Yuri Klyufas, president of the Ukrainian National Association of Canada, received an email allegedly from Kyrylo Budanov, the head of the Presidential Office. He asked to "provide active media and information support" for the return of Ukrainian citizens to their homeland. The letter looked convincing—until you looked at the sender's address.

The address was not official. The letter came from a mailbox on a commercial email service: [email protected]—no connection to official government domains. The Presidential Office confirmed: the mailing was fake.

Why this particular legend—and why now

The choice of topic is not accidental. After his appointment as head of the PO in January 2025, Budanov made the return of Ukrainians from abroad one of his public priorities. According to RBC-Ukraine, he insists that mass return is only possible after the end of hostilities, security guarantees, and economic recovery. The topic is actively present in the media space—and that is precisely why the legend about "Budanov's request to facilitate the return" sounds plausible to someone who follows Ukrainian news.

Diaspora organizations are a natural target: they have authority in communities abroad, media channels, and a habit of interacting with Ukrainian state institutions. A letter asking for "media support" rather than money looks less suspicious than typical fraud.

A scheme we've seen before

This is not the first time Ukraine has detected phishing mailings allegedly from high-ranking officials or state bodies. According to Detector Media, similar schemes previously used the names of the State Tax Service and other agencies—with the difference that back then attachments contained malicious software. In the case of the "Budanov letter," only a request for media cooperation is publicly known, but the PO did not disclose the full contents of the letters and possible attachments.

"Manual management in the system of power is fertile ground for the growth of corruption"

Kyrylo Budanov, head of the PO—on the transparency of state institutions

The irony is that Budanov's very openness and public visibility as a new face of the PO made him a convenient brand for counterfeiting: he is active in the media space, the topic of citizen returns is real, and his name is more recognizable abroad than most officials.

What is known and what was not disclosed

• The letter was received by at least one recipient—Yuri Klyufas from Canada. The PO did not specify the scale of the mailing.
• The purpose of the attack—manipulation of diaspora media space or contact collection—was not publicly determined.
• Cyberpolice did not publicly join the investigation, at least not officially.
• The PO did not explain whether the letters contained links or attachments with potentially malicious code.

If the goal was not a technical attack but an information operation—creating confusion around the topic of Ukrainian returns and discrediting the PO among the diaspora—then the success of the operation can only be assessed once it becomes known how many organizations received the letters and how they responded.