Lisbon, May 24, 2026 (Lusa Verifica) – Some 75 pages purporting to be recruitment pages for 27 national electoral commissions (CNE), including those of Portugal, Angola, Cabo Verde and Guinea-Bissau, are fake; their identities have been stolen by a network responsible for hundreds of fraudulent pages.
+++ Claim: “The National Electoral Commission has opened an application
+++ portal to recruit new staff” +++
On 17 March, over a month after the second round of the presidential elections on 8 February, Lusa detected a page purporting to be the official recruitment portal of the National Electoral Commission (CNE): https://archive.ph/5PihS.
Although hosted on Blogger, a Google platform for creating and hosting blogs, the page, which has since been removed, displayed CNE’s official logo, taken from the official website: https://archive.ph/DKWus, and a form requesting name, telephone number, email address, date of birth, gender and confirmation that the applicant was over 18 years of age.
When it was active, the site also had a redirect system to the short link https://tinyurl.com/gov-cne-pt. Every time someone tried to go back in the browser, the feature stopped working shortly afterwards because the link was removed by TinyURL (a web service that converts web addresses (URLs) into shorter links) due to a breach of its terms of use (https://archive.ph/SOgNw).
+++ Facts: the purported CNE recruitment page and 74 other similar
+++ international sites are fraudulent +++
The discovery of the purported CNE recruitment portal took place during a practical exercise as part of a work placement at Lusa, undertaken by a Cabo Verdean student, a final-year journalism student studying in Portugal.
The aim was to demonstrate how to analyse the origin of a fake page, in this case, Cabo Verde’s CNE (CNE CV), which was recently detected and ultimately led to a several-week-long investigation that uncovered hundreds of fake pages.
Following this investigation, it was discovered that the supposed Portuguese CNE page was promoted through an advertisement on Facebook that was reportedly displayed for just one hour between 13 and 14 January: https://ghostarchive.org/archive/nxUHK?wr=false (click on "Don't see the archived webpage, or is the archived page not displaying properly? Click here" if the archive link does not display the content).
According to information available in Meta’s ad library, the owner of Facebook, the source of the advert was a suspicious page for an alleged online recruitment portal, created in July 2025, apparently from Nigeria, and whose only recorded advert was that one, but with references to various CNEs in the few images available in the posts: https://archive.ph/qtKkb and https://archive.ph/0eTGj.
The image used in the ad was detected in the source code of the fake page and referred to alleged recruitment related to the presidential elections on 18 January: https://archive.ph/qIzaF.
Through forensic analysis of the page, it was found that the creator of this page and nine other fake pages, including four more CNE pages, was the "Fama" profile, created on Blogger in January 2026: https://archive.ph/zaioV.
In addition to the CNE PT and CNE CV pages, the latter has at least two distinct addresses originating from other profiles (https://archive.ph/Y4yFI and https://archive.ph/yQYox), analysis of the source code revealed hundreds of pages produced by over 70 profiles on Blogger and GitHub, a source code hosting platform, responsible for around 2,200 URLs, 75 of which were for alleged CNE recruitment campaigns from 27 countries, some from previous years, but others relating to 2026.
In all cases, some of the images were hosted on the official CNE pages of countries, including South Africa (https://archive.ph/4p4wr), Benin (https://archive.ph/9N5e6), Nigeria (https://archive.ph/drpoi), Ghana (https://archive.ph/okgwf), Zambia (https://archive.ph/QMlgu), and Portuguese-speaking African countries (PALOP) such as Angola (https://archive.ph/wv4MO), Cabo Verde and Guinea-Bissau (https://archive.ph/VrnzA).
In the case of these links from Nigeria and Zambia, which are examples of the various pages relating to those countries, the aim was to promote voter registration rather than staff recruitment. However, analysis of these and other pages suggested an apparent phishing scheme, the collection or theft of personal data through fake websites, or another fraudulent scheme designed to generate revenue through advertising.
At the end of the registration processes, which Lusa tested on dozens of pages, virtually all of them were redirected to online shops such as Chinese sites, Aliexpress and Shein (https://archive.ph/uWJxt), to websites purportedly for installing the Opera browser (a customisable web browser developed by Opera Software), and to subscriptions for paid services with telecoms operators or other suspicious destinations that were potentially malicious, some of which antivirus software blocked.
+++ Contradictory: Portugal’s CNE was unaware of the case +++The
The Lusa team sought technical assistance from the National Cybersecurity Centre (CNCS), the official body that analysed a preliminary survey of this network and concluded that the websites exhibit cross-cutting technical patterns indicative of a shared infrastructure across several fraudulent sites.
Despite the risk of phishing (the theft of personal data via fraudulent websites), the CNCS’s analysis concluded that the personal data entered into the forms available on the pages does not appear to be sent to the operators.
According to the technical report sent to Lusa, which focused on the CNE’s pages, the social engineering scheme relies on the collection of personal data without actual transmission to the operator, viral sharing via WhatsApp, and redirection to advertising pages, all while using the image of official bodies to boost credibility.
Lusa also questioned the National Election Commission on 13 May, the date on which the page was still active (https://archive.ph/uUnaf), and the CNE admitted it was unaware of the case.
In a written response sent the following day, the CNE said that "it only uses official channels for the recruitment of staff, namely its institutional website or the BEP (Civil Service Jobs), and has no ongoing recruitment procedures for staff.”
André Wemans, spokesperson for the CNE, also said that "the appropriate measures have been taken, specifically through the CNCS and by completing the necessary forms on various platforms to have the content of the blog spot in question removed".
Following this contact, the fake page was removed from Blogger, along with other fake pages of the same profile, which on 23 May was still active with six fake links: https://archive.ph/PqXW9. In recent years, some of the national electoral commissions (CNEs) in the targeted countries have also been alerted of the existence of some of these fraudulent or similar pages and have issued warnings, such as the CNEs of South Africa (https://archive.ph/kN7Fm), Cabo Verde (https://archive.ph/OnA42), Guinea-Bissau (https://archive.ph/JB43S), Nigeria (https://archive.ph/zp4UM and https://archive.ph/tq4rS), amongst others.
Some fact-checking projects in Angola (https://archive.ph/dvBiw) and the Africa Check project (whose website does not allow links to be posted), for example, have also published fact-checks on some of these fake pages, but have not realised the scale of the fraudulent network.
Lusa identified contacts linked to several of the profiles analysed, including the creators of some of these fake pages, to whom it sent requests for clarification, but has not yet received a response.
On 13 May, a response was also sought from Google, the owner of Blogger, to whom the full list of identified profiles was sent, including those set to private but with information accessible through archive services such as the digital archive Wayback Machine, and whose fraudulent pages violate Blogger’s Content Policy and Community Guidelines; however, no responses have been received nor have the profiles been removed.
This investigation, published on Sunday in partnership with Portugal’s state broadcaster, RTP’s programme 'O segredo do Algoritmo' (The Secret of the Algorithm), has resulted in a database that will be made available to international fact-checking organisations to enable further investigations.
+++ Lusa Assessment: False +++
It is false that, prior to the presidential elections, Portugal's National Electoral Commission (CNE) launched an official recruitment portal for staff on Google’s Blogger platform, which hosts dozens of similarly fake pages from other CNEs.
A major investigation found nearly 2,200 fraudulent addresses, around 1,400 of which are still active, linked to at least 73 profiles on the Blogger and GitHub platforms, and which include 75 fake CNE pages from 27 countries, including PALOP nations such as Angola, Cabo Verde and Guinea-Bissau
LYGA/MYAL // ADB.
Lusa
