La France Insoumise candidates.
Watch for reuse
Documented past
Persistent pro-Russian information-manipulation set; VIGINUM records only probable links with Russian actors and does not establish state direction; individual operators not publicly identified · 2023 – ongoing
Storm-1679 / Matryoshka
AllegedA persistent pro-Russian information-manipulation set that seeds fabricated reports impersonating media and institutions, then amplifies them through coordinated accounts and directly pressures journalists or fact-checkers to investigate the fakes. VIGINUM treats Matryoshka, Storm-1679 and Overload as public names for the same wider set.
Watch for reuse
Previously documented in this country
Actors documented in this region
Narratives to expect
Background reading
Explore
Sources cited above
Where the date comes from
Scheduled dates come from national election authorities and are linked above. Dates can move; where one is not yet fixed by decree it is marked as expected rather than confirmed. Listing an election here is not a prediction that anything improper will occur — it is a statement about what would be worth checking if it did.