Digital Rights Review: Online Aggression, Conspiracy Theories, Seasonal Scams

Dodik also likened Bosniaks to “amoebas moving in” and calling for the “prevention of further Islamisation”. Despite repeated fines from the Central Election Commission, such narratives continue to circulate offline and online, reinforcing inter-ethnic hostility.

In Croatia, activities by far-right groups were also amplified across social media and online forums after activists disrupted the ‘Days of Serbian Culture’ in Split and Zagreb. Masked men chanted slogans of the World War II-era Nazi-allied Ustasha movement, forcibly interrupted cultural events and spray-painted threats such as “Kill the Serb”. Meanwhile, in an online statement, the Croatian Disabled Homeland War Veterans’ Association alleged that the nationalist “Greater Serbia” narrative has “metastasised” throughout the Serb community in Croatia, citing the cultural events and anti-fascist marches as ‘proof’.

In North Macedonia, which has a large ethnic Albanian population, a government event marking the annual ‘Albanian Alphabet Day’ sparked ethnic slurs and hate speech comments online targeting the Albanians minority and Macedonian officials.

Serbia saw a comparable case: a photo of two students hugging during a protest, one wearing a hijab and the other a traditional šajkača (Serbian cap), provoked a torrent of online hostility and even death threats against the students.

In Montenegro, following reports of an attack on a Montenegrin man allegedly by foreign nationals (initially and incorrectly identified as Turkish) a wave of online hate speech targeting Turks emerged. This was followed by street protests featuring chants such as “Turks out” and “Kill the Turk”, as well as acts of vandalism against Turkish-owned restaurants and shops and a vehicle bearing Turkish license plates. Several politicians further fuelled the situation by spreading disinformation about what they alleged “Ottomanisation” of the country. In this climate, the government decided to abolish Montenegro’s visa-free regime for Turkish citizens.

In another case, a viral New Year’s image was misused to spread derogatory and hate-filled comments targeting residents of Ulcinj, a Montenegrin town with a significant Albanian population.

In Kosovo, AI-generated content has been misused in several cases to spread disinformation, including false depictions of senior politicians from Kosovo and Serbia appearing together. In another instance, such content was used to circulate claims about the existence of a secret deal to divide northern Kosovo. These false narratives caused confusion and some online insults directed at politicians.

BIRN’s monitors reported that such cases demonstrate how political rhetoric, disinformation and offline interventions interact with online amplification to normalise hate speech and ethnic intolerance, deepening societal divisions.

Gender-based violence and sexual abuse

International Women’s Day protest march in Tirana in March 2025. Photo: Nensi Bogdani/BIRN.

Gender-based violence and sexual abuse cases were also recorded across multiple countries, disproportionately targeting women and children. In Bosnia and Herzegovina, the murder of a woman by her partner, sensationalised through media publication of images of the deceased, prompted victim-blaming comments online. In Turkey, a man used a Facebook post to announce that he had killed his wife.

Albanian police meanwhile staged multiple operations targeting reported cases of stalking, online child abuse, sexual harassment and blackmail involving private photographs.

There were several cases of abuse involving lawmakers. In Serbia, MP Nebojsa Bakarec, posted intimate photos and derogatory remarks about students and activists involved in the ongoing protest movement in the country, illustrating how political, interpersonal and gendered harassment often overlap online. In Hungary, opposition politician Noemi Halasz reported being subjected to online harassment and image-based sexual abuse, and receiving 14 emails containing death threats from abusers who explicitly cited political motives. In Montenegro, MP Maja Vucelic also received numerous misogynist and sexist insults online after criticising a statement by the president of the Montenegrin parliament.

In Montenegro, images of peer violence among minors, filmed fights and attacks were circulated online. In North Macedonia and Bosnia and Herzegovina, violent bullying incidents were also recorded by peers and uploaded online, echoing the patterns observed in Montenegro.

Another case in North Macedonia concerned a minor sexually assaulting a younger child on camera, followed by blackmail and online dissemination of the footage, while arrests were reported for online child sexual abuse, and image-based sexual abuse against an adult woman. In Montenegro, a man was arrested on suspicion of image-based child sexual exploitation.

Romania documented several high-severity cases, including the online circulation of images suggesting sexual assault by the mayor of Livezile. The mayor denied the allegation, claiming the images had been manipulated or generated by AI; however, he was arrested and is under investigation for sexual assault, offences against public morals and the violation of privacy.

In separate cases recently, Romanian police have also made arrests linked to rape, sextortion, human trafficking and the production of child sexual abuse material.

In Albania, online outlets circulated photos of Tirana’s end-of-year decorations, claiming, without any factual basis, that the rainbow-coloured lights were part of an “LGBTQ+ agenda”. This narrative provoked online hostility and further reinforced the ongoing discriminatory discourse targeting women and LGBTQ+ activists and communities in the country. These attacks have been recently amplified in connection with a wave of disinformation surrounding the recently adopted gender equality law.

BIRN’s monitors reported that these cases demonstrate how digital spaces are closely intertwined with and mirror broader societal issues around gender-based discrimination and sexual violence. BIRN’s annual digital rights report argued that these challenges require a response that combines legal accountability and proactive protection and support for vulnerable groups, recognising how online violations reinforce and exacerbate offline inequalities.

Conspiracies and health-related disinformation

A chemist in Debrecen, Hungary prepares to administer a COVID-19 vaccine to a patient, December 2020. Photo: EPA/ZSOLT CZEGLEDI.

Several conspiracy narratives were recorded across the region by BIRN monitors, during November-December 2025, with some resurfacing from the COVID-19 pandemic period.

In Albania, cardiac surgeon Edvin Prifti promoted claims that COVID-19 vaccines constituted “gene therapy”, damaged reproductive tissues, and caused micro-clots. However, the cited study does not mention the claimed link between vaccination history and the consequences of long COVID-19. These scientifically misleading assertions appeared in more than 20 online articles, illustrating how professional authority can amplify false health information and enable fringe narratives to penetrate mainstream spaces.

In Hungary, the public media’s news website published an article claiming that certain COVID-19 vaccines cause cancer. The article cited a study and asserted that vaccination could increase the incidence of certain types of cancer by up to 69 per cent. However, experts and independent fact-checkers have noted that the cited study does not establish a causal link between vaccines and cancer, a limitation also explicitly acknowledged by the study itself.

In North Macedonia, social media posts called for life imprisonment for doctors who “trusted Bill Gates’ COVID-19 vaccines”, framing public health professionals as traitors aligned with foreign interests. Other posts falsely claimed that every vaccinated person must receive a daily dose of glutathione. Such content spread rapidly across multiple groups before being flagged by fact-checkers.

Meanwhile, in Kosovo, health-related disinformation remains a persistent concern. Recent cases include promotions for products falsely claiming to restore hearing; and AI-generated content promoting cures to erectile dysfunction and hypertension, many of which have been debunked by fact-checkers. Similar cases were recorded in North Macedonia too, where images of doctors were abused in deepfake videos promoting fake cures and health products for arthritis and osteoporosis.

Romania faced a wave of controversy and conspiracy theories targeting dams and water infrastructure, including claims that facilities had been deliberately emptied or dismantled. Some narratives invoked the war in Ukraine or an imminent conflict, alleging that the EU or NATO had ordered the removal of so-called “strategic obstacles”, or that foreign actors were covertly privatising critical infrastructure.

These claims gained traction during a local water crisis in Prahova County that affected more than 100,000 residents, potentially eroding public trust in state institutions and essential services. Radio Free Europe and fact-checkers published detailed debunkings of these narratives.

BIRN’s monitors highlighted how such cases reveal how conspiratorial narratives are not isolated incidents but part of a broader, adaptive ecosystem that exploits societal fears, undermines expertise, and erodes public trust in institutions, science and facts. BIRN’s annual digital rights report argued that cases like this reaffirm the crucial role of independent fact-checking and the need for media and information literacy efforts.

Black Friday shoppers in London, November 2025. Photo illustration: EPA/ANDY RAIN.

Online fraud across the region surged around seasonal events, particularly ‘Black Friday’, highlighting how scammers systematically exploit high-volume shopping periods and heightened digital activity, BIRN’s monitors found.

In Croatia, authorities recorded a sharp increase in fake ads, counterfeit web shops, and social-media promotions offering “unbelievable discounts” around Black Friday. The authorities responded with the nationwide awareness campaign ‘Let’s Be Real’, combining technical guidance with broad media outreach.

Montenegro also reported a spike in Black Friday-related banking scams, prompting Hipotekarna Bank to warn customers about phishing sites impersonating the bank. Similarly, Sephora in Serbia and Romania alerted consumers to fraudulent campaigns tied to Black Friday, using the company’s branding, underscoring how international retail chains are recurrent targets for cross-border impersonation schemes.

In Serbia, the national Computer Emergency Response Team warned that holiday periods consistently bring elevated online risks, documenting increases in phishing attempts, fake e-commerce stores, dating-platform fraud, “get-rich-quick” ads and deceptive travel offers.

Beyond ‘seasonal’ fraud, a series of other familiar types of scams were also registered throughout Southeast Europe during the monitoring period. Croatia reported multiple crypto-investment frauds resulting in losses of tens of thousands of euros, signalling the enduring appeal of high-risk, high-return narratives used by scammers. Police in Split in Croatia also arrested a man for 14 criminal offences of personal data abuse and fraud.

In Serbia, phishing campaigns, fraudulent emails, and password-cracking attempts aimed at data compromise and exfiltration targeted the Belgrade Centre for Security Policy. These activities have been reportedly linked to the hacker group Forest Blizzard, which Western security services say is run by Russia’s military intelligence service, the GRU.

Albania reported sophisticated international phishing campaigns targeting both institutions and citizens, some leading to the arrest of organised groups, extraditions of foreign fugitives, and the detection of fake-loan and stock-trading schemes circulating on social media. These cases highlight exposure to externally coordinated cybercrime networks.

Institutional impersonation also remained widespread, exploiting public trust in institutions to steal personal data or extort payments. Scam campaigns mimicked Serbia’s Ministry of Internal Affairs and the High-Tech Crime Prosecutor’s Office, North Macedonia’s Bureau for Public Security, Ministry of Finance, and national post office, Romania’s Tax Agency, and Croatia’s Criminal Police Department and digital wallet services.

In Turkey, corporate impersonation scams circulated fabricated interviews with Baykar executives to lure citizens into fraudulent investment schemes, demonstrating how the reputational capital of major companies is misused for financial fraud.

Institutional responses recorded by BIRN monitors across the region varied: some countries implemented proactive awareness campaigns and technical alerts, while others relied on reactive measures such as arrests, detentions, or investigations after harm has occurred.

Across these cases, regional trends pointed to an ecosystem of opportunistic fraud built on brand impersonation, seasonal social-engineering tactics, and transnational criminal networks, which BIRN’s annual digital rights report said highlights the need for coordinated regional strategies and collaborative prevention efforts.

Monitoring: Romania was covered by Adina Florea, Serbia by Tijana Uzelac, Turkey by Hamdi Firat Buyuk, Albania by Nensi Bogdani, Montenegro by Djurdja Radulovic, Kosovo by Flaka Isufi, North Macedonia by Bojan Stojkovski and Goce Trpkovski, Hungary by Akos Keller-Alant, Bosnia and Herzegovina by Selma Melez, Croatia by Sandra Junicic.