Report: Iran-linked influence effort peddles anti-Israel messaging disguised as US voices

(SeaPRwire) –   A fresh review of social media engagement in the initial phase of Operation Epic Fury indicates that a significant portion of the online criticism and content opposing Israel likely did not originate from American users.

The study noted repeated themes promoted by accounts located abroad, such as assertions that the operation constituted a “betrayal of MAGA,” was “deeply unpopular among Americans,” and was executed “for Israel’s benefit.”

Research from the private intelligence and data analysis firm Argyle Consulting Group reveals that 60% of the most widely shared posts on X referencing “Iran” in the operation’s first week came from accounts outside the U.S., even though they frequently posed as American commentators.

“These aren’t merely scattered viewpoints,” Eran Vasker, CEO and co-founder of Argyle Consulting Group, stated to Digital.

“We are observing dialogue that appears American—composed in English, employing U.S. political terminology—yet is in fact originating from overseas … nearly undetectable to the average user,” Vasker explained, adding that these accounts “seem very American” and replicate internal political discourse.

The study looked at 100 highly viral X posts—each shared over 10,000 times—from February 28 to March 7. Collectively, posts with the term “Iran” produced 98 million posts, 696.4 million interactions, and an approximate 1.5 trillion potential views, ranking it among the most substantial online information events documented.

Accounts based outside the U.S. alone accounted for 155.6 million views in the sample, surpassing the 93.4 million views from U.S.-based accounts by over 60 million.

More notably, Argyle’s findings show that every post from a foreign account in the data was critical of the operation, whereas all supportive material came from users within the United States.

JP Castellanos, Director of Threat Intelligence at Binary Defense and an ex-member of U.S. Central Command’s Active Cyber Defense Team, noted that a large focus of this activity targets Israel, merging disruptive actions with messaging.

“Roughly 42% of the cyber attacks or allegations we observe online are aimed at Israel,” Castellanos stated.

He also highlighted doxing campaigns and AI-produced videos that are “attempting to mold the information environment.”

A major difficulty, Castellanos said, lies in separating genuine cyber events from exaggerated online assertions made by hacktivist groups looking for notoriety.

“Frequently, these are simply unverified claims they publish online,” he remarked.

Analysts stated that the messaging’s volume, uniformity, and wide geographic distribution indicate a coordinated initiative, not a natural worldwide discussion.

Cyber threat experts report that a campaign to control online narratives is progressing in tandem with wider actions by pro-Iranian and affiliated groups throughout the digital sphere.

Castellanos identified one of the most visible groups in the current conflict as Handala, a hacking operation connected to Iran that has taken credit for assaults on both U.S. and Israeli targets.

Of the top ten accounts most effective at driving engagement, seven were located outside the United States, with ties to nations including Russia, the United Arab Emirates, the United Kingdom, and South Asia.

U.S. officials and cybersecurity companies have associated Handala with Iran’s Ministry of Intelligence and Security, characterizing it as an element of a larger strategy that merges cyber assaults with psychological and information warfare.

The cybersecurity analysts informed Digital that Handala belongs to an extended network of Iran-aligned and pro-Russian hacktivist groups activated since the war’s onset, which mix disruptive cyber operations with efforts to shape narratives online.

Digital contacted X on several occasions, supplying a list of the relevant accounts as requested, but has not obtained a reply.