NEWYou can now listen to articles!
A new analysis of social media activity during the opening days of Operation Epic Fury suggests that much of the online backlash and anti-Israel content may not have been driven by Americans at all.
The report identified recurring narratives pushed by foreign-based accounts, including claims that the operation was a “betrayal of MAGA,” “highly unpopular with the American people,” and carried out “on behalf of Israel.”
Sixty percent of the most viral posts on X mentioning “Iran” during the first week of the operation originated from accounts based outside the United States — despite often presenting themselves as American voices, according to research conducted by Argyle Consulting Group, a private intelligence and data analysis firm.
WITH DOGS, DANCE AND UNCOVERED HAIR, IRANIANS DEFY ‘UNHOLY ALLIANCE’ OF SOCIALISTS, RADICALS: ‘HYPOCRITES!’
“These aren’t just random opinions,” Eran Vasker, CEO and co-founder of Argyle Consulting Group, told Digital. “What we’re seeing is discourse that looks American — written in English, using U.S. political language — but is actually coming from outside the country… Almost impossible for a regular user to detect,” Vasker said, explaining that the accounts “look very American” and mirror domestic political language and debates.
Local groups and residents speak out against the U.S./Israeli war against Iran during a local protest in Townsend Park on Sunday, March 1, 2026 in Albany, N.Y. (Lori Van Buren/Times Union)
The analysis examined 100 highly X viral posts — each with more than 10,000 shares — between Feb. 28 and March 7. In total, posts containing the word “Iran” generated 98 million posts, 696.4 million interactions, and an estimated 1.5 trillion potential views, making it one of the largest online information events on record.
Foreign accounts alone generated 155.6 million views, compared to 93.4 million from U.S.-based accounts, outpacing them by more than 60 million views in the sample.
Even more striking, every single foreign-based post in the dataset was negative toward the operation, while the only supportive content came from U.S.-based users, Argyle found.
WHY TRUMP IS DENOUNCING THE MEDIA’S IRAN WAR COVERAGE AS TOO NEGATIVE – BOOSTED BY RHETORICAL FCC BACKING
David Chung, organizing director at the People’s Forum Inc., sets up in Union Square to protest the war with Iran in New York, N.Y., on Saturday, March 7, 2026. He carries signs with the website domain for the Party for Socialism and Liberation. (Rashid Umar Abbasi for Digital)
JP Castellanos, Binary Defense director of threat intelligence and a former member of U.S. Central Command’s Active Cyber Defense Team, said much of the activity is focused on Israel and combines disruption with messaging. “About 42% of the attacks that we’re seeing or the claims that we’re seeing online are directed toward Israel,” Castellanos said.
He also pointed to doxxing campaigns and AI-generated videos “trying to basically shape the information space.”
Much of the challenge, Castellanos said, is distinguishing real cyber incidents from inflated online claims by hacktivist groups seeking attention.
“A lot of times, these are just claims that they put online,” he said.
BLOODY NYC KHAMENEI VIGIL REVEALS ANTI-US PROTEST NETWORK LINKED TO IRAN
The People’s Forum Inc. set up signs in Union Square to protest the war with Iran in New York, N.Y., on Saturday, March 7, 2026. The signs are marked with the website for the Party for Socialism and Liberation. (Rashid Umar Abbasi for Digital)
Researchers said the scale, consistency and geographic spread of the messaging point to a coordinated effort rather than organic global debate.
Cyber threat analysts say that online narrative campaign is unfolding alongside broader activity by pro-Iranian and aligned groups across the digital space.
One of the most prominent groups to emerge in the current conflict, Castellanos said, is Handala, an Iran-linked hacking operation that has claimed responsibility for attacks on both U.S. and Israeli targets.Among the most influential voices driving engagement, seven of the top 10 accounts were based outside the United States, including accounts linked to Russia, the United Arab Emirates, the United Kingdom and South Asia.
U.S. authorities and cybersecurity firms have linked Handala to Iran’s Ministry of Intelligence and Security, describing it as part of a broader effort combining cyberattacks with psychological and information operations.
CLICK HERE TO DOWNLOAD THE APP
Members of the Party for Socialism and Liberation filmed children supporting the regime in Iran, during a protest on Saturday, March 7, 2026, in Washington, D.C. (Asra Q. Nomani/ Digital)
The cybersecurity researchers told Digital Handala is part of a wider network of Iran-aligned and pro-Russian hacktivist groups that have mobilized since the start of the war, blending disruptive cyber activity with narrative-shaping campaigns online.
Digital reached out to X multiple times, providing a list of the accounts in question per their request, but has not yet received a response.
