The Centre for Cybersecurity Belgium has issued an international alert for a sophisticated threat actor that appears to target politicians exclusively during World Cup matches, compromise their accounts, publish a single discriminatory statement indistinguishable from the account holder's actual opinions, and vanish.
The operation, which the CCB has designated APT-Mirror, has now struck three times in eleven days. The attack pattern is identical in each case: one politician, one platform, one statement, zero technical traces, and content that, by coincidence, perfectly mirrors what the victim thinks. The category of prejudice varies. The attacker adapts to whatever the target has available.
“This versatility is what makes APT-Mirror so dangerous,” a CCB analyst said. “Some targets have racism on file. Some have misogyny. Some have both. The attacker works with the existing inventory. We have never seen this level of personalisation in a cyber operation.”
The first known incident occurred on June 10, when a Belgian party official's Instagram was used to send a misogynistic message to a comedian in response to a radio segment on FWB budget cuts. The official claimed the account was hacked. The attacker had 900 followers to work with and used them to send one message to one person, then retired.
The second incident struck a Paraguayan senator whose X account published a racist tirade against Kylian Mbappé following Paraguay's elimination by France. The senator's Instagram was subsequently declared compromised, even as the “hacked” account continued posting about the same footballer, in the same tone, for several more hours. The attacker eventually announced they had recovered control of the account, which then resumed posting in the same voice, about different topics.
“That's the hallmark of APT-Mirror,” the analyst said. “The transition between hacked content and authentic content is indistinguishable. Linguistically, stylistically, ideologically, there is no detectable boundary. It's either the most advanced impersonation in cyber history, or it isn't one.”
The CCB has now issued a preemptive advisory for former Spanish Prime Minister Mariano Rajoy, whose World Cup column this week described France's squad as playing “without Frenchmen.” The column was submitted as a voice memo and transcribed by an intern at El Debate.
“The voice memo format presents a novel challenge,” the analyst conceded. “If Rajoy claims his voice was hacked, we will need to assess whether someone synthesised his vocal patterns, his views on immigration, and his specific understanding of French nationality law, which appears to be none. We are preparing for this scenario.”
Asked whether APT-Mirror could be a single individual or a state-sponsored group, the analyst said the CCB was keeping all options open. “The only profile we can rule out,” he added, “is someone whose views differ from the target's. So far, every attacker has agreed with their victim completely. That is either the most remarkable coincidence in intelligence history, or it is not a coincidence.”
Interpol has joined the investigation. The threat level has been raised to “World Cup,” a classification created specifically for this tournament. The CCB confirmed it is monitoring all elected officials with access to a phone, a World Cup opinion column, or an opinion.