Digital Forensic Analysis Reveals 326 Coordinated Accounts Supporting Florentino and Attacking Riquelme

A consultancy specializing in digital analysis and European cyber intelligence has identified a network of 326 accounts on X deemed "potentially inauthentic" that played a coordinated role in conversations regarding Real Madrid's presidential election. According to the report, compiled using digital forensic analysis techniques (WEBINT), the detected activity was divided into two directions: strengthening Florentino Pérez's public image and spreading critical messages against businessman Enrique Riquelme, who is the main alternative to the current president in the election process. An investigation run by candidate Riquelme said it had analyzed more than 119,000 campaign-related mentions and concluded that the detected accounts generated more than 29,000 publications, responses and reposts during the two weeks following the election announcement on May 14. According to the authors, this volume represents nearly a quarter of all digital conversations generated around the election. This study describes a structure divided into two levels. On the one hand, there is the core of eleven older and seemingly credible accounts, the so-called 'Vector Prestige', which serve as generators of the narrative in favor of Florentino Pérez. On the other hand, there is a group of 315 lower quality profiles, the so-called 'Vector Swarm', whose aim is to amplify the messages and increase the pressure on Riquelme through more aggressive publicity. Analysts stated that the ecosystem supporting Florentino Pérez has shown activity since 2022, although they detected an intensification after the vote. According to the report, during May 2026, previously inactive accounts were reactivated, and new profiles were created that began participating massively in conversations related to the election process. Among the key indicators used to categorize activity as potentially inauthentic are the simultaneous reactivation of old accounts, frequent username changes, publications focused on a single theme, coordinated amplification patterns, and discrepancies between users' stated identities and certain technical metadata. The consultant identified several key moments in the campaign where network activity spiked, coinciding with announcements made by Enrique Riquelme, such as the launch of his selection program, the announcement of player transfers, or the initiative launched during the Champions League final, with buses marked in Budapest. Also noted was the change in narrative at the end of May, when most publications switched to supporting Florentino Pérez's proposal to open 5% of the club's capital to foreign investors. While the conclusions are quite firm, the document adds precision that the findings do not constitute an attribution of ownership or establish a direct link between the detected activity and any particular candidate, campaign, or third party. This investigation is limited to the description of behavioral patterns that, according to the authors, are compatible with a coordinated operation to digitally influence in the context of the Real Madrid elections.