Fake Social Media Accounts Created in Names of Armenian Senior Officials, Central Bank Warns of Fraudulent Documents

Several senior Armenian officials said that fake accounts were created on social media using their names and photos. The Central Bank of Armenia separately issued a warning, saying that fake documents bearing the bank's name are being circulated.

Since October 28, fake accounts have been created in the names of Parliament Speaker Ruben Rubinyan, Yerevan Mayor Tigran Avinyan, Education Minister Zhanna Andreasyan, Environment Minister Hambardzum Matevosyan, Economy Minister Gevorg Papoyan and human rights defender Anahit Manasyan. Senior Armenian officials and civil society representatives have been targets of similar attacks before, but the latest wave was recorded at the end of 2025 and the beginning of 2026.

Officials and their press secretaries urged citizens, employees and partners of relevant agencies to ignore messages sent from these accounts, not to share personal or official information and not to make any money transfers. They also asked that the accounts be blocked and that platforms be notified about them.

The Central Bank published examples of fraudulent documents and said that cases have become more frequent in which fraudsters try to mislead citizens by presenting forged powers of attorney, certificates or other documents, allegedly issued by the bank. "Using this method, fraudsters try to obtain loans from various financial organizations in the names of citizens or carry out other fraudulent operations," the bank said.

The Armenian government has not yet commented on the attacks.

Arthur Papyan, co-founder of the cybersecurity organization CyberHub, told OC Media that he does not consider it a coincidence that representatives of a specific government group were targeted in the same period. "In my view, this is clearly linked to attempts to undermine public trust. People begin to doubt whether information published by an official is genuine or fake, and whether this person actually published it or not," he said.

According to Papyan, from October 2025 to the end of January 2026, CyberHub recorded numerous attempts to act on behalf of other persons on several platforms, especially WhatsApp and Facebook. Facebook remains the main platform for internal and public communication of the government. Text messages recorded in that period appeared to have been translated using Google Translate or artificial intelligence, and some texts also contained leftover Russian words.

Papyan warned that this circumstance is not enough to conclude that Russia is behind the attacks, since the Russian language is widely used in post-Soviet countries. In his assessment, the actions were likely organized by people with some knowledge of the Armenian context and could have been part of a "hybrid attack" originating from Azerbaijan or Russia.

"It seems the aim is to intimidate people and involve them in some kind of illegal activity. This was very similar to an attempt to form a espionage network," Papyan said. He also said that there is currently not enough information to determine who stands behind the latest cases and what the motive was. He suspects that useful information could be obtained by applying to Meta.

"Can we say that this latest case resembles previous attacks? Yes, in many respects, because the perpetrators apparently know the local context, copy profile photos from user accounts and so on. However, going further than assumptions can be dangerous, at least in our case, because we try to draw conclusions based on facts," Papyan added.