Russian Advertising Infrastructure in Hungarian Pro-Government Media

Most online advertising is not placed by a human picking a website. It is bought and sold automatically, in milliseconds, through a chain of intermediaries. When you load a news article, dozens of companies may simultaneously bid to show you an advertisement. The publisher does not know in advance who will win. The advertiser may not know exactly where their ad appeared. This opacity is normal commercial behaviour in programmatic advertising. It is also, structurally, an ideal environment for covert influence operations.

To address this, the Internet Advertising Bureau (IAB), the industry standards body, created a transparency framework built on three interlocking components: ads.txt, sellers.json, and the Transparency and Consent Framework. Together they form the public record of who is authorised to place advertising on any given website, and under what terms.

ads.txt: The Publisher's Declaration

Every website that sells advertising programmatically must publish a plain text file at a predictable address, for example origo.hu/ads.txt. This file lists every company authorised to sell that website's advertising inventory. Each line declares an advertising network, an account identifier, and whether the relationship is direct or goes through a reseller.

A DIRECT entry means the publisher has an active commercial relationship with that network. It requires an account to be opened, terms to be agreed, and ongoing maintenance. It is a deliberate, sustained choice.

sellers.json: The Network's Confirmation

The complementary file, sellers.json, is published by each advertising network rather than by the publisher. It lists all the publishers the network works with, confirmed from the network's own records. When an ads.txt entry on a publisher's site can be matched to a corresponding entry in the network's sellers.json, the relationship is independently verified from both sides.

When a seller ID appears in a publisher's ads.txt but cannot be found in the network's sellers.json, the relationship is declared by one party only. It cannot be verified. This is a meaningful anomaly: a legitimate commercial advertising relationship should appear in both files.

The IAB Transparency and Consent Framework

The IAB's Transparency and Consent Framework (TCF) is the advertising industry's primary mechanism for managing GDPR consent in programmatic advertising. It maintains a Global Vendor List, a public registry of advertising technology companies that have declared what data they collect, for what purposes, and under what legal basis. While the TCF is a private industry standard rather than a legal requirement, participation is effectively required for commercial operation: most major ad exchanges will not transact with companies outside it. A company appearing in a publisher's ads.txt but absent from the Global Vendor List is operating outside the mainstream transparency infrastructure of the European programmatic ecosystem, though this is not in itself a GDPR violation. Yandex is registered on the Global Vendor List as vendor ID 128. Its presence on Hungarian publisher sites is therefore not a registration failure.

KESMA

The Central European Press and Media Foundation (KESMA) is a conglomerate aligned with Hungary's governing Fidesz party. On 28 November 2018, the owners of 476 media outlets donated them to KESMA in a single coordinated action. These outlets, including national newspapers, regional county papers and online portals, were declared of "strategic national importance" by the government, exempting the merger from scrutiny by Hungary's competition authority.

As of 2025, KESMA controls approximately 470 outlets across print, television, radio and digital platforms, representing approximately 80% of Hungary's news and public affairs media market by revenue.

All KESMA outlets share centralised infrastructure managed by Mediaworks, KESMA's publishing arm. Our data shows that origo.hu, magyarnemzet.hu, ripost.hu and associated KESMA outlets share an identical programmatic advertising file. When KESMA's advertising team authorises an ad network, including high-risk ones, that decision applies across all sites sharing the file simultaneously. A single authorisation can give a foreign actor access to multiple major news outlets at once.

A second pro-government bloc, Indamedia, is linked to government-aligned business figures and controls index.hu and blikk.hu. Blikk, Hungary's most-read tabloid, was acquired from Swiss publisher Ringier by Indamedia in late 2025.

Yandex Has Direct Access to 23 Pro-Government Sites

Yandex, Russia's largest technology company, holds active direct advertising partnerships with 23 monitored Hungarian news sites. Every one of these sites is pro-government. No independent Hungarian outlet in our sample carries a Yandex direct entry.

The Russian state holds effective control over Yandex through the Public Interest Foundation, a body created in 2019 whose board includes the CEO of VTB Capital, the investment arm of VTB Bank. VTB Bank is majority state-owned, with the Russian government holding over 60% of its equity through federal agencies.8 The Public Interest Foundation holds veto powers over share consolidations above 10% and over decisions concerning how Yandex uses personal data

The relationships are organised around two separate accounts, reflecting the two main ownership groups in Hungary's pro-government media ecosystem.

Account 109358832 appears on 20 sites, all managed through Mediaworks, the central publishing infrastructure of KESMA, the Central European Press and Media Foundation. These sites include origo.hu, magyarnemzet.hu, ripost.hu, pestisracok.hu, hirtv.hu, borsonline.hu and metropol.hu at the national level, and all 12 KESMA regional county papers including baon.hu, haon.hu, teol.hu and others. This account also appears on mindmegette.hu, a lifestyle site whose programmatic file is identical to the KESMA national sites, suggesting affiliation with the KESMA infrastructure that was not previously documented.

Account 305563103 appears on blikk.hu and glamour.hu, both of which are properties of Indamedia, the media group linked to government-aligned business figures that acquired these titles from Swiss publisher Ringier in late 2025.

The two accounts confirm that the two main pro-government ownership groups, KESMA and Indamedia, each independently maintain a direct commercial relationship with Yandex.
None of these entries carry an IAB certification tag, which is the mechanism that would allow independent verification of the buyer identity behind the relationship.

What This Access Makes Possible

A direct advertising relationship with 23 Hungarian news sites, held by a Russian state-linked platform four days before a national election, creates a technical capability that should be understood precisely.

Yandex's advertising formats include native advertising, content that is designed to be visually indistinguishable from editorial articles. Native ads appear in the same font, the same layout, with headlines and images matching the host site's style. They do not systematically carry the word "advertisement" prominently. On a site like origo.hu, a native ad unit will appears to the reader as another origo.hu article.

Yandex's access is declared as direct, meaning it does not pass through an intermediary exchange that might apply brand safety filters, content review, or political advertising rules. Content served through this channel would not appear in Google's Ad Transparency Centre, Meta's Ad Library, or any of the platforms that researchers and regulators currently use to monitor political advertising online.

This does not establish that Yandex has used this access to place political content in the current election period. What it establishes is that the infrastructure exists, that it was deliberately created, that it is being actively maintained by both ownership groups independently, and that it would be extremely difficult to detect if used.

The Shell Company Cluster

Within the KESMA ads.txt files, a second finding warrants attention alongside the Yandex entries.

A single seller identifier, number 90643844, appears declared as a direct partner across five different advertising network domains simultaneously: adipolo.com, adipolosolutions.com, pmbmonetize.com, opamarketplace.com and smartadline.com. None of these five domains carry IAB certification tags. None appear in the sellers.json registry of any major SSP.

The standard programmatic advertising model assigns a unique seller identifier to each publisher within each network. A single identifier shared across five network domains, with no public registry presence, is not consistent with normal commercial advertising operations. It is consistent with a cluster of related entities operating under a shared infrastructure, structured to obscure the ultimate controller of the advertising inventory.

This matters because inventory that flows through an unverifiable shell cluster is invisible to the standard fraud detection and brand safety tools that advertisers and regulators rely on. An advertiser buying through one of these five domains cannot verify where their money goes or what content it is funding. A political operator buying through this cluster could place content on KESMA sites that cannot be traced to any named entity.

The shell cluster appears identically on origo.hu, magyarnemzet.hu, ripost.hu and the associated KESMA properties. It does not appear on independent outlets.

Transparency Gaps and Anomalies

Beyond the primary findings, the scan identified a broader pattern of infrastructure anomalies among the smaller advertising networks referenced in Hungarian ads.txt files. These are weaker signals than the Yandex finding, but they form part of the same picture of a supply chain that is structurally less transparent on pro-government sites than on independent ones.

Across all 58 scanned sites, 529 findings related to sellers.json anomalies were recorded. These include 109 cases where an advertising network's sellers.json file contains malformed or unparseable code, 81 cases where the network's domain does not resolve in DNS at all, and 24 cases where the domain exists but has no valid security certificate.

Two domains returned an empty response body with an HTTP 200 status code: adunity.com and coxmt.com. An empty 200 response means the server is reachable and aware of the sellers.json URL but is actively returning no content. This is more consistent with deliberate blocking of monitoring tools than with ordinary non-compliance.

What This Report Does and Does Not Claim

This report documents authorisation and infrastructure. It does not document active influence operations or proven voter impact.

What the public files establish is that Yandex holds direct, authorised access to 23 Hungarian pro-government news sites; that this access is absent from every independent outlet in the sample; that the access is maintained by two separate ownership groups independently; that it operates outside the standard monitoring pipelines used by researchers and regulators.

Whether this infrastructure has been used to place content in the current election period, and whether any such content has affected voter behaviour, are questions that this methodology cannot answer. They are questions that the appropriate authorities, the European Commission, ODIHR and the Hungarian National Election Commission, have the mandate and the standing to pursue.

All findings in this report can be independently verified by any researcher. The starting point for verification is the publisher's ads.txt file, readable in any browser at the publisher's domain followed by /ads.txt.

Methodology Note

58 of 61 monitored sites were successfully scanned on 8 April 2026. Seven sites returned fetch errors: atlatszo.hu, direkt36.hu, azonnali.hu, merce.hu and noizz.hu (independent outlets that likely do not publish ads.txt), nemzeti-sport.hu and peol.hu (KESMA properties with DNS failures). Two sites, tv2.hu and hir.ma, returned empty ads.txt files with no error, meaning their supply chains are not publicly declared.