Just before the French go to the polls on Sunday (May 7), hackers have leaked campaign emails belonging to presidential frontrunner Emmanuel Macron.

This may sound familiar: There are indications that the Russians may be involved in changing the outcome of a democratic election—in this case, France’s most important race in decades. Macron’s rival, far-right candidate Marine Le Pen, is on friendly terms with Russian president Vladimir Putin.

The hack comes less than two weeks (paywall) after an internet-security firm reported that Macron had been the target of an attempted hack by the same shadowy group that leaked US presidential candidate Hillary Clinton’s emails.

Macron’s campaign acknowledged the leak, claiming that the trove of leaked documents includes innocuous real email along with forged ones that appear more incriminating. France warned on Saturday it could be a criminal offence to republish the data.

The timing of the leak, just hours before campaigning and French media coverage was supposed to stop, has made many curious. The Atlantic Council’s Digital Forensic Research (DFR) Lab analyzed how the news of leaked emails spread on Twitter.

It found that Jack Posobiec, the Washington DC bureau chief for alt-right website Rebel Media, was among the first to create the hashtag #MacronLeaks. DFR found signs that bots then amplified the message.

From there on, the news was spread by a series of accounts, starting with William Craddick of Disobedient Media, whom DFR has identified as a distributor of fraudulent news stories. Others were likely bots: @patricia691503, @Georges_Resist, and @Languillem. (Craddick says there’s no proof of the involvement of bots.)

The amplified news didn’t take long to reach France, where Le Pen’s “most active and aggressive” online supporters, @Messsmer and @AudreyPatriote, took on the baton of amplifying the news in France.

The biggest amplification, however, came from @Wikileaks.

Who is most likely behind #MacronLeaks which have been timed such that they are very unlikely to affect the vote?

— WikiLeaks (@wikileaks) May 5, 2017

“Taken together, the data indicates that the #MacronLeaks hashtag was initially launched in the US and was driven by a cluster of alt-right accounts and probable bots.It was then picked up by Le Pen supporters, and probable bots, and passed on to the French audience,” DFR concluded. “While the authenticity of the ‘leaked’ documents is still in question, the alt-right’s activity in amplifying the #MacronLeaks hashtag is not, pointing to yet another attempt to skew democratic elections in a Western country.”