Three Layers of Coordination: How Fidesz Coordinates Hungarian TikTok Before the 2026 Elections

• Coordination score: 74.0/100 — CRITICAL. Blind algorithmic analysis of 17 Hungarian TikTok accounts detected systematic coordination patterns characteristic of a centrally managed information operation.

• 22,105 users (22.8%) comment across 2+ accounts in the network — significantly above normal cross-platform engagement levels.

• 18,566 temporal sync events (videos published within 30 minutes of each other), including 792 ultra-syncs within 60 seconds.

• Stealth hashtag tactic: 5 of 10 Megafon influencers publish 65–100% of videos without a single hashtag, defeating standard hashtag-based coordination detection.

• Escalation: weekly sync events grew at +84/week from November 2025 to March 2026 as elections approach.

• Three KESMA state media outlets (Origo.hu, Mandiner, Hír TV) — all owned by the same pro-government foundation — form the densest sync cluster in the entire network (1,206 events between Origo and Hír TV alone).

1.1 Stealth Hashtag Tactic

The most striking finding: deliberate hashtag avoidance by the majority of Megafon influencers. Standard TikTok coordination detection relies on identifying accounts using identical hashtags. The Megafon network has effectively neutralized this method.

These 5 Megafon accounts produced 1,739 videos over 120 days with near-zero hashtag footprint. Yet they maintain significant audience overlap: 30–44% of their commenters also comment on Orbán’s TikTok.

Full interactive version

1.2 Temporal Synchronization & Escalation

The analysis detected 18,566 cases of two accounts publishing within 30 minutes of each other, 9,360 within 15 minutes, 3,408 within 5 minutes, and 792 within 60 seconds. The sub-60-second co-publications are particularly significant — coincidental timing at this granularity is extremely improbable.

Weekly sync events grew at +84 events/week throughout the observation period. By mid-March 2026, weekly sync exceeded 2,100 events. This escalation coincides with the launch of the anonymous AI bot campaign identified by NewsGuard (see Layer 2).

1.3 Top Synchronization Pairs

Note the type column: 5 of top 10 pairs are KESMA ↔ Megafon cross-sector links — these are the analytically most significant, connecting a government-controlled media conglomerate with nominally independent influencers.

1.4 KESMA: One Owner, Three “Independent” Outlets

A critical structural finding: all three media outlets in the core cluster — Origo.hu, Mandiner, and Hír TV — are assets of the Central European Press and Media Foundation (KESMA), the pro-government media conglomerate controlling over 400 Hungarian media entities. Hír TV operates under the subdomain hirtv.origo.hu, confirming platform integration.

KESMA was established in November 2018 when Orbán-allied business owners donated media holdings to a single foundation. The government declared the merger “nationally strategic,” bypassing competition authority review. All outlets are managed by Mediaworks, previously owned by Lőrinc Mészáros, Orbán’s closest business ally.

This means the top pair — hirtv_hu ↔ Origo.hu (1,206 events) — represents intra-company coordination, not independent editorial convergence. The more significant finding is the cross-sector synchronization between KESMA outlets and external Megafon influencers who are not formally part of the media holding.

1.5 Core Cluster

1.6 Audience Overlap

Of 96,781 unique commenters, 22,105 (22.8%) comment on 2+ accounts. 10,223 suspicious users flagged. 3,721 duplicate comments across channels. Orbán audience penetration shows that 24–44% of each satellite account’s commenters also engage with the PM’s TikTok — the ecosystem functions as a hub-and-spoke model with Orbán at the centre.

1.7 Most Suspicious Videos: What Coordinated Content Looks Like

Real TikTok covers from videos scoring highest on our composite suspicion metric (suspicious commenter concentration + multi-account users + ultra-sync). Each card shows the sync partner and time gap. Click to view the original video.

Hortay Olivér Elindult az évszázad beruházása! ⚠ 100% suspicious⚡ hirtv_hu (31s) 👁 1,075 · ❤ 136 · Score: 98.5	mandiner.hu Orbán Viktor: Azt akarjuk, hogy mind Brüsszelben… ⚠ 100% suspicious⚡ Trombitas (4s) 👁 995 · ❤ 76 · Score: 94.5	Kristóf Trombitas magasban a zászlók! #orbánviktor #magyarország ⚠ 100% suspicious⚡ Deák (6s) 👁 452 · ❤ 37 · Score: 95.4
Dániel Bohár EZT LÁTNI KELL! Orbán Viktor az Európia Unió… ⚠ 100% suspicious⚡ Origo.hu (32s) 👁 3,731 · ❤ 374 · Score: 95.7	hirtv_hu A valaha volt legnagyobb Békemenet. A hazádnak… ⚠ 100% suspicious⚡ RTL Hungary (22s) 👁 516 · ❤ 40 · Score: 94.7	Origo.hu Csak idő kérdése és többen lesznek a háború ellen… ⚠ 100% suspicious⚡ mandiner.hu (43s) 👁 1,031 · ❤ 57 · Score: 91.9
Stefi Déri Jövőre folytatjuk! ⚠ 100% suspicious⚡ RTL Hungary (49s) 👁 443 · ❤ 48 · Score: 97.9	Szarvas Szilveszter Na ki a király? Naná, hogy Orbán Viktor! ⚠ 86% suspicious⚡ Origo.hu (24s) 👁 2,037 · ❤ 201 · Score: 90.5	Péter Szijjártó Van itt egy komoly tévedés: Zelenszkij szerint… ⚠ 80% suspicious⚡ Origo.hu (52s) 👁 2,276 · ❤ 255 · Score: 88.6

Suspicion score: suspicious commenter % (40 wt) + multi-account % (25 wt) + ultra-sync flag (20 wt) + ER anomaly (15 wt). Minimum 5 commenters per video. Out of 8,325 videos processed, 1,420 had ultra-sync events; top 50 scored 87.8–98.5.

In March 2026, NewsGuard published an investigation identifying a parallel influence operation on TikTok: a network of 34 anonymous accounts using AI-generated videos to promote Orbán and discredit Magyar. TikTok confirmed that these accounts were “part of a covert influence operation.”

• 22 of 34 accounts were created within two days in January 2026 — precisely when our data shows a sharp escalation in Megafon network coordination.

• AI-generated fake news anchors and fabricated experts were used to attack Magyar.

• Deepfakes of Johnny Depp, Leonardo DiCaprio and Jake Paul delivered anti-Magyar messages.

• The videos accumulated approximately 10 million views.

The two-layer architecture is significant: the public layer (Megafon influencers + KESMA media, documented in this report) maintains plausible deniability using real people with established audiences, while the covert layer (anonymous AI bots) delivers direct reputation destruction that public figures cannot undertake.

NewsGuard also identified Russian Matryoshka campaign activity on X and Telegram — fabricated reports, including fake Microsoft-branded reports about Ukrainian cyberattacks on Hungary, aimed at boosting the pro-Russia Orbán position.

TikTok itself labels three accounts in our dataset — Origo.hu, Mandiner, and Hír TV — as “state-affiliated media.” This institutional label independently confirms our algorithmic finding that these accounts form the densest synchronization cluster.

Critically: the Megafon influencers carry no such label. They function as nominally independent content creators, despite receiving funding, training and content direction from the Megafon Központ organization.

TikTok stated on March 18, 2026, that it had removed four networks “targeting the political discourse in Hungary” in the preceding four months, and confirmed that the 34 anonymous accounts identified by NewsGuard were part of a “covert influence operation” that the platform “had previously disrupted.”

1. A multi-layered information operation. Three independent detection methods — blind algorithmic analysis, NewsGuard investigative journalism, and TikTok’s own platform labels — converge on the same conclusion: a coordinated campaign designed to amplify Fidesz narratives while evading standard detection methods.

2. The stealth hashtag tactic is methodologically significant. Traditional social media coordination detection relies on shared hashtags, URLs, or content fingerprints. The Megafon network’s deliberate elimination of hashtags represents an adaptation to known detection methods — identified in this study only through simultaneous multi-signal analysis.

3. KESMA ownership explains intra-media sync but not cross-sector coordination. The top sync pairs link KESMA media with external Megafon influencers and Fidesz politicians who are not formally part of the media holding — the analytically most significant finding.

4. Escalation coincides with the campaign period. Weekly sync events grew at +84/week, with peak volumes in mid-March 2026. As political scientist Botond Feledy noted: “The weak electoral stance of Fidesz might have pulled the emergency intervention from Russia in this last stage of the campaign.”

5. Polls: Fidesz 39% vs Tisza 48% (Politico, March 19, 2026) ahead of the April 12 elections. The outcome will determine whether Orbán — described by analysts as “Putin’s most direct channel of influence within the EU” — retains power.