Thread by @arawnsley

New from me: investigation by The Daily Beast and @FireEye finds three reporter personas planted dozens of pro-Iranian fake articles in dozens of Arabic-language news outlets. Stories were based on spoofed, hacked, and forged sites/material thedailybeast.com/pro-iran-troll…

We shared our finding with Facebook. In their release of the December coordinated inauthentic behavior takedown, Facebook found four Iran-linked accounts involved in trying to spread some of the material we sent. Accounts were active in 2020 but stopped by FB's spam detection

So what did the accounts get up to? Attempts at election meddling, for one. Here's an example of how the cycle often worked. In October, someone impersonated an Israeli cybersecurity official on FB to claim that Israel & the UAE were secretly funding the Trump campaign

This was, of course, bullshit. But up pops one of the reporter personas, Rumaisa Hanaoui to flag it on Twitter and launder the fakery into an Arabic-language story for the Algerian daily, El Wamid elwamid.com/%D8%A3%D9%85%D…

Shadia Ben Yousef was one of the most active journo personas and her fake stories caused real pain to at least one person. When Najwa Qassem, a popular Al Arabiya anchor, passed away suddenly of a heart attack, Ben Yousef wrote a story suggesting the UAE murdered her

In a cruel twist, the Ben Yousef persona invented a fake quote from Qassem's friend, Rima Najm, who wrote of her shock, hurt, and confusion seeing her name used with a fake quote to push a conspiracy theoru about her friend's death al-hiwarnews.com/?page=article&…

Some of Ben Yousef's stories were so absurd they were actually funny. When coronavirus hit, the personas planted stories trying to paint the US as the source of the virus. They used a forged tweet from a French MP to suggest that McDonalds McNuggets spread the virus

Facebook was able to attribute some of the activity they found from suspended accounts to Iranian territory. But there are other hints of a possible Iran nexus. For instance, at least two of the stories appeared on fake news domains seized by DOJ and attributed to the IRGC

While Facebook acted quickly, unfortunately Twitter still hasn't responded to the emails I sent them weeks ago warning about these accounts, including one pretending to be a jihadi group threatening attacks. cc @yoyoel

Account was part of an effort to threaten the Bahrain conference on the Arab-Israeli peace conference. They created a phony Twitter account for a fictitious jihadist group to issue threats against it in an attempt to disrupt. You'd think Twitter would care about that ¯\_(ツ)_/¯

One tangent I'll raise. We were never able to get this attributed so it's technically not part of the above basket but it is odd so I'll flag. When the personas were pushing that impersonated Israeli cyber security official for the election conspiracy, they stole another identity

The Rumaisa Hanaoui persona was one of a very few accounts that tweeted a link to the fake claim that the UAE was funding Trump's reelection. The other was an account impersonating a real life antifa activist. We talked to the real guy and he confirmed this was fake.

Even stranger, when you scrolled through his timeline it turned out the fake antifa account was "feuding" with another fake account impersonating Joey Gibbs, the head of the right wing extremist group Patriot Prayer.

We can't say that the same people behind the reporter personas are the same people behind the impersonated Antifa and Patriot Prayer accounts and have the same links to Iran. There isn't enough evidence to support any conclusions about origins and linkages yet

But given Iran's demonstrated interest in imitating the Proud Boys (remember the FL election emails and the BLM impersonations) and seizing on our dysfunctional civil society to stoke violence, this is something I'd like to follow up on. If you see any strange impersonations...

...feel free to drop me a line.

If you're a researcher, academic or a journalist and you'd like to see all of the articles in this story, I've got a spreadsheet I'm happy to share privately. Drop a line.