While nationwide protests in Iran have surged in the past month, Cyabra has conducted a deep analysis of online discourse to uncover the forces seeking to influence the grassroots protests of the Iranian people.
TL;DR;
- A coordinated fake campaign tried countering the Iranian protests by promoting the Ayatollah-led regime and delegitimizing the US
- 25% of profiles discussing Iran’s protests were inauthentic
- The fake campaign reached an estimated 6.6 million views with coordinated messaging supporting Iran’s current regime, and created the illusion of widespread support online
- Lebanese-origin accounts dominated the inauthentic network, indicating a cross-border influence operation
The Numbers Behind the Pro-Ayatollah Manipulation
Cyabra analyzed social media discourse surrounding the protests in Iran against the Islamic regime from December 1, 2025, to January 18, 2026. The investigation spanned X, Facebook, Instagram, and TikTok, revealing a coordinated inauthentic campaign designed to counter the protests by promoting the Ayatollah-led regime and delegitimizing the United States.
On X, 25% of profiles discussing the Iranian protests were inauthentic. These fake accounts generated 26% of all content on this topic, demonstrating significant investment in narrative manipulation. The inauthentic profiles operated in a synchronized manner, creating the impression of widespread support for regime-friendly narratives. The campaign’s potential impact is striking: an estimated 6.6 million views amplifying the regime’s messaging during a critical period of civil unrest.
What distinguishes this operation is the geographic origin of the fake campaign. Cyabra identified that a significant number of inauthentic profiles originated from Lebanon, providing concrete evidence of a pro-Iranian influence operation manipulating public opinion from outside Iran despite internet blackouts and access restrictions within Iran itself.
Coordinated Tactics: Hashtags, Messaging, and Amplification
The campaign deployed sophisticated coordination tactics centered around a specific Arabic-language hashtag: مع_ايران_ضد_العدوان#
which means “With Iran against the aggression” – the aggression being the United States. This slogan expressed support for Iran and opposition to perceived external aggression, particularly from the US.
Numerous inauthentic profiles shared coordinated content supporting Khamenei as Iran’s rightful leader while framing the United States as a terrorist actor.
The campaign’s content was primarily disseminated in Arabic, indicating a targeted effort to influence audiences across the Arab and Muslim world, not just within Iran. This cross-regional approach demonstrates sophisticated audience segmentation by the campaign operators.
Blurring Lines: Fake Accounts Leverage Authentic Engagement
A sophisticated aspect of this campaign was the integration of authentic and inauthentic activity. Cyabra discovered that alongside fake profiles, many authentic accounts also used the same hashtag, blurring the line between coordinated manipulation and organic discourse.
This hybrid approach represents an evolution in discourse manipulation. By entangling authentic engagement with coordinated inauthentic behavior, the campaign created an environment where distinguishing between genuine public opinion and manufactured sentiment became increasingly difficult.
The organic amplification enabled the campaign to reach broader audiences and strengthen its perceived authenticity. This approach parallels what Meta identified and disrupted in other Iranian influence operations during 2025, where fake personas manipulated public opinion.
Broader Implications for Democratic Governments
The Iranian anti-protest campaign reveals the sophisticated nature of cross-border influence operations that target specific language demographics and leverage regional relationships. The coordination of messaging across platforms and languages, while blending authentic and inauthentic engagement, creates significant detection challenges.
Such operations aren’t limited to Iran. Similar tactics have been observed in influence campaigns targeting electoral processes in democratic nations. State actors increasingly utilize sophisticated digital tools to influence both domestic and international audiences.
The Lebanon-Iran connection highlights the importance of understanding regional proxy relationships in digital influence operations. By operating through Lebanon-based accounts, the campaign maintained activity despite internet restrictions within Iran.
For government agencies protecting democratic processes, this campaign offers critical lessons:
- Continuously monitoring and analyzing online discourse during political crises is essential for early detection of coordinated campaigns.
- Cross-platform analysis is crucial for identifying synchronized messaging across multiple social media environments.
- Developing rapid response protocols to identify and counter inauthentic campaigns is vital: The speed with which these operations generate millions of impressions means delayed responses significantly reduce counter-measure effectiveness.
- Advanced disinformation detection technologies enable identification of coordinated inauthentic behavior before maximum impact. By analyzing engagement patterns, account origins, and content similarity, these tools provide crucial early warnings.
The Iranian anti-protest campaign represents a warning of increasingly sophisticated tactics influencing public discourse around critical political movements. By implementing appropriate detection and response mechanisms, democratic governments can better protect the information environment and society as a whole from similar manipulation attempts.
