Forensic Research Archive of Manipulation and Exploitation
Illustration: a Cold War intelligence-dossier collage dominated by a distressed world map with connecting routes, coordinates and highlighted regions.

Campaigns

Iran-origin Meta CIB — fake US activist personas (H2 2026)

Illustration, not an archive object

Entrance sign at Meta's headquarters complex in Menlo Park, California, reading Meta, 1 Hacker Way
Entrance sign at Meta's headquarters complex in Menlo Park, California, reading Meta, 1 Hacker Way
Street view of the Meta Platforms campus entrance in Menlo Park, California, with a Meta sign among flowering trees
Street view of the Meta Platforms campus entrance in Menlo Park, California, with a Meta sign among...
Actor
Iran-based operators (Meta attribution; continuity claimed with prior Iranian CIB / IUVM-style activity — continuity is high for tradecraft, not a named-unit indictment in the public report)
Target
US domestic political audiences, journalists, and politicians; themes: anti-Republican messaging, immigration, Israel-Palestine
Source
Impersonated black (false nationality, false vocation, proxies)
Techniques
AstroturfingSynthetic mediaPlain folksNarrative launderingCard stacking
First seen (this wave)
Meta H2 2026 Adversarial Threat Report, 27 Aug 2026; Axios exclusive same day
Status
disrupted on-platform as of the report; residual copies and copycats possible
Related briefs
Iran-linked network used AI personas and proxies to push anti-Republican memes on Meta, Meta disrupts Iran-based CIB network that used fake US activist personas and AI-generated memes to target American political discourse

Mechanism

Meta removed 4 Facebook and 31 Instagram accounts “originating in Iran.” Operators posed as US activists, students, and graphic designers in named cities (Washington, D.C., San Diego, Atlanta), used only US and Canadian proxy/hosting IPs, ran civic meme pages, tagged real journalists and politicians, and solicited collaborations (Meta: none succeeded). Some memes were AI-generated. About 79,400 Instagram accounts followed one or more of the assets before removal. Indicators were shared with US law enforcement.

Entrance sign at Meta's headquarters complex in Menlo Park, California, reading Meta, 1 Hacker Way

12 May 2022. Entrance sign at 1 Hacker Way, Menlo Park, California, the address of Meta Platforms, the company whose H2 2026 report announced this takedown. The photograph predates the operation and shows the platform operator, not any account or content from it. Photo: Nokia621, CC BY-SA 4.0.

Astroturf plus plain-folks is the core: the message is supposed to arrive as domestic dissent. Synthetic media cheapens the meme line. Card-stacking is in the issue diet. Narrative laundering is the activist costume. Operational security (exclusive Western proxies) is a tell, not a technique id.

Scale is moderate. Intent and coordination are the filing bar, not virality. Meta’s own report is the primary document, and it does not support reading this as a decisive election operation.

Evidence

  • Meta H2 2026 Adversarial Threat Report — https://transparency.meta.com/sr/H2-2026-adversarial-threat-report/
  • Meta threat-research indicators, “Iran-Based Influence Operation Targeting United States” — https://raw.githubusercontent.com/facebook/threat-research/main/indicators/meta-h2-2026-iran-cib-based-network.md
  • Axios, 27 Aug 2026 — https://www.axios.com/2026/08/27/facebook-instagram-iran-ai-disinformation

Street view of the Meta Platforms campus entrance in Menlo Park, California, with a Meta sign among flowering trees

27 March 2022. Entrance to the Meta Platforms headquarters complex, Menlo Park, California. Context image only: it does not depict the accounts, the content or the people named in the report. Photo: LPS.1, CC0.

What would falsify this read

A showing that Meta’s origin attribution is wrong (indicators pointing elsewhere); that the accounts were authentic US activists; or that the AI-meme claim is a generic false positive. Platform attribution is not a court finding — confidence is documented for the takedown, not for a named Iranian unit.

Literacy counter

Sudden clusters of “local activist” meme accounts with polished output on a narrow theme, no offline identity, and lots of politician tags are provisional. Check creation dates, mutuals, and reverse-image profile photos. Read the platform’s technical summary, not the partisan recap. The same checklist applies to US, Russian, and commercial persona farms.