Everyone saw the hackers coming.

The National Security Agency in Washington picked up the signs. So did Emmanuel Macron’s bare-bones technology team. And mindful of what happened in the American presidential campaign, the team created dozens of false email accounts, complete with phony documents, to confuse the attackers.

The Russians, for their part, were rushed and a bit sloppy, leaving a trail of evidence that was not enough to prove for certain they were working for the government of President Vladimir Putin but which strongly suggested they were part of his broader “information warfare” campaign.

The story told by American officials, cyber experts and Macron’s own campaign aides of how a hacking attack intended to disrupt the most consequential election in France in decades ended up a dud was a useful reminder that as effective as cyber attacks can be in disabling Iranian nuclear plants, or Ukrainian power grids, they are no silver bullet. The kind of information warfare favoured by Russia can be defeated by early warning and rapid exposure.

But that outcome was hardly assured on Friday night, when what was described as a “massive” hacking attack suddenly put Macron’s electoral chances in jeopardy. To French and American officials, however, it was hardly a surprise.

Testifying in front of the Senate Armed Services Committee in Washington on Tuesday, Admiral Michael S Rogers, the director of the National Security Agency, said American intelligence agencies had seen the attack unfolding, telling their French counterparts, “Look, we’re watching the Russians. We’re seeing them penetrate some of your infrastructure. Here’s what we’ve seen. What can we do to try to assist?”

But the staff at Macron’s makeshift headquarters in the 15th arrondissement at the edge of Paris didn’t need the NSA to tell them they were being targeted. In December, after the former investment banker and finance minister had emerged as easily the most anti-Russian, pro-Nato and pro-European Union candidate in the presidential race, they began receiving phishing emails.

The phishing mails were “high quality”, says Macron’s digital director, Mounir Mahjoubi. They included the actual names of members of the campaign staff, and at first glance appeared to come from them. Typical was the very last one the campaign received, several days before the election on Sunday, which purported to have come from Mahjoubi himself.

“It was almost like a joke, like giving us all the finger,” Mahjoubi says. The final email enjoined recipients to download several files “to protect yourself”.

Even before then, the Macron campaign had begun looking for ways to make life a little harder for the Russians, showing a level of skill and ingenuity that was missing in Hillary Clinton’s presidential campaign and at the Democratic National Committee, which had minimal security protections and for months ignored FBI warnings that its computer system had been penetrated.

“We went on a counteroffensive,” says Mahjoubi. “We couldn’t guarantee 100 per cent protection” from the attacks. “So we asked, ‘What can we do?’” Mahjoubi opted for a classic “cyber-blurring” strategy, well known to banks and corporations, creating false email accounts and filled them with phony documents the way a bank teller keeps fake bills in the cash drawer in case of a robbery.

“We created false accounts, with false content, as traps. We did this massively, to create the obligation for them to verify, to determine whether it was a real account,” Mahjoubi says. “I don’t think we prevented them. We just slowed them down,” he says. “Even if it made them lose one minute, we’re happy.”

Mahjoubi refuses to reveal the nature of the false documents that were created, or to say whether, in the Friday document dump that was the result of the hacking campaign, there were false documents created by the Macron campaign.

But he did note that in the mishmash that constituted the Friday dump, there were some authentic documents, some phony documents of the hackers’ own manufacture, some stolen documents from various companies, and some false emails created by the campaign.

“During all their attacks we put in phony documents. And that forced them to waste time,” he says.

With only 18 people in the digital team, many of them occupied in producing campaign materials like videos, Mahjoubi hardly had the resources to track down the hackers. “We didn’t have time to try to catch them,” he says. But he has his suspicions about their identity. Simultaneously with the phishing attacks, the Macron campaign was being attacked by the Russian media with a profusion of fake news.

Oddly, the Russians did a poor job of covering their tracks. That made it easier for private security firms, on alert after the efforts to manipulate the American election, to search for evidence.

In mid-March, researchers with Trend Micro, the cyber-security giant based in Tokyo, watched the same Russian intelligence unit behind some of the Democratic National Committee hacks start building the tools to hack Macron’s campaign. They set up web domains mimicking those of Macron’s En Marche! party, and began dispatching emails with malicious links and fake login pages designed to bait campaign staffers into divulging their usernames and passwords, or to click on a link that would give the Russians a toehold onto the campaign’s network.

It was the classic Russian playbook, security researchers say, but this time the world was prepared. “The only good news is that this activity is now commonplace, and the general population is so used to the idea of a Russian hand behind this, that it backfired on them,” says John Hultquist, the director of cyber espionage analysis at FireEye, the Silicon Valley security firm.

Hultquist notes that the attack was characterised by haste, and a trail of digital mistakes. “There was a time when Russian hackers were characterised by their lack of sloppiness,” Hultquist says. “When they made mistakes, they burned their entire operation and started anew. But since the invasion of Ukraine and Crimea,” he says, “we’ve seen them carry out brazen, large scale attacks”, perhaps because “there have been few consequences for their actions”.

The hackers also made the mistake of releasing information that was, by any campaign standard, pretty boring. The nine gigabytes worth of purportedly stolen emails and files from the Macron campaign was spun as scandalous material, but turned out to be almost entirely the humdrum of campaign workers trying to conduct ordinary life in the midst of the election maelstrom.

French Presidential Election Show all 20 1 /20 French Presidential Election French Presidential Election Voters line up to cast their ballots REUTERS French Presidential Election French expats queue along the street outside the Lycee Francais Charles de Gaulle to cast their vote in a polling station inside the school, in the first round of the 2017 French presidential election, in London, Britain April 23, 2017. REUTERS/Luke MacGregor - RTS13JM5 REUTERS French Presidential Election People line up to vote in the first round of 2017 French presidential election at a polling station in Vaulx-en-Velin near Lyon, France, April 23, 2017. REUTERS/Emmanuel Foudrot - RTS13HSP REUTERS French Presidential Election Police patrol polling stations in France REUTERS French Presidential Election Francois Fillon (L), member of the Republicans political party and 2017 French presidential election candidate of the French centre-right, casts his vote in the first round of 2017 French presidential election in Paris, France, April 23, 2017. REUTERS/Christophe Archambault/Pool - RTS13IH0 REUTERS French Presidential Election Benoit Hamon (C), French Socialist party 2017 presidential candidate, is surrounded by photographers as he leaves a polling station after voting in the first round of 2017 French presidential election in Trappes, near Paris, France, April 23, 2017. REUTERS/Vincent Kessler - RTS13I0Y REUTERS French Presidential Election French President Francois Hollande collects voting slips before casting his ballot in the first round of the 2017 French presidential election at a polling station in Tulle, France, on April 23, 2017. REUTERS/Georges Gobet/Pool - RTS13ITO REUTERS French Presidential Election A policeman walks by election posters near a polling station during the first round of 2017 French presidential election in Paris, France, April 23, 2017. REUTERS/Christian Hartmann - RTS13I3A REUTERS French Presidential Election Emmanuel Macron and wife Brigitte Trogneux REUTERS French Presidential Election Emmanuel Macron casts his ballot REUTERS French Presidential Election Emmanuel Macron, head of the political movement En Marche !, or Onwards !, and candidate for the 2017 French presidential election, waves hand during in the first round of 2017 French presidential election at a polling station in Le Touquet, northern France, April 23, 2017. REUTERS/Benoit Tessier - RTS13ICH SAA/ French Presidential Election Jean-Luc Melenchon, candidate of the French far-left Parti de Gauche and candidate for the French 2017 presidential election, leaves a polling booth in the first round of 2017 French presidential election at a polling station in Paris, France, April 23, 2017. REUTERS/Stephane Mahe - RTS13IKB REUTERS French Presidential Election Front National leader Marine Le Pen casts her ballot Marine Le Pen (L), French National Front (FN) political party leader and candidate for French 2017 presidential election, casts her ballot in the first round of 2017 French presidential election at a polling station in Henin-Beaumont, northern France, April 23, 2017. At R, Mayor of Henin-Beaumont Steeve Briois. REUTERS/Charles Platiau - RTS13IEI REUTERS French Presidential Election Early ballots are read as results continue to come in Reuters French Presidential Election Macron supporters react as results come in early in the evening AP French Presidential Election Supporters of Front National leader Marine Le Pen cheer as early results come in Reuters French Presidential Election Alamy Live News. J21KYW Paris, France. 23rd April 2017. Marcon supporters wave French and EU flags after the announcement that he is the leader in the exit polls after the polling stations have been closed. Supporters of Emmanuel Macron, the Presidential candidate from the social liberal political party En Marche! celebrate the exit polls, that see him in first place, ahead of Marine Le Pen from the Front National in the first round of the French Presidential election. Credit: Michael Debets/Alamy Live News This is an Alamy Live News image and may not be part of your current Alamy deal . If you are unsure, please contact our sales team to check. Alamy French Presidential Election Front National leader Marine Le Pen takes to the stage to address her supporters as fans cheer Reuters French Presidential Election Emmanuel Macron greets supporters on Sunday night AP French Presidential Election Emmanuel Macron and wife Brigitte Trogneux celebrate the incoming results EPA

One of the leaked emails details a campaign staffer’s struggle with a broken down car. Another documents how a campaign worker was reprimanded for failure to invoice a cup of coffee.

That is when the hackers got sloppy. The metadata tied to a handful of documents — code that shows the origins of a document — show some passed through Russian computers and were edited by Russian users. Some Excel documents were modified using software unique to Russian versions of Microsoft Windows.

Other documents had last been modified by Russian usernames, including one person that researchers identified as a 32-year-old employee of Eureka CJSC, based in Moscow, a Russian technology company that works closely with the Russian ministry of defence and intelligence agencies. The company has received licenses from Russia’s Federal Security Service to help protect state secrets. The company did not return emails requesting comment.

Other leaked documents appear to have been forged, or faked. One purported to detail the purchase of the stimulant mephedrone, sometimes sold as “bath salts”, by a Macron campaign staffer who allegedly had the drugs shipped to the address of France’s National Assembly. But Henk Van Ess, a member of the investigations team at Bellingcat, a British investigations organisation, and others discovered that the transaction numbers in the receipt were not in the public ledger of all Bitcoin transactions.

“It’s clear they were rushed,” Hultquist says. “If this was APT28,” he says, using the name for a Russian group believed to be linked to the GRU, a military intelligence agency, “they have been caught in the act, and it has backfired for them”.

Now, he says, the failure of the Macron hacks could just push Russian hackers to improve their methods.

“They may have to change their playbook entirely,” Hultquist says.