Report Unveils Iran-Linked Campaign Masquerading Anti-Israel Rhetoric as American Perspectives

A recent examination of social media dynamics during the initial days of Operation Epic Fury reveals that the surge of anti-Israel sentiment online may not have primarily originated from American users. This analysis uncovers a significant influence from foreign-based accounts that shaped the narrative.

Among the recurring themes propagated by these accounts were assertions that the operation represented a “betrayal of MAGA,” was “widely unpopular among Americans,” and was executed “on behalf of Israel.” These narratives gained traction in the digital space, despite their questionable origins.

Research conducted by Argyle Consulting Group, a firm specializing in intelligence and data analysis, found that 60% of the most viral posts on the platform X mentioning “Iran” during the operation’s first week were traced back to accounts located outside the United States. Interestingly, these accounts often portrayed themselves as being American, cloaking their true origins.

Eran Vasker, CEO and co-founder of Argyle Consulting Group, shared insights with Fox News Digital, stating, “These aren’t just random opinions. What we’re observing is a discourse that appears American — crafted in English and utilizing U.S. political vernacular — yet it emanates from foreign sources. This makes it almost undetectable for the typical user.”

Vasker further noted that these accounts convincingly mimic American political dialogue and debates, making them appear indistinguishably domestic, thereby amplifying their influence on the conversation.

A new analysis of social media activity during the opening days of Operation Epic Fury suggests that much of the online backlash and anti-Israel content may not have been driven by Americans at all. (Lori Van Buren/Times Union)

The analysis examined 100 highly X viral posts — each with more than 10,000 shares — between Feb. 28 and March 7. In total, posts containing the word “Iran” generated 98 million posts, 696.4 million interactions, and an estimated 1.5 trillion potential views, making it one of the largest online information events on record. 

Foreign accounts alone generated 155.6 million views, compared to 93.4 million from U.S.-based accounts, outpacing them by more than 60 million views in the sample.

Even more striking, every single foreign-based post in the dataset was negative toward the operation, while the only supportive content came from U.S.-based users, Argyle found. 

Among the most influential voices driving engagement, seven of the top 10 accounts were based outside the United States, including accounts linked to Russia, the United Arab Emirates, the United Kingdom and South Asia, Argyle found.  (Rashid Umar Abbasi for Fox News Digital)

JP Castellanos, Binary Defense director of threat intelligence and a former member of U.S. Central Command’s Active Cyber Defense Team, said much of the activity is focused on Israel and combines disruption with messaging. 

“About 42% of the attacks that we’re seeing or the claims that we’re seeing online are directed toward Israel,” Castellanos said.

He also pointed to doxing campaigns and AI-generated videos “trying to basically shape the information space.”

Much of the challenge, Castellanos said, is distinguishing real cyber incidents from inflated online claims by hacktivist groups seeking attention.

“A lot of times, these are just claims that they put online,” he said. 

Cyber threat analysts say that an online narrative campaign is unfolding alongside broader activity by pro-Iranian and aligned groups across the digital space. (Rashid Umar Abbasi for Fox News Digital)

Researchers said the scale, consistency and geographic spread of the messaging point to a coordinated effort rather than organic global debate.

Cyber threat analysts say that an online narrative campaign is unfolding alongside broader activity by pro-Iranian and aligned groups across the digital space.

One of the most prominent groups to emerge in the current conflict, Castellanos said, is Handala, an Iran-linked hacking operation that has claimed responsibility for attacks on both U.S. and Israeli targets. 

Among the most influential voices driving engagement, seven of the top 10 accounts were based outside the United States, including accounts linked to Russia, the United Arab Emirates, the United Kingdom and South Asia.

U.S. authorities and cybersecurity firms have linked Handala to Iran’s Ministry of Intelligence and Security, describing it as part of a broader effort combining cyberattacks with psychological and information operations.

The report identified recurring narratives pushed by foreign-based accounts, including claims that the operation was a “betrayal of MAGA,” “highly unpopular with the American people” and carried out “on behalf of Israel.” (Asra Q. Nomani/Fox News Digital)

The cybersecurity researchers told Fox News Digital Handala is part of a wider network of Iran-aligned and pro-Russian hacktivist groups that have mobilized since the start of the war, blending disruptive cyber activity with narrative-shaping campaigns online.

Fox News Digital reached out to X multiple times, providing a list of the accounts in question per their request, but has not yet received a response.