Iran-linked influence campaign pushes anti-Israel messaging disguised as US voices: report
A new analysis of social media activity during the opening days of Operation Epic Fury suggests that much of the online backlash and anti-Israel content may not have been driven by Americans at all.
The report identified recurring narratives pushed by foreign-based accounts, including claims that the operation was a "betrayal of MAGA," "highly unpopular with the American people" and carried out "on behalf of Israel."
Sixty percent of the most viral posts on X mentioning "Iran" during the first week of the operation originated from accounts based outside the United States — despite often presenting themselves as American voices, according to research conducted by Argyle Consulting Group, a private intelligence and data analysis firm.
"These aren’t just random opinions," Eran Vasker, CEO and co-founder of Argyle Consulting Group, told Fox News Digital.
"What we’re seeing is discourse that looks American — written in English, using U.S. political language — but is actually coming from outside the country … almost impossible for a regular user to detect," Vasker said, explaining that the accounts "look very American" and mirror domestic political language and debates.
The analysis examined 100 highly X viral posts — each with more than 10,000 shares — between Feb. 28 and March 7. In total, posts containing the word "Iran" generated 98 million posts, 696.4 million interactions, and an estimated 1.5 trillion potential views, making it one of the largest online information events on record.
Foreign accounts alone generated 155.6 million views, compared to 93.4 million from U.S.-based accounts, outpacing them by more than 60 million views in the sample.
Even more striking, every single foreign-based post in the dataset was negative toward the operation, while the only supportive content came from U.S.-based users, Argyle found.
JP Castellanos, Binary Defense director of threat intelligence and a former member of U.S. Central Command’s Active Cyber Defense Team, said much of the activity is focused on Israel and combines disruption with messaging.
"About 42% of the attacks that we’re seeing or the claims that we’re seeing online are directed toward Israel," Castellanos said.
He also pointed to doxing campaigns and AI-generated videos "trying to basically shape the information space."
Much of the challenge, Castellanos said, is distinguishing real cyber incidents from inflated online claims by hacktivist groups seeking attention.
"A lot of times, these are just claims that they put online," he said.
BLOODY NYC KHAMENEI VIGIL REVEALS ANTI-US PROTEST NETWORK LINKED TO IRAN
Researchers said the scale, consistency and geographic spread of the messaging point to a coordinated effort rather than organic global debate.
Cyber threat analysts say that an online narrative campaign is unfolding alongside broader activity by pro-Iranian and aligned groups across the digital space.
One of the most prominent groups to emerge in the current conflict, Castellanos said, is Handala, an Iran-linked hacking operation that has claimed responsibility for attacks on both U.S. and Israeli targets.
Among the most influential voices driving engagement, seven of the top 10 accounts were based outside the United States, including accounts linked to Russia, the United Arab Emirates, the United Kingdom and South Asia.
U.S. authorities and cybersecurity firms have linked Handala to Iran’s Ministry of Intelligence and Security, describing it as part of a broader effort combining cyberattacks with psychological and information operations.
The cybersecurity researchers told Fox News Digital Handala is part of a wider network of Iran-aligned and pro-Russian hacktivist groups that have mobilized since the start of the war, blending disruptive cyber activity with narrative-shaping campaigns online.
Fox News Digital reached out to X multiple times, providing a list of the accounts in question per their request, but has not yet received a response.