Meta disrupted a Iran-based Coordinated Inauthentic Behavior (CIB) network targeting United States. This file contains a network summary from Meta’s Adversarial Threat Report H2 2026.
We disrupted 4 Facebook accounts and 31 Instagram accounts originating in Iran and targeting audiences in the United States for violating our policy against Coordinated Inauthentic Behavior. About 79,400 accounts followed one or more of these Instagram accounts. Although the people behind it attempted to conceal their identity, our investigation found links to actors in Iran.
We observed that network operators relied on sophisticated operational security and evasion tactics to mask their Iranian origins, exclusively using United States and Canadian proxy or hosting IPs. The operation used inauthentic accounts to pose as US-based individuals—such as activists, students, and graphic designers—who claimed to be based in American cities like Washington D.C., San Diego, and Atlanta. These fake personas were used to manage civic meme accounts and engage with authentic American users by tagging real journalists and politicians in their posts to solicit content collaboration. Once their infrastructure was established, the operators produced and amplified content (some of which was AI-generated) focusing on American politics, including anti-Republican views, alongside messaging on the Israel-Palestine conflict and immigration. We found this activity as a result of an internal investigation.
Note: URLs have been defanged for safety. Replace [.] with . to resolve.
No IOCs associated with this report.