Search

𝗜𝗿𝗮𝗻’𝘀 𝗳𝗮𝗸𝗲 𝗜𝘀𝗿𝗮𝗲𝗹𝗶𝘀 – 𝗵𝗼𝘄 𝗮 𝗳𝗼𝗿𝗲𝗶𝗴𝗻 𝗶𝗻𝗳𝗹𝘂𝗲𝗻𝗰𝗲 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝗲𝗻𝘁𝗲𝗿𝗲𝗱 𝗜𝘀𝗿𝗮𝗲𝗹’𝘀 𝗲𝗹𝗲𝗰𝘁𝗶𝗼𝗻 𝗱𝗲𝗯𝗮𝘁𝗲 Ahead of Israel’s 27 October election, hundreds of social-media accounts have been presenting themselves as ordinary Israelis while injecting political messages into genuine domestic conversations. They appear as women, reservists, secular voters, religious activists and frustrated citizens. Some attack Benjamin Netanyahu, others have previously promoted narratives associated with the Israeli right, while many focus less on parties than on a broader message: Israel is divided, its institutions cannot be trusted and its political system is approaching crisis. A detailed investigation by the OSINT company Golden Owl has mapped this activity as a substantial Iran-linked influence network. Its October analysis identified at least 694 accounts, with 445 attributed at high or medium-high confidence to the operation. Between 11 August and 11 October, the network generated at least 4.7 million views and more than 160,000 interactions. The researchers found no evidence that these accounts were simply a group of independent Iranian commentators expressing political opinions. Their assessment rests instead on coordinated behaviour, false identities, account histories, copied content, language patterns and platform metadata linking significant parts of the infrastructure to Iran. 𝗙𝗿𝗼𝗺 𝟯𝟱 𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝘀 𝘁𝗼 𝗵𝘂𝗻𝗱𝗿𝗲𝗱𝘀 𝗼𝗳 𝗳𝗮𝗸𝗲 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 The investigation developed in two stages. Golden Owl’s first report, published in September, identified an operational core of 35 accounts: 32 personas presenting themselves as Israelis and three Hebrew-language media-style channels. During the 30-day period measured in that study, active accounts generated 947,322 impressions and more than 9,000 interactions. The October investigation expanded the dataset dramatically. Researchers analysed more than 560,000 data points, including tens of thousands of accounts, relationships between them and more than a quarter of a million posts. The wider network showed repeated patterns of identical texts, synchronised activity and accounts created in batches. The numbers therefore describe not a sudden explosion from 35 to hundreds of accounts, but the gradual exposure of a much larger infrastructure surrounding the original core. 𝗧𝗵𝗲 𝗳𝗮𝗸𝗲 𝗜𝘀𝗿𝗮𝗲𝗹𝗶𝘀 Some of the strongest evidence comes from the histories of individual personas. One account had spent years posting exclusively in Persian under the handle “mardeankabooti” before reappearing in August 2026 as an apparently Israeli user called “Alon Strauss”, complete with an Israeli flag and Hebrew political messaging. Other personas presented themselves as Israeli professionals, activists or ordinary citizens while X transparency information showed connections through the Iranian version of the Android application or locations inconsistent with their claimed identities. The account “Yaara Shalev” presented itself as an Israeli woman concerned with democracy and peace. Investigators found that photographs used to construct the identity were inconsistent, including borrowed and apparently AI-generated imagery. A small Hebrew-language channel called KigVoice, previously identified in Israeli government reporting as part of an Iranian influence environment, repeatedly published material that later appeared on the much more visible Yaara account. In one sample, 14 of 40 KigVoice posts subsequently resurfaced as captions or opening lines in Yaara’s content. Another persona, “Miriam Kozak”, had built an audience of more than 18,000 followers and had already been exposed as fictitious by Israeli researchers in 2024. Its political messaging changed substantially over time, moving between narratives associated with different sides of Israeli politics. That inconsistency is important: the apparent purpose was not necessarily to build a stable ideological following, but to enter whichever political argument offered the greatest opportunity to intensify division. 𝗔𝗜, 𝗰𝗼𝗽𝗶𝗲𝗱 𝗺𝗲𝘀𝘀𝗮𝗴𝗲𝘀 𝗮𝗻𝗱 𝗜𝗿𝗮𝗻𝗶𝗮𝗻 𝗳𝗶𝗻𝗴𝗲𝗿𝗽𝗿𝗶𝗻𝘁𝘀 The Iran attribution is based on more than political content. Researchers identified accounts using the Iranian version of the X Android application, repeated connections to previously identified Iranian influence assets, copied posts appearing across supposedly independent personas within minutes, and Hebrew containing unusual grammatical errors or Persian and Arabic keyboard artefacts. Generative AI also appears to have become part of the production process. Some accounts inadvertently published fragments resembling chatbot instructions, while other posts displayed patterns consistent with machine-generated Hebrew. AI-generated videos and synthetic profile imagery further reduced the cost of maintaining large numbers of apparently distinct personalities. However, none of these indicators was treated as proof on its own. Golden Owl explicitly excluded accounts where the evidence was insufficient and notes that VPNs, travel and platform location labels can create misleading signals. The attribution rests on multiple independent indicators converging across the network. 𝗧𝗵𝗲 𝗴𝗼𝗮𝗹 𝗶𝘀 𝗻𝗼𝘁 𝗻𝗲𝗰𝗲𝘀𝘀𝗮𝗿𝗶𝗹𝘆 𝘁𝗼 𝗲𝗹𝗲𝗰𝘁 𝗼𝗻𝗲 𝗽𝗮𝗿𝘁𝘆 The network repeatedly exploited issues that genuinely divide Israeli society: responsibility for the 7 October attacks, the war, the hostages, ultra-Orthodox military exemptions, economic pressure, emigration and confidence in state institutions. It also circulated misleading information about the election itself, including false voting dates, claims that voting had been postponed and posts suggesting online voting mechanisms that do not exist in Israel’s parliamentary election system. The pattern suggests a strategy broader than conventional electoral campaigning. Rather than consistently promoting one political faction, the network appears designed to weaken confidence in the government, military, democratic institutions and the electoral process itself. An influence operation does not need to persuade Israelis to support a particular candidate if it can convince different groups that defeat would prove fraud, betrayal or systemic failure. 𝗥𝗲𝗮𝗹 𝗜𝘀𝗿𝗮𝗲𝗹𝗶𝘀 𝗮𝘀 𝘂𝗻𝘄𝗶𝘁𝘁𝗶𝗻𝗴 𝗮𝗺𝗽𝗹𝗶𝗳𝗶𝗲𝗿𝘀 One of the network’s most effective characteristics is that it does not depend solely on its own followers. Fake personas enter comment sections and political discussions involving real Israeli journalists, politicians and ordinary users. Authentic Israelis then repost or interact with the material, sometimes carrying it far beyond the original account. Golden Owl does not classify those genuine users as participants in the operation. In most cases they appear to be unwitting amplifiers. But once a message passes from a fabricated Iranian-operated persona to an authentic Israeli account, its foreign origin becomes much harder for the next person to recognise. 𝗧𝗵𝗲 𝟰𝟬,𝟬𝟬𝟬-𝗯𝗼𝘁 𝗳𝗶𝗴𝘂𝗿𝗲 𝗯𝗲𝗹𝗼𝗻𝗴𝘀 𝘁𝗼 𝗮 𝗱𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝘁 𝗽𝗲𝗿𝗶𝗼𝗱 A much larger figure has also appeared in recent reporting. In the first two days after the October 2023 Hamas attack, social-media intelligence company Cyabra identified more than 40,000 fake profiles participating in online discussions across major platforms. Their content generated hundreds of thousands of interactions and had a potential reach estimated at 531 million profiles. Those numbers are important historical context, but they should not be merged with the current Golden Owl investigation. There is no public evidence demonstrating that all of those 2023 accounts and the 2026 Iran-linked election network belonged to one continuous command structure. The 531 million figure is also an estimate of potential exposure, not proof that 531 million people saw or believed the content. 𝗪𝗵𝗼 𝗶𝘀 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗯𝗲𝗵𝗶𝗻𝗱 𝘁𝗵𝗲 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻? No confirmed individual operators have been publicly identified. Names such as Yaara Shalev, Miriam Kozak and Alon Strauss are personas, not verified identities of the people controlling the accounts. Golden Owl says its evidence supports an association with the Islamic Republic of Iran and with previously documented Iranian influence infrastructure, but it does not establish which Iranian institution, intelligence service, military organisation or contractor directs the network. That distinction is essential. Public OSINT supports attribution at the Iran-linked operational level. It does not currently justify naming individual Iranian officials as the people commanding this specific campaign. 𝗧𝗵𝗲 𝗱𝗲𝗲𝗽𝗳𝗮𝗸𝗲 𝗶𝘀 𝗻𝗼 𝗹𝗼𝗻𝗴𝗲𝗿 𝗼𝗻𝗹𝘆 𝘁𝗵𝗲 𝘃𝗶𝗱𝗲𝗼 The Israeli case illustrates a broader change in influence operations. The synthetic asset does not have to be a spectacular deepfake of a politician. It can be an apparently ordinary citizen who comments on politics, argues with neighbours, describes personal experiences and gradually becomes part of an authentic community. That can be more difficult to recognise because the propaganda does not arrive looking foreign. It arrives looking local. And when hundreds of fabricated citizens enter the same national conversation, they can manufacture the impression that political anger, despair or distrust is more spontaneous and more widely shared than it really is. 𝗦𝗼𝘂𝗿𝗰𝗲𝘀 Golden Owl — Exposing the Iranian Regime’s Influence Machinery Against Israeli Society https://web-dev-production-7a35.up.railway.app/resources/research/Exposing-the-Iranian-Regime-Influence-Machinery-Against-Israeli-Society Golden Owl Golden Owl — The Other Face of War: Iranian Regime–Linked Manipulation of Israel’s 2026 Election Debate https://web-dev-production-7a35.up.railway.app/resources/research/Iranian-Regime-Linked-Manipulation-of-Israel-2026-Election-Debate Golden Owl The Jerusalem Post — Iran-linked social-media accounts posing as Israelis to target election https://www.jpost.com/israel-election-2026/article-909863 The Jerusalem Post Ynet — Fake Israelis, real influence: Iran-linked network infiltrates Israel’s election debate https://www.ynetnews.com/tech-and-digital/article/syp119nqqzg ynetglobal Calcalist — Iranian influence network exposed ahead of Israel’s election https://www.calcalist.co.il/calcalistech/article/s1q0ifijzl calcalist Vesty / Ynet — Iranian fake-account network and October update https://www.vesty.co.il/main/article/rkwokjssgg vesty Israel Ministry for Diaspora Affairs — Iran’s active Hebrew-language influence campaign https://www.gov.il/BlobFolder/reports/israel-and-us-strikes-in-iran-daily-status_2_3_26/en/mashlat_Roaring_Lion_israel-and-us-strikes-in-iran-daily-status_2_3_26.pdf Government of Israel Israel Central Elections Committee — official 2026 election timetable https://www.gov.il/en/pages/time--table-26 Government of Israel Channel NewsAsia — historical Cyabra analysis of more than 40,000 fake profiles after 7 October 2023 https://www.channelnewsasia.com/singapore/how-fake-news-israel-hamas-stokes-outrage-hatred-and-potential-violence-southeast-asian-tiktok-5603221 𝗞𝗲𝘆𝘄𝗼𝗿𝗱𝘀 #DISINFORMED #Episode20 #Iran #Israel #IsraelElection2026 #IranianInfluence #IranianDisinformation #ElectionInterference #ForeignInterference #FIMI #Disinformation #InformationWarfare #InfluenceOperations #FakeAccounts #FakePersonas #SyntheticIdentity #ArtificialIntelligence #AI #AIPropaganda #SocialMediaManipulation #Astroturfing #NarrativeManipulation #PoliticalDisinformation #ElectionDisinformation #X #Twitter #Bots #BotNetwork #KigVoice #YaaraShalev #MiriamKozak #DigitalInfluence #InformationManipulation #ElectionIntegrity #GoldenOwl #OSINT #MediaManipulation #WRLD

Iran’s cognitive warfare – when AI becomes the operating layer of state propaganda Iranian state-linked influence operators were not using artificial intelligence simply to write faster social-media posts. According to Anthropic’s September 2026 threat intelligence report, three separate operations connected to Iranian propaganda institutions were using Claude to help construct the machinery behind what the operators themselves called “soft war” and “cognitive warfare” – non-military efforts intended to shape public opinion inside Iran and abroad. Anthropic linked the activity to the Islamic Culture and Communications Organization (ICCO), which operates under Iran’s Ministry of Culture and Islamic Guidance; the Islamic Propaganda Office of Khorasan Razavi; and the Bina Cultural Observatory, part of the Islamic Propaganda Organization. The company said each operation was run by someone working within or on behalf of the named institution. The attribution was based on a combination of account telemetry, institutional references disclosed during conversations, branded documents and open-source corroboration. Anthropic subsequently removed the accounts. AI as an operational headquarters The most significant feature of the operation was the role assigned to AI. Claude was used to develop campaign plans, doctrine manuals, coded project portfolios, persona systems, target databases, early-warning protocols, amplification schedules and ministerial planning documents. Anthropic described the model as the principal administrative and operational layer supporting the three campaigns, allowing relatively small groups of operators to create organisational structures and planning material that would otherwise have required a much larger staff. This distinction matters. The reported use of AI went considerably beyond content generation. Operators were using the model to help organise how influence activity should function: which audiences to target, which identities should deliver particular narratives, how official material should be repackaged and when amplification should take place. Human operators still determined objectives and supplied the underlying political doctrine; AI helped translate those decisions into an operational system. Anthropic found that all three operations explicitly connected their activity to Jihad al-Tabyin, often translated as “explanatory jihad”, a concept used within the Iranian state system to frame information activity as both a strategic and ideological responsibility. In internal planning material examined by the company, this doctrine was not merely rhetorical: it informed manuals and campaign structures used by the operators. ‘Not the narrator, but the director’ One sentence contained in the ICCO material captures the model particularly clearly. According to Anthropic, an operator described the role of Iranian cultural attachés as being “not to be the narrator, but the director” of the narrative. The distinction reveals the logic of attribution laundering. Instead of publishing an overt state message and asking foreign audiences to believe it, the operator attempts to create the appearance that the same narrative emerged independently from journalists, activists, foreign writers or ordinary citizens. Anthropic found that Claude was used specifically to make content appear to come from foreign authors or independent media organisations and to design hashtag campaigns that looked grassroots rather than centrally organised. The ICCO operation reportedly used the organisation’s international cultural network as part of this structure. Anthropic found ministerial-level documents carrying official ICCO branding, including a nine-part international influence portfolio. This makes the operation particularly significant because the infrastructure was not limited to anonymous social-media accounts; it intersected with formal state institutions and an existing network of cultural representation abroad. A multilingual content factory A second operation was associated with the Islamic Propaganda Office of Khorasan Razavi and what Anthropic described as a “cognitive warfare command room” operating from a seminary in Mashhad. Its organisers ran a multi-province content production system known internally as Manjanegh, or “Catapult”. According to Anthropic, dozens of activists were involved in repackaging publicly available reporting from Iranian security institutions under different personas so that the material no longer appeared directly connected to those institutions. The network used Claude to transform official government intelligence bulletins into customised material in Farsi, Arabic, Urdu, Malay, Spanish and English, while planning expansion into a total of 20 languages. Distribution extended across Iranian platforms such as Eitaa, Bale and Rubika and international services including X, Instagram, Telegram, TikTok and YouTube. Anthropic also documented paid amplification across more than 100 Iranian channels, including channels associated with IRGC narratives. The scale should nevertheless be interpreted carefully. Anthropic documented production infrastructure and some real-world dissemination, but it did not demonstrate that all planned campaigns were fully deployed or that they meaningfully changed public opinion. The company placed the operation in Category Three of its Breakout Scale, indicating multi-platform activity with content observed in external distribution channels, rather than evidence of strategic impact on entire populations. From security bulletins to apparently independent voices The Bina Cultural Observatory operation provides another example of the same architecture. Anthropic linked a director-level official at Bina to activity in which Claude generated messaging in the voice of an IRGC spokesperson. During the 2026 US–Israel–Iran war, the network also attributed false claims to Western institutions including CSIS, Brookings and RAND. The apparent objective was to make Iranian state-aligned claims look as though they had been independently validated by respected foreign research organisations. That technique is more sophisticated than simply publishing propaganda under a false name. It attempts to manufacture a chain of external validation: official information is transformed into apparently independent commentary, which can then be recirculated as evidence that outside observers have reached the same conclusion. Anthropic also found target databases naming international officials and Iranian opposition figures, as well as aggressive counter-narrative material directed against the Bahá’í community. These findings show that the infrastructure was designed not only for broad messaging but also for targeted influence activity against specific groups and individuals. What AI changed The Iranian operations described by Anthropic did not create a new doctrine of influence. Iran has used cultural institutions, official media, aligned organisations and covert or semi-covert online networks for years. What AI changed was the economics and organisational capacity of that model. A relatively small team could use the system to draft doctrine, create personas, translate material, structure target databases, produce campaign calendars and generate multiple versions of the same message for different audiences. The operator remained responsible for intent, political direction and selection of targets. AI reduced the amount of human labour required to turn those decisions into a functioning influence operation. The most revealing part of the case is therefore not that an Iranian propaganda network used a chatbot. It is that AI was being treated as part of the back office of information warfare – a system for converting state doctrine into apparently decentralised, multilingual and plausibly independent voices. Sources Anthropic — Detecting and countering misuse of AI: September 2026 https://www.anthropic.com/threat-intelligence-report-september-2026 Iran International — Iran state-aligned accounts used Claude to push IRGC narratives https://www.iranintl.com/en/202609105561 BNE IntelliNews — Yemen missile cell used AI to write guidance software, Anthropic says https://new.intellinews.com/articles/yemen-missile-cell-used-ai-to-write-guidance-software-anthropic-says-467296 This is Beirut — Anthropic report details Iranian propaganda operations https://thisisbeirut.com.lb/news/politics/anthropic-report-details-iranian-propaganda-operations-and-yemen-missile-development-using-claude Anthropic report — PDF mirror https://static.foxbusiness.com/foxbusiness.com/content/uploads/2026/09/anthropic-detecting-and-countering-091026-1.pdf Keywords #DISINFORMED #Episode11 #Iran #IranianInfluence #IranianPropaganda #CognitiveWarfare #SoftWar #JihadAlTabyin #Disinformation #InformationWarfare #InfluenceOperations #ForeignInterference #FIMI #ArtificialIntelligence #AI #AIPropaganda #GenerativeAI #ClaudeAI #Anthropic #SyntheticMedia #NarrativeManipulation #NarrativeLaundering #AttributionLaundering #PersonaNetworks #Astroturfing #SocialMediaManipulation #DigitalInfluence #StatePropaganda #IslamicCultureAndCommunicationsOrganization #ICCO #IslamicPropagandaOrganization #KhorasanRazavi #IRGC #MultilingualInfluence #Targeting #Amplification #OSINT #WRLD

Kuwait's interior ministry reported that a group of armed members of Iran's Islamic Revolutionary Guards Corps infiltrated Bubiyan Island on May 1, clashing with Kuwaiti soldiers and resulting in multiple arrests, amidst rising tensions in the Gulf region linked to the ongoing conflict involving Iran, the U.S., and Israel. #GulfConflict #IranianInfluence #KuwaitSecurity #KW #IR #BH #AE #QA #US #IL