The report

Executive summary

For three years, a covert paid influence campaign has pushed more than half a billion exposures of far-right propaganda to 30 countries, mostly in Europe. Beginning in October 2023 and still advertising in October 2026, the operation targeted audiences across Europe, the Americas, Asia and the Middle East with racist, anti-Muslim, anti-migrant, anti-Qatar and anti-Iran messaging. The recorded total is 533 million exposures¹, a composite of commercial-tracker impressions, platform reach and video views.² Projected for advertising the archives could not obtain, it reached 831 million. This figure is likely a massive undercount, and only accounts for advertising cost, as opposed to labour and commissioning costs.

Over the past three years we have documented and tracked the campaign, creating a large archive of its content. The archive holds 1,473 Facebook advertisements with 94.7 million recorded reach; 189 YouTube videos on 15 channels with 132 million public views; 359 TikTok advertisements with 72.2 million reach; and 105 videos on the No to the Iranian Occupation TikTok account with 5.6 million views. The campaign also ran web ads, although it was not possible to count the reach or number. On the 17 pages it covered, the commercial tracker Ad Clarity recorded 262 million impressions and $1.59 million of spend.³ Alongside the advertising, the operation ran branded and covert accounts on Twitter/X and Telegram, a Change.org petition signed by more than 7,500 people in the name of a fake human rights organisation, a sockpuppet network of at least 24 accounts editing Wikipedia, and billboards in Times Square and Lebanon.

The campaign’s European messaging draws heavily on the “Great Replacement” conspiracy: the racist belief that Europe’s white, native population is being deliberately displaced through mass immigration, particularly Muslim immigration, as part of an organised political project. In antisemitic variants, Jewish elites are presented as orchestrating or financing this process, with George Soros frequently cast as its architect. This campaign reproduces that conspiratorial structure but places Qatar in the role usually assigned to Soros: the concealed force directing migration, manipulating European institutions and seeking to “Islamise” Europe. Historical conquest imagery, inflammatory slogans and AI-generated parody songs present Muslim presence itself as evidence of conquest. In Lebanon the campaign deploys anti-Iran and anti-Hezbollah narratives, and in 2026 it carried calls for regime change in Iran to European audiences on TikTok, in at least 118 advertisements with 12.6 million recorded reach. Interestingly, this campaign calling for regime change in Iran started four days before the US-Israeli bombing of Iran on February 28th.

The operation ran in three phases, which group pages rather than mark strict date windows: October 2023 to July 2024, mainly on Facebook; a smaller burst in November and December 2024, aimed mainly at Hungary; and October 2025 to October 2026 on Facebook, YouTube and TikTok. Phase-one buying in France ran through the months before the June 2024 European Parliament election, and UK buying stopped on 17 May, days before the general election was called, and two months before the anti-Muslim Southport riots. Meta told AFP in early July 2024 that it had removed the network nearly two months earlier, which puts the removal at about mid-May. The archive nonetheless records 27 advertisements from one phase-one page, Défendons la laïcité, on 13 and 14 June, and 22 on pages grouped into phase two between 1 June and 1 July. The authors published on 7 July 2024 and Meta disclosed the takedown in August. Advertising resumed under new identities in November 2024 and returned at scale in October 2025. Phase-three buying in Germany ran through the Saxony-Anhalt state election of 6 September 2026 and resumed later that month. In October 2026 YouTube terminated four of the 15 channels, Grand Theft Qatar, EURO Summer Fest, Qatar is Responsible and AirAlert, for violating its Terms of Service, and the videos of ThanksIran and Wedontwantyoutobewithus were no longer available. On 26 October new channels under the first three names (@GrandTheftQatar2, @EuroSummerFest-z and @QatarIsResponsibl3) posted eight videos, with the same channel descriptions and the same Brazilian advertisers as the previous flight.

Among the operations in Meta’s published reports on coordinated inauthentic behaviour (CIB) and adversarial threats from 2018 to 2025 that targeted EU member states, none has higher disclosed advertising spend than this operation’s first phase, which Meta puts at around $1.2 million. That is 69% of the total across the 13 EU-facing networks with a stated spend, 6.8 times the next largest and 11 times what Meta stated for Doppelgänger. On Meta’s whole record phase one ranks sixth, or seventh if The BL network, for which Meta gave only a ceiling, spent more, and the five operations above it with exact figures are commercial advertising or public-relations firms working for political clients (Section 9.7).⁴ Phases two and three appear nowhere in that record, and will likely make the campaign the most expensive CIB operation in Meta’s history. For phase one, Meta’s own figure is more than a thousand times the spend visible for the same pages in its public Ad Library, because almost none of the advertising was filed as political or social-issue content. Set against the audience figures published for other documented operations, this is one of the largest influence operations by known reach ever recorded (Section 9.7).

Advertising was placed through accounts and companies recorded in Vietnam, Brazil, Belgium, and through German-named TikTok advertiser strings, none with a disclosed connection to the countries targeted. When asked, the Vietnamese proxy LT Media and the Brazilian agency Agência Moll, gave the same account: the advertising assets were sold to a buyer they could or would not identify. Phases one and two form a single connected component in the disclosure records; the two phase-three clusters are joined to it, and to each other, by narrative and method rather than by any shared payer, advertiser or beneficiary (Section 14.2).

The evidence indicates with moderate to high confidence that the campaign originated in Israel, with other entities acting as contractors for various dimensions of the campaign. Campaign material passed on two occasions through former Gaza Humanitarian Foundation head Johnnie Moore and his public-relations firm JDA Worldwide. One Wikipedia editing session on 30 January 2024 included a fixed-line Israeli IP address interleaved with campaign accounts and known German proxy exits. That is consistent with a proxy failure exposing an operator’s own presence in Israel. Edit metadata in the videos on the operation’s Telegram channel puts their production on a Sunday-to-Thursday working week at UTC+3, on machines with Hebrew drive and folder names, and one machine’s clock moved back between 22 and 27 October 2024, the week Israel left daylight saving time. The same Telegram metadata also includes the same name as a prominent Israeli political creative campaigner with ties to people working in Israel’s influence industry, including Lior Chorev, who was implicated in a reportedly aborted anti-Qatar operation in October 2023. The narrative, anti-Qatar, anti-Muslim and anti-Iran, is consistent with Israel’s politics, and specifically previous campaigns reportedly contracted by the Israel’s Ministry of Diaspora Affairs through the Tel-Aviv firm STOIC.

We also analysed a sample of responses to the ads. The advertising drew polarised responses. Of 406 comments coded on UK-targeted Facebook advertisements from one page in 2024, 61% supported Islamophobic views and 19% opposed them. Of 2,560 top-level YouTube comments from 2024 to 2026, 28% supported the advertisement’s message and 42% opposed it. Italian was the only language in which support led. 15% of the YouTube comments attributed the advertising to Israel, and a share of those crossed into antisemitic tropes. The two samples differ in platform, years, campaigns and coding, so the gap between them is not evidence of a platform effect, but points to how the ads promote polarised discussion on the issue of Islam and immigration in Europe.

Key findings

1. Between October 2023 and October 2026 the operation recorded at least 533 million exposures of anti-Muslim, anti-migrant, racist and anti-Qatar advertising in 30 countries, mostly in Europe.

2. Meta puts the first phase alone at around $1.2 million. That is the highest advertising spend Meta has disclosed for any operation targeting EU member states: 69% of the total across the 13 such networks with a stated spend, 6.8 times the next largest and 11 times what Meta stated for Doppelgänger. Phases two and three appear nowhere in Meta’s record (Section 9.6). At the commercial tracker’s rate, with YouTube views at $0.02 each, that advertising prices at $5.08 million, and at up to $8.22 million when projected for what the ad archives missed. Exposures are deliveries in mixed units (impressions, reach and video views), and one person can account for several (Sections 1.1, 9.4, 14.6).

3. The operation ran for 37 months in three phases and survived enforcement by Meta . Meta removed the phase-one network in about mid-May 2024; advertising resumed under new identities in November 2024 and returned at scale in October 2025 (Sections 1.2, 8.4), highlighting the relative ease of bypassing platform moderation.

4. After the takedown the operation returned to Meta but had even more success with YouTube and TikTok. 189 YouTube videos on 15 channels drew 132 million views, more than the 94.7 million reach of all 1,473 Facebook advertisements, and 359 TikTok advertisements reached 72.2 million. While TikTok tend to remove offending ads (although not the advertiser responsible), six of the 15 YouTube channels were terminated or emptied only in October 2026, and three were replaced under the same names within days (Sections 1.1, 10.1).

5. In Europe the campaign uses the structure of the “Great Replacement” conspiracy theory, with Qatar in the role antisemitic versions give to George Soros: a hidden power directing Muslim immigration to “Islamise” Europe. In Lebanon it ran anti-Hezbollah and anti-Iran material aimed at Shia audiences (Sections 4.1, 4.2).

6. Almost none of the advertising was filed as political or social-issue content, so Meta’s transparency rules for that category did not apply. For phase one, Meta’s own figure is more than a thousand times the spend visible for the same pages in its Ad Library. Google and TikTok publish no spend figures (Sections 8.3, 10.1).

7. France received the most placements, 991 of 2,748. The largest audiences were in the UK, with 154 million recorded exposures, and the United States, with 100 million. Phase two was aimed mainly at Hungary, and phase three at France, Germany, Italy, the UK and Lebanon (Sections 2.1, 2.2, 2.3). These figures are known exposures, the actual balance received by countries is likely to be different from the known figures.

8. The advertising ran alongside elections. Phase-one buying in France ran through the months before the June 2024 European Parliament election, and UK buying stopped on 17 May 2024, days before the general election was called. Phase-three buying in Germany ran through the Saxony-Anhalt state election of 6 September 2026 (Section 2.3). The campaign remains active in countries approaching major elections, including France and Italy in 2027. Its sustained promotion of anti-Muslim and anti-migrant narratives raises concerns about attempts to shape the political environment ahead of these votes, beyond the formal election campaign period. The campaign targeted the UK in the months leading up to the July/August 2024 anti-Muslim riots that occurred after the Southport murders.

9. The operation also ran on Twitter/X, Telegram, Wikipedia and Change.org, and offline: billboards in Times Square and Lebanon, a video screened at CPAC 2024, and a staged protest by two former US pageant winners outside a Valentino store in Atlanta. A sockpuppet network of at least 24 accounts edited Wikipedia articles on Qatar, and a petition in the name of a fake human rights organisation gathered more than 7,500 signatures (Sections 5, 7.1).

10. Advertising was placed through accounts and companies recorded in Vietnam, Brazil and Belgium, and through German-named TikTok advertisers, none with a disclosed connection to the countries targeted. Payers and page identities changed repeatedly: the median identity advertised for 3 days. The two intermediaries who responded, LT Media in Vietnam and Agência Moll in Brazil, both said they sold the advertising assets to a buyer they could not or would not identify (Sections 6, 8.1, 8.2, 10.3).

11. The evidence indicates with moderate to high confidence that the campaign originated in Israel. Edit metadata in the Telegram channel’s videos puts their production on a Sunday-to-Thursday working week at UTC+3, on machines with Hebrew drive and folder names; one Wikipedia editing session exposed an Israeli fixed-line IP address among German proxy exits; and campaign material passed twice through Johnnie Moore and his firm JDA Worldwide. The client who commissioned the operation is not established (Section 7.3).

12. The advertising drew polarised responses. Of 406 comments coded on UK-targeted Facebook advertisements in 2024, 61% supported Islamophobic views. Of 2,560 top-level YouTube comments, 28% supported the message and 42% opposed it, and 15% attributed the advertising to Israel (Section 12).

13. The operation repurposed material circulated by prominent far-right and anti-Muslim accounts. Editing metadata identifies the source clips used in 18 Telegram videos: twelve drew from RadioGenoa, while other source accounts included Tommy Robinson, Éric Zemmour and Europe Invasion. The operation retained or adapted captions and added its own branding and allegations that Qatar was orchestrating Europe’s “Islamisation” (Section 5.5).

14. The campaign combined AI-generated imagery and songs, video-game and music-festival parodies, and repurposed footage of migration and protests. Creatives referencing Ceuta and French student protests presented these events as evidence of a Qatar-directed project to “Islamise” Europe, while Christmas-song parodies depicted Muslims as displacing European cultural traditions (Section 4.1).

15. The operation’s European-targeted TikTok advertising promoting regime change in Iran was running by 24 February 2026, four days before US–Israeli strikes began. This strand comprised at least 118 advertisements with 12.6 million recorded reach, including messages opposing negotiations with Tehran and depicting the government’s overthrow.

Key numbers (the tiers are defined in Section 14.6)

1. The campaign in numbers

Every figure below is a recorded composite total, including some estimates, unless it appears in the projected column.

The following table uses impressions, reach and views, which have slightly different meanings but are the best available engagement metric across platforms.

1.1 Scale and platforms

The operation placed at least 1,473 Facebook ads, 189 YouTube videos across 15 channels, 359 TikTok ads through 5 named advertiser accounts, and 105 videos on the No to the Iranian Occupation TikTok account. The nine campaign websites are recorded separately from the 2,126 items (Section 6.4). The campaign also placed display advertising on the open web, documented through Google’s Ads Transparency Center and, where possible, user discussions on Reddit. The available data does not allow the number of web ads to be counted. Facebook mostly carried the first phase, with occasional YouTube, TikTok and Twitter presence. TikTok and YouTube carried much of the third. YouTube delivered comparable reach from far fewer items: video advertising against a broad audience is cheap, and almost all of the videos were still online in September 2026. In October 2026 six of the 15 channels were terminated or emptied, and three were replaced under the same names within days.

1.2 Timeline

Plotted by month, the operation runs in three phases. The first, from October 2023 to July 2024, peaks in February 2024 at 247 archived items in a single month, four months before the European Parliament vote. No paid placement is recorded for the next three months, though neither the operation nor the record of it stops: the campaign’s own X account posted 65 times across August, September and October 2024; and its Telegram channel, t.me/MadeInQatar24, 52 times across the same months.

Paid placement returns at an apparently lower volume in November and December 2024 and then stops. No paid placement is recorded from January to September 2025; the No to the Iranian Occupation TikTok account began posting in August 2025, and the campaign’s own X accounts, @Qatarsis24 and @TheQatarPlot, the second renamed @IslamistWeb along the way, carry 118 recorded posts running to 5 February 2025. Measured on what can be observed, the operation ran in terms of regular posting without a break from October 2023 to February 2025. The third is the biggest in the archive, at 259.6 million across three platforms against phase one’s 40.7 million of archived Facebook reach, and runs from October 2025 to October 2026. Phase one carries a larger figure in the recorded tier, 267.1 million, but only because the commercial tracker covered 17 of its 26 pages and none at all in phase three: 83 per cent of phase one’s archived reach is replaced there by tracker impressions. The two tiers are not comparable across phases, which is why this comparison is drawn on the archive.

1.3 Campaign timelines

The 72 curated campaigns varied widely in duration. 47 were live for a month or less, while the longest advertising campaign, Qatar's Behind This, ran for 11 months. No to the Iranian Occupation is the outlier: a Facebook page in November 2023, then an X account, a YouTube channel and a TikTok account, it spans 35 months, though only its first advertisement and its TikTok videos are in the ad archive (not every X post). Many overlapped, since a few long-running pages placed most of the advertising while shorter-lived pages opened and closed around them. Duration here is considered putting out new content. The graphs show a continual line running to represent the fact they are still public on those with YouTube channels. In phase 3 some pages carried identical names but different IDs, the same branding reused on a fresh page. Section 14.3 explains how names, identities and items are counted, and why 72 campaigns sit on 64 page identities.

2. Geography and places targeted

The operation's geography shifted over the 37 months. Across the three phases the operation is recorded in around 30 countries on five continents. That figure combines two sources. The ad archive records a target country per item and covers 17 countries. Ad Clarity, the commercial tracker, was available for phase 1 and one phase-2 page only; it records impressions and spend per country, includes channels the ad archive misses, and covers 21 countries. Eight countries appear in both. Thirteen appear only in the tracker (Austria, Canada, Egypt, India, Israel, Lithuania, Malaysia, Romania, Singapore, South Africa, Spain, Thailand and the United Arab Emirates) and nine only in the ad archive (Belgium, Brazil, Croatia, Italy, Lebanon, Malta, Saudi Arabia, Sweden and Switzerland). Both platform archives and commercial trackers are limited in what they expose, so the picture is incomplete.

2.1 Placement volume

By number of archived individual ad placements, France leads with 991, more than the next three countries combined. The count takes Facebook advertisements, YouTube videos and TikTok advertisements together and counts one placement per target country named, so the 1,840 items that carry a targeting field resolve to 2,748 placements, 908 of them a second or later country of a multi-country buy. 334 of the 2,748, or 12%, were aimed outside Europe, almost all at Lebanon and the United States.

Exposures with a recorded target country total 520.2M, of which 76% fall to Europe. The United Kingdom accounts for 154.1M and the EU member states for 238.1M. The United States accounts for 99.7M, 98.7M of it in phase 1 and 1.0M from a single phase-3 placement.

Asia accounts for 25.8M. The table separates the Middle East, which is the Lebanese strand plus small Gulf deliveries, from South and South-East Asia, where the tracker recorded delivery to India, the Philippines, Singapore, Malaysia and Thailand that the ad archive has no record of. It is not clear if South-East Asian targeting was a means of first ‘warming up’ ad accounts. South America is 0.8M, from two Lebanon Free advertisements whose delivery panel is Brazilian states, possibly an error on the operator’s part. Africa is 0.2M, from Egypt and South Africa. A further 12.4M of the 532.6M recorded total carries no target country, 12.3M of it on items with no targeting field and 0.1M where TikTok’s per-country figures fall short of an advertisement’s total, and is excluded from the shares.

2.2 Audience exposure

By recorded exposure the UK leads with 154 million, followed by France with 121 million and the United States with 100 million. France has the most ad placements but ranks second by audience. The UK and the United States together account for 49% of all recorded exposure with a target country. Exposure here is booked to the country an item targeted, which is not the same as where its audience was. Only the commercial tracker publishes delivery by country, and TikTok publishes reach by target location. Facebook reach is booked to the first target country an advertisement names, and YouTube views to the target country recorded for the video. YouTube publishes no viewer location, so that allocation is an assumption: the language of each video and the regions listed in Google’s Ads Transparency Center support it, but it is not a measurement.

Italy ranks third by placements, with 356, and fourth by audience, with 76 million exposures. About 49% of these come from 36 YouTube videos whose 37.5 million views are allocated to Italy by their targeting. No Italian placement appears in the phase-one archive, although that does not mean it was not targeted.

On archived Facebook reach alone France leads. The tracker, which covers channels the ad archive does not, records 127 million UK impressions on the pages it measured. Figure 7 combines the two without double counting, using tracker impressions for the pages the tracker covered and archived reach and YouTube views for the rest. The units are mixed, as Section 14.5 explains.

2.3 Geographical shifts

The operation's centre of gravity moved twice. Phase 1 was predominantly on Western Europe and the United States, with some reach in India. Phase 2 was a smaller buy aimed mainly at Hungary. By phase 3 the United States had fallen to a single placement.

The below table shows exposures per country across phases on the definition Figure 7 uses: tracker impressions where the tracker measured a page, archived reach and YouTube views elsewhere, TikTok reach split by country as recorded, and YouTube views allocated to the target country of each video. Phase 3 takes Facebook, YouTube and TikTok together. Units are mixed, as Sections 14.5 and 9.2 set out.

In phase 1 the UK took 128.2M of the 266.8M targeted exposures, 48%, and the United States 98.7M, 37%. France took 28.8M, 11%, although it had 570 of the phase's 921 placements, against 174 for the UK and 106 for the United States. The remaining 71 placements went to Croatia (16), Belgium and Sweden (14 each), Germany (11), Lebanon (7), Malta (4), the Philippines (3) and Saudi Arabia (2). Other countries, including India, account for 10.5M exposures. Italy took nothing.

Phase 2 amounted to 97 advertisements¹⁴, 81 placements and 4.7M targeted exposures, 1.8M of them the commercial tracker’s impressions for Make the West Great Again, the one phase-two page it covered (first seen 8 December, last seen 10 December 2024). Hungary, which has no documented placements in phase 1, took 34 placements and 1.0M exposures. France took 32 placements and 1.6M. The Hungarian ads started two weeks after Budapest hosted the November 2024 European Political Community summit, and included page names like "Orban is right".

Phase 3 delivered 248.6M targeted exposures to six markets. France took 90.1M, more than a third of the total, from 389 placements, and Italy 76.2M from 356. Germany took 33.7M from 379 and the UK 25.3M from 64. Lebanon took 208 placements but only 15.2M exposures, 6%. The United States fell from 98.7M to 1.0M, on a single placement. Germany rose from 0.6M to 33.7M and Italy from nothing to 76.2M. These are recorded figures, not a complete count, and do not account for potentially missed campaigns.

Elections and other political events

The operation’s first phase overlapped with a concentrated period of electoral campaigning in France and the United Kingdom. France voted in the European Parliament elections on 9 June 2024, followed by snap legislative elections on 30 June and 7 July; the UK held its general election on 4 July. The campaign therefore placed anti-Muslim and anti-migrant narratives before audiences in both countries during the run-up to major votes.

After the removal Meta dated to about mid-May, the ad archive holds 30 items starting in June, 27 of them from the phase-one page Défendons la laïcité on 13 and 14 June and three on pages grouped into phase two, and 19 more on phase-two pages starting on 1 July, after which no further placement starts until 21 November. The investigation was published on 7 July and Meta disclosed the removal of the network in August.

The Southport attack on 29 July falls after the last placement began. The stepped line is cumulative archived reach on the right axis, 43M: 40.2M on phase-one pages and 3.2M on the phase-two pages that ran in June and July 2024; the horizontal rule is the tracker total for phase 1, which the ad archive does not itemise by date.

In 2026, to the archive cutoff of 21 October, Germany received 339 placements, second only to France’s 358, so the two panels are on separate scales. Apart from four YouTube placements in January, German placements came in two runs and a tail. The first was on TikTok: 141 placements in the five weeks from 23 February, including the Iran material (Section 4.4), and 31 more in April, the last of them delivered on 24 April. Nothing was placed in Germany from May to late June. The second run began in the week of 29 June on Facebook, YouTube and TikTok and held at about nine placements a week through August; the last German Facebook placement started on 3 September and was delivered until 6 September, polling day. German-targeted TikTok advertising then resumed, with one advertisement starting on 22 September and 82 more between 2 and 21 October, 56 of them the “What will be the next flight?” and “Air Alert” series. Those were still being delivered on 21 October, when the archive was last captured, so the record shows no end to the German advertising. The line is cumulative archived exposure for the same rows, Facebook and TikTok reach with YouTube views: 26.5M for Germany of 201.4M across the window, on its own axis at right. The rule marks polling day in the Saxony-Anhalt state election, 6 September 2026.

The campaign also ran ads around local elections in the UK in 2026. Shahid Butt was an independent candidate who ran for a seat on the Birmingham City Council representing the Sparkhill ward in the UK local elections held on May 7, 2026. He was not elected, finishing seventh in the ward with 453 votes.¹⁷ His candidacy drew widespread national attention and controversy due to his past imprisonment for his role in an armed plot to bomb the British consulate, an Anglican church, and a Swiss-owned hotel.¹⁸ The campaign, based on no evidence, suggested Qatar was behind his candidacy.¹⁹

2.4 Monthly activity by country

The country mix changed month by month as well as phase by phase, in terms of number of ads tracked. France dominates the first burst and the smaller second one. The third is different: Lebanon carries the July 2026 peak, with Italy and Germany behind it and France reduced to a minor band. slightly When the operation returned, it was aimed at a different set of countries.

3. Campaign identities

The operation consisted of multiple campaigns. It ran through a roster of disposable identities: at least 64 Facebook pages, 15 YouTube channels and 5 TikTok advertiser accounts, with X accounts, Telegram channels and campaign websites attached to some of them. Section 14.3 explains how names, identities and items are counted, and why the 72 curated campaigns sit on 64 page identities; Section 8.1 describes the disposable-identity model as an evasion method. This section describes that model as it appears in the data: who the identities were, how the work was spread across them, and how they related to one another across platforms. Appendix A lists all identities..

The distribution is steep. The largest page, Sauvons le Liban, ran 203 advertisements and the second, Défendons la laïcité, 200; the third, the Arabic-language فك الارتباط الان, ran 157. Those three carry 38% of the 1,473 archived Facebook advertisements and the ten largest carry 69% of the rows and 67% of the archived Facebook reach. 28 of the 64 identities ran five or fewer advertisements, 17 ran one or two, and six ran exactly one. Across the 61 identities with a dateable run, the average placed about 24 advertisements, the median 7. Reach is concentrated differently from volume. Euro Summer Fest, a phase-three page with 65 advertisements, accounts for 26.2 million of the 94.7 million archived Facebook reach, 28% of the total and more than the two largest pages by volume combined.

The three phases used identities differently. On Facebook, phase one ran 1,018 advertisements through 26 pages with a median of 18 advertisements each and 40.7 million archived reach: these were the campaign pages, with names, a visual identity and in several cases a website and an X account to match. Behind them was a second layer of approximately 49 sponsor and beneficiary pages, eight of which also ran advertising of their own, for 67 phase-one identities in all; 34 of those sponsor pages placed 235 advertisements across nine campaigns, and Section 6 traces them, through boilerplate, stolen and Vietnamese-named pages, to the LT Media supply chain. Meta’s own takedown disclosure for this phase counted 65 Pages, 112 Facebook accounts and 49 Instagram accounts with about 38,000 followers between them.

Phase two, on Facebook alone, ran 97 advertisements through 24 pages with a median of two each and 4.5 million reach: burner identities, most of them English-language European-identity names such as Newrope, Orban is right, They are here and Stand Strong Europe, alongside a few pages dressed as something else, TeslaX, Tato’s Sport Bar & Grils, EU News and The Policy.

Phase three ran 358 Facebook advertisements through 14 pages for 49.5 million reach, but most of its audience was elsewhere: 189 YouTube videos on 15 channels drew 132.2 million views, 359 TikTok advertisements from five named advertiser accounts reached 72.2 million, and the brand account’s 105 TikTok videos drew 5.6 million, fewer identities carrying far more audience each; here the names were reused across platforms and, in some cases, across successive page IDs, the same branding on a fresh page after the previous one was lost.

Facebook identities are counted after merging the two spellings of Euro Summer Fest. Reach is the archived platform figure and carries the phase-one estimate caveat set out in Appendix A; the tracker’s impression figures for the 17 pages it covered are substantially higher (Section 1).

The names themselves fall into a few families. Forty-seven of the 64 Facebook identities carry English names, eight French and nine Arabic. Seventeen are named for Qatar (Shame on Qatar, The Qatar Plot, Qatarsis, Don’t fund Qatar, Made in Qatar, Stop Qatar, Qatar is Responsible, Qatar’s Behind This, Grand Theft Qatar, Cut Q, Keep Qatar out, rotten emir and others), and seventeen for Europe or the West (Save Europe, Europe First, The Plot Against Europe, Make the West Great again, Save The West, Stand Strong Europe, Invaderss, Dark Age, The End). The French pages spoke the language of laïcité and Lebanese solidarity: Défendons la laïcité, Sauvons le Liban, Ne Financez pas le Qatar, Le Projet, Qataracte. The Arabic pages addressed Lebanese and specifically Shia audiences: حرب ٢٠٠٦ تنذكر وما تنعاد, الشيعة ضد الحرب, لا للإحتلال الإيراني, لبنان حر, شكرا على تدمير الجنوب. A last group had names that were less explicit about the contents: Le vestiaire du PSG, Euro Summer Fest, One Peace Global, It’s In Your Hands, You Have The Power, Harrods Secrets, Family Secrets..

Eighteen of the 72 campaigns ran under the same name on more than one platform; 47 were Facebook-only and seven YouTube-only. In phase one the pairing was Facebook with X (The Qatar Plot, The Plot Against Europe, Save Europe, Made in Qatar), with a website added for Shame on Qatar, Don’t Fund Qatar and Qatarsis, and It’s In Your Hands on all four. In phase three the brands were built to span Facebook, YouTube and TikTok together: Euro Summer Fest, Qatar is Responsible and Grand Theft Qatar ran on all three, and Qatar’s Behind This, Stop Qatar and كاريقطر on Facebook and YouTube. The YouTube channels are as concentrated as the pages: Qatar’s Behind This carries 62 of the 189 videos and 57.9 million of the 132.2 million views, 44% on its own, and the three largest channels 75%. On TikTok one advertiser account, Alemira, placed 251 of the 359 advertisements and 64.6 million of the 72.2 million reach: 158 under its own name and 93 that TikTok removed and stripped of name and payer but still lists under Alemira’s business ID. The others are Goge with 71 (28 of them removed and listed under its business ID), away.fromus with 18, NovaTech Solutions GmbH with two and an advertiser named Grand Theft Qatar with one. Sixteen removed advertisements carry no name and no business listing and are not assigned to any account. Goge and NovaTech are discussed in Section 8.2. Section 5 sets out how the platforms were linked in practice.

Of the 61 identities with a dateable advertising run, the median ran for 3 days and 57% placed everything inside a single week; twelve sustained buying for three months or more, and Défendons la laïcité, The Plot Against Europe, Sauvons le Liban and Shame on Qatar each for five (Section 10.3). Meta removed the phase-one network around mid-May 2024 and disclosed the takedown in August 2024; no enforcement was recorded against any YouTube channel or TikTok advertiser account before October 2026, apart from the removal of individual videos (Qatarsis, the No to the Iranian Occupation channel) and of single TikTok advertisements. In October 2026 YouTube terminated four channels, and three reappeared under the same names (Section 1.1). None of the identities mattered on its own. When one was lost the branding moved to the next, so action against individual pages left the operation intact, and the sheer number of identities suggests the operator expected to be caught.

4. Narratives and Content

Overall the campaign had two strands. The most harmful and overarching theme was promoting animosity towards migrants and Muslims through invoking fear of a ‘Great Replacement’, and claiming Qatar was orchestrating this. The second was framing Lebanon’s war and broader challenges as solely the result of Iran and Hezbollah. The below excerpts and screenshots are just examples, due the sheer volume of content produced.

4.1 Towards the Great Replacement

The opening material addressed the mother of Qatar’s Emir directly, calling on her to use her influence to free hostages held in Gaza. Qatar was not holding the hostages, and Sheikha Moza holds no political office. Interestingly, earlier material in the campaign had been directed at the president of the International Committee of the Red Cross (ICRC), indicating a strategy to experiment and pivot as needed. The campaign quickly pivoted to being an anti-Muslim, anti-migrant and xenophobic campaign.

Across the examples, Qatar is repeatedly positioned as the enabling force behind a wider civilizational threat: funding migration, imposing sharia law, and supporting actors presented as hostile to Europe. These claims intersect with explicitly anti-Muslim and anti-migrant frames, including the “Great Replacement,” the supposed erosion of Christian identity, migrant crime and disorder, and Islam as an inherent threat. The anti-Qatar messaging was embedded in broader narratives about migration, Islam, demographic change, Christianity and regional geopolitics; it was never a standalone critique of Qatar, though Qatar functioned as a useful protagonist - often important in conspiracies. It is also worth noting that while Qatar is predominantly a Sunni Muslim country, many of the creatives in the campaign use footage from Shia public rituals as Latmiya (Lamentation) and Juloos (processions)—these are found commonly posted around anti-Muslim and otherwise xenophobic circles online, as the language barrier and cultural unfamiliarity facilitates insinuation of ominous overtones in a large number of Muslims gathered in public for religious expression.

Examples of campaign content

The Save Europe, Stop Qatar channel use slogans like “THIS IS AN INVASION” and “QATAR IS ISLAMISING EUROPE” with the repeated demand to “SAVE EUROPE | STOP QATAR.” By juxtaposing inflammatory protest placards with an image of collective prayer, it collapses the distinction between extremist rhetoric and Muslim religious practice, presenting both as evidence of a hostile takeover. The blood-dripping maroon graphics reinforce this association with violence, while the yellow warning text creates a sense of emergency. Qatar becomes the supposed organising force behind the threat, turning Muslim visibility in Europe into evidence of foreign interference. The imagery invites viewers to interpret diverse people and activities through a single conspiratorial narrative: Europe is under attack, Muslims are the instrument, and Qatar is responsible.

A video published by the Qatar is Responsible channel constructs a direct causal narrative linking Qatar to the alleged “Islamization of Europe.” It moves between footage labelled London, Paris and Berlin, asking “Do you know who is behind the Islamization of Europe?” before identifying Qatar as the alleged culprit. The video then broadens the claim geographically, moving from “They’re doing it in the UK” and “They’re doing it in France” to “And they’re doing it everywhere,” accompanied by footage of Muslims praying and gathering in public spaces. It culminates in the assertion “Qatar wants to impose Sharia law on you.” The sequence turns Muslim visibility across different European cities into purported evidence of a single coordinated process, with Qatar cast as the actor supposedly financing or enabling a continent-wide project of Islamisation.

Another video packaged the campaign’s message as a mock European summer festival, opening with “Qatar Productions Present: Euro Summer Fest — Now Live All Over Europe.” It then cuts between footage of large demonstrations and crowds, presenting scenes of political mobilisation as “all the greatest hits” and telling viewers to “Enjoy the live show.” The festival parody recasts disparate protests and public gatherings as parts of a single Europe-wide spectacle supposedly “produced” by Qatar. In doing so, the video advances the campaign’s wider claim that Qatar is not simply supporting particular causes or organisations, but is financing or orchestrating unrest and political disruption across Europe, using humour and familiar entertainment advertising conventions to package the allegation. It is also satirical, showing Islamic rituals overtaking traditional European practices, including the replacing of Danish traditional dances with Shia Islamic rituals.

Euro Summer Fest

One channel producing videos introducing viewers to ‘Islamic terms you must know’. One video uses a stark ultimatum narrative, presenting Europeans with the choice to “Convert, Die, or Live as a Second Class Citizen.” It then invokes Dar al-Harb, defining it as the Islamic concept of the “House of War” and claiming that it encompasses any territory not governed by Sharia law. The sequence strips a contested historical and jurisprudential concept of context and presents it as a straightforward description of how Muslims supposedly view contemporary Europe. In doing so, the video advances the campaign’s broader civilisational-threat narrative: Muslim presence is portrayed not simply as demographic or cultural change, but as an inherently expansionist project in which non-Muslims ultimately face conversion, death or subordination.

A series of videos extended the campaign into AI-generated Christmas songs, including one set to the melody of Wham!’s Last Christmas. The lyrics and captions repurposed a familiar festive song to push the campaign’s anti-Muslim and anti-Qatar narrative: “Next Christmas because of Qatar,” “you won’t eat any pork, no drinks at the bar,” and “now Santa’s name is Abu Baqar,” culminating in “because we rule your streets and we’ll do what we want.” Accompanied by footage of Muslims in European streets, the videos turn Christmas into another vehicle for the Great Replacement narrative, depicting Muslims as a hostile population imposing cultural and religious rules on Europeans while presenting Qatar as the force enabling that transformation. The parody-song format packages xenophobic political messaging in something familiar, funny and easy to share.

Christmas

Another video made the Great Replacement framing explicit, opening with the warning “You are being replaced” and “Wake up!” over footage of Muslim crowds and public gatherings. The video then shifts from demographic alarmism to an allegation of deliberate sponsorship, presenting footage of police alongside the claim “Qatari money for anti-Christian policy.” The sequence ties together three elements of the campaign’s narrative: the idea that Europeans are being demographically “replaced,” the portrayal of Muslim presence as the source of that threat, and the claim that Qatar is financing or enabling the institutional policies responsible for it. As in the other videos, Qatar is cast as the hidden financier of a transformation of European society.

A single video developed the campaign’s “invasion” narrative through a historical analogy, moving from “the Turkish invasion of the Byzantine Empire” to contemporary footage of Muslims labelled “21st Century AD” and “The Silent Invasion.” By sequencing these images, the video presents present-day Muslim migration and presence in Europe as a continuation of historical territorial conquest. It culminates by attributing this supposed process to Qatar with the caption “Brought to you by Qatar.” The chronology is the point. Historical Muslim conquest, contemporary Muslim populations and Qatar are presented as stages of one continuing “invasion” of Europe.

The Silent Invasion

Muslim Brotherhood

Another set of French-language creatives adopted the visual language of public-opinion polling to legitimise anti–Muslim Brotherhood messaging. The graphics foreground purported survey results, including claims that 48% of Muslims in France want to “reduce the reasons for conflation,” one in two support banning the Muslim Brotherhood, and 47% favour strengthening national cohesion, alongside the injunction “It’s time to act” and the demand for “zero Muslim Brothers in France.” Muslim brotherhood imagery is prominently incorporated into one graphic, while mosques, Islamic symbols and prohibition signs recur across the series. By combining large numerical claims with the aesthetics of polling and civic messaging, the creatives give an appearance of empirical authority to a political argument that presents the Muslim Brotherhood as a threat to French social cohesion and calls for its exclusion from France, while also doing little to distinguish Islam from political Islam.

Minidocs

A mini series, called ‘Cities Stories’, produced content about the islamisation of various European cities, including Malmo - Sweden, Bradford - England, and Paris - France.

Tying into current affairs:

Ceuta

The campaign was often opportunistic, drawing off current events for maximum virality. For example, it drew directly on Ceuta-related disinformation and anti-migrant narratives, using Spain’s North African enclave as a visual shorthand for the supposed “Islamisation of Europe.” One creative depicts migrants apparently crossing a fortified Spanish border alongside a Gulf figure, before transforming into a Grand Theft Auto-style “Mission Passed: Islamization of Europe” screen. This imagery was then folded into the wider “Grand Theft Qatar” branding, explicitly connecting migration at Europe’s southern border to Qatar and presenting it as part of a deliberate project to transform Europe. The ads repackaged the already politicised imagery of Ceuta into a conspiracy narrative in which migration, Islam and Qatar form a single coordinated threat. Other creatives showed visibly Arab men breaking wine bottles, and turning churches into mosques.

UAE and British Universities

Released after reports that the UAE had restricted funding for Emirati students at British universities, this campaign video uses the story to reinforce claims of Muslim Brotherhood infiltration. It juxtaposes a Financial Times headline with imagery of Brotherhood flags flying above buildings labelled Oxford, Cambridge, Imperial and LSE.

French Protests and Riots

Examples of campaign videos combining imagery of the French student protests with video-game and music-festival parodies. Videos were careful to include images of Palestinian flags. Qatar-branded overlays and slogans such as “Qatar is responsible” portray the disorder as orchestrated by Qatar and link it to the supposed “Islamisation” of Europe.

Shaikha Moza obsession

The campaign’s fixation on Shaikha Moza gives the campaign a recognisable female villain through whom it can demonise Qatar. It likely seeks to invert her public association with education, philanthropy and international engagement—roles institutionalised through Qatar Foundation and Education Above All—and replace it with associations of extremism, deception and violence. In the Gulf, even mentioning someone’s mother’s name can be perceived as sensitive, so this could also be constructed as an attack on Qatar’s Emir (Shaikha Moza’s son).

The imagery makes that inversion explicitly gendered. “The mother of the Muslim Brotherhood” turns motherhood into an accusation: she supposedly nurtures the threat. “Queen of death,” accompanied by severed heads, presents her as personally responsible for bloodshed. The Arabic “الشرموزة” fuses her name with a misogynistic sexual slur (sharmuta = prostitute and moza = banana). Together, these devices attack her through femininity, sexuality and maternal identity, making humiliation part of the political message.

The montage placing her face between masked figures adds another insinuation: that her public appearance conceals a sinister identity. Meanwhile, the French, English and Italian posters place essentially the same accusation against recognisable European landmarks, with fire and smoke pointing to European civilisational destruction. Repetition encourages audiences to associate her face automatically with menace, while sexualised ridicule gives a second route to contempt. The matching multilingual posters clearly demonstrate adaptation of a common message.

FlyDubai

A set of TikTok advertisements aimed at France, Italy and Germany raised the prospect of aircraft hijackings by Muslim pilots. Forty-one ran under “What will be the next flight?” and fifteen under “Air Alert”, between 2 and 13 October 2026, within days of the flydubai incident at the end of September. They opened with a red “BREAKING NEWS” card captioned “Tragic news from the Middle East”, before cutting to archive footage labelled “29 August 1969 — TWA Flight 840”(This was the PFLP hijacking of a Rome-to-Athens flight that was diverted to Damascus). This linked with the Euro Summer Fest campaign which sought to imply Qatar was behind bombings of the 1980s (including Lockerbie).

Its subject is air safety and the background of Muslim pilots and crew. A YouTube channel, AirAlert, carried the same material from 2 October; the Google Ads Transparency Center lists a Brazil-based advertiser, Olimpio Lucas Pereira Silva, against it and against Grand Theft Qatar. Two of its three videos share the “What will be the next flight?” title and close on the instruction to check a pilot’s background for extremism; the third is a dramatised news bulletin reporting that flight FZ1073 was brought down by an extremist attack twenty minutes after a hijacking code was transmitted. Alemira placed all 56 TikTok advertisements, nine of them since removed and listed under its business ID, in English and French, for a recorded reach of 5,518,000, half of it in France; the YouTube channel was targeted at the same three countries. Their payer field reads “IRAN”, a billing name with no bearing on the subject (Section 4.4).

4.2 Lebanon

Lebanon took the fifth-largest share of placements, after France, Germany, Italy and the United Kingdom, though it ranks sixth by recorded exposure. The messaging there was not about European identity but about sectarian division: anti-Hezbollah and anti-Iranian material, Arabic-language pages, and content on the 2006 war and southern Lebanon. In Europe the operation exploited religious and ethnic division; in Lebanon, sectarian division. Phase 1 and Phase 3 both targeted Lebanon. Make Lebanon Great Again, which ran from May 2025, may be a continuation of the same strand; Section 4.5 sets out the evidence, and its figures are kept out of the operation’s totals. ²³

The Lebanon-facing materials in Phase 1 are characterised by intensely hostile anti-Hezbollah and anti-Iran messaging, portraying both as forces of foreign domination, destruction and sectarian control. Hezbollah’s weapons are associated with the destruction of Beirut and threats to civilian infrastructure, including Beirut airport, while the memory of the 2006 war is repeatedly invoked to warn against renewed conflict. Other creatives appear specifically tailored to Lebanese Shia audiences, attacking Wilayat al-Faqih, invoking Musa al-Sadr, and portraying Hezbollah and Amal as having subordinated Lebanese Shia interests to Tehran. This was particularly evident in the “Shia Against War” campaign, which sought to rally Shia opposition to Hezbollah and Amal and promoted material associated with Lebanese politicians and political movements critical of Hezbollah and Iran. It also promoted content relating to the Taharor political party, although Taharor publicly denied any affiliation with the campaign, suggesting that the operators were appropriating or amplifying sympathetic political actors rather than necessarily acting on their behalf. “Shia Against War” also attracted coverage from MEMRI, the US-based media monitoring and translation organisation founded by former Israeli military intelligence officer Yigal Carmon.

At its most aggressive, the campaign used grotesque and demonising caricatures of Iranian and Hezbollah religious leaders, depicting them as monsters or devils. Taken together, the materials frame Iran and its Lebanese allies not simply as political opponents but as an alien and malign force threatening Lebanese sovereignty, while attempting to cultivate and amplify anti-Hezbollah sentiment from within Lebanon’s Shia political sphere. Importantly, the role of Israel as a provocateur or belligerent is often omitted.

Content examples

These Arabic-language advertisements attack Hezbollah and Iranian influence through appeals to Lebanese Shia identity, memories of war and explicitly demonising imagery. Under “Shia Against War” branding, they oppose weapons at Beirut airport, present rubble as the consequence of war and invoke Musa al-Sadr’s commitment to Lebanon. Other panels accuse political figures of serving Iranian interests and portray religious leaders as betraying their communities. The most aggressive images depict Ali Khamenei alongside a horned demon and label him “Satan the accursed,” while another cleric is shown with Iranian and Israeli flags over his eyes beneath the accusation “double agent.” Together, the advertisements seek to detach Lebanese Shia identity from allegiance to Hezbollah and Tehran, portraying that allegiance as a source of destruction, deception and foreign control.

Save Lebanon

Some of the Lebanon narrative was directed at French audiences. For example, the “Sauvons le Liban” (“Save Lebanon”) materials use appeals to peace and national solidarity to frame Hezbollah and Iranian influence as the main threats to Lebanon’s survival. A cedar composed of bomb silhouettes turns the national emblem into a symbol of militarisation, while a caricature of a black-turbaned cleric apparently consuming the cedar portrays religious leadership as devouring the country. Alongside images of destruction and declarations that “we have had enough of war,” these visuals suggest that Hezbollah’s militarism and its alignment with Iran is the main source of Lebanon’s danger. French and Lebanese flags, a dove and statements attributed to public officials lend a respectable appearance to messaging that denigrates Hezbollah and its allies as destructive, predatory forces.

4.3 No to the Iranian Occupation after the takedown

Another channel was لا للاحتلال الإيراني ("No to the Iranian occupation). The brand did not end with Meta’s takedown, which Meta dated to about mid-May 2024 and disclosed in August. Meta's August 2024 report listed its X handle among the LT Media network's assets; on 26 September 2024, a month later, the handle was re-registered one letter shorter as @LalihtilalalIR, with the same name, octopus-in-a-turban logo and header, and by 13 September 2026 it had 12,600 posts, about 18 a day over the 717 days since re-registration, 10,500 followers, and paid verification since January 2026.²⁴ A YouTube channel under the same name opened on 13 January 2025 and reached 19 videos and about 3.5 million views before it was removed, around the time a similar channel (Make Lebanon Great Again -MLGA) appeared in May 2025.²⁵ A TikTok account, @lalihtilalalir, has posted since 18 August 2025 and had 7,926 followers and 74,800 likes on 13 September 2026, with pinned videos at 1 million and 577,000 views; its 105 videos to 17 September 2026 carry 5.6 million views in all.²⁶ The content is Lebanon-focused only: Naim Qassem speeches with mocking captions, the army, Berri, "Greater Lebanon", the hashtags #لا_للاحتلال_الايراني and #No_to_Iranian_Occupation, real clips under the octopus watermark mixed with AI-rendered imagery. No Meta advertising is recorded for the brand after April 2024.

Recorded after the takedown, the brand has 3.5 million YouTube views, which price at $21,500 at the report's blended rate of $6.09 per thousand (section 9.4), $14,500 at the $4.11 rate, or $10,500 to $52,500 at the $0.003 to $0.015 per view ARIJ applies to Lebanese YouTube buying. X is not priced: it publishes no advertising data for the account. The TikTok account is in the operation’s totals in section 9: its 105 videos to 17 September 2026, 5.6 million views, are in the working archive and are priced there at the blended $6.09 CPM, about $34,000, like every other non-YouTube exposure, since nothing in the record shows whether its views were bought.

4.4 Iran

The operation targeted Iran and Iranian influence from the outset. In Lebanon it used ironic messages such as “thank [Iran] for destroying the South”: the two YouTube channels carrying this material, ThanksIran and Wedontwantyoutobewithus, have 25 videos, all targeted at Lebanon, and 922,398 views. Seventeen videos use AI-generated imagery and sarcastic expressions of gratitude. The remaining eight combine protest footage with hashtag activism.

As part of a Thanks Iran campaign, the stills juxtapose a smiling family receiving an Iranian-branded gift with scenes of destruction. A young girl and a woman in a black headscarf smile as the family gathers around a green box tied with a red ribbon and marked with the Iranian emblem. These warm domestic scenes give way to a rubble-filled street and Arabic lettering formed from debris. The sequence frames Iran’s apparent generosity as a deceptive gift that brings devastation to Lebanese families.

In 2026 the Iran material moved to TikTok and to European audiences. Forty-five advertisements ran between 2 and 12 March 2026 under three captions, “Revolution in progress” (33), “Iran Revolution” (six) and “Share and comment on the Iranian Revolution” (six), with English, French and German as the targeting languages. Their recorded reach of 2,567,500 was in Germany and Italy above all, and otherwise in Belgium, France, Switzerland and the Netherlands; none was aimed at Iran or Lebanon. The archived covers show the same material on 71 more advertisements from 24 February to 27 April whose captions only ask viewers to comment and share, and two more are captioned “A liberation is taking place”, so at least 118 advertisements and 12.6 million of reach carried it (Figure 47). Another 54 generic-caption advertisements of those months have no surviving cover that shows their subject. The advertiser ‘Alemira’ placed nine and ‘Goge’ two; the other 34 have since been removed, and the library lists them under the business IDs of Alemira (18) and Goge (16). The payer field on these accounts reads “IRAN”, “Yuh232” or both. That is a billing name, not evidence of who paid and certainly not an Iranian connection: Alemira billed 144 TikTok advertisements to those names between 24 February and 21 October 2026, most of them on other subjects, among them EURO Summer Fest (38), Qatar is Responsible (nine), Grand Theft Qatar (seven) and the flight advertisements described in Section 4.1.

The 2026 material calls openly for the Iranian government’s removal. “EVERY ACTION BRINGS LIBERATION / IRANIANS’ FUTURE IS NOW” accompanies images of a man tearing a Khamenei portrait from a wall, a stone bust of Khamenei breaking under a wooden beam, and a fist snapping chains. Another advertisement shows Azadi Tower beneath the Lion and Sun, the emblem on the pre-1979 flag used today by monarchist opposition groups. Its caption reads “THE LION ROARS / THE SUN SETS ON THE ISLAMIC REPUBLIC REGIME”. Elsewhere, a toppled Khamenei head lies in rubble beneath the words “TERROR’S GRIP IS BROKEN / The Iranian people will be free”. The imagery repeatedly depicts the collapse of the government, in advertisements served to European audiences.

Two advertisements make a more direct appeal over policy towards Iran. “NO SEAT FOR TYRANTS / NO DEAL WITH OPPRESSORS / #STANDWITHIRANIANS” places portraits of Iranian leaders on empty chairs at a negotiating table. “LET IRANIANS CHOOSE / Democracy ends the war” shows a ballot entering a box, presenting a change of government as the route to peace. Their messages and targeting suggest an attempt to turn European public opinion against negotiations with Tehran and towards support for regime change. This extends the operation’s objectives beyond its attacks on Iranian influence in Lebanon and its wider campaign against Qatar.

4.5 Potential links to Make Lebanon Great Again

Make Lebanon Great Again (MLGA), a campaign circulating AI-generated videos of Lebanese officials in 2025, likely represents a continuation of the operation’s earlier Lebanon strand based on similar TTPs. ARIJ documented 28 videos with 8.1 million views and approximately 30 accounts amplifying its content. It also reported continuity with “No to the Iranian Occupation,” whose channels were removed around the time MLGA appeared. Our investigation and Meta’s had already identified that earlier brand’s X account as part of the LT Media/Moore/Phase 1 network in its August 2024 takedown report. That account was suspended on X and re-registered in September 2024: an account using a nearly identical handle appeared with the same name, octopus-in-a-turban logo and header (Section 4.3). ARIJ’s findings provide an indirect connection between MLGA and an established asset.^{27 28 29}

The advertising records offer further similarities. Misbar traced 23 MLGA YouTube advertisements, running between May and July 2025, to a Google advertiser account verified in Belgium under the name Victor Wilde. Later^{30 31} viewer screenshots recorded additional Belgium-verified advertiser names promoting similar material. This resembles^{32 33} the use of Belgian advertising accounts elsewhere in this report under the name Liliane Kaufman, which was used for Qatar-related, Europe-facing material.

More specifically, an MLGA Facebook page ran a Lebanon-targeted advertisement between 30 November and 1 December 2025, billed at ₫500,000–600,000 in Vietnamese dong.³⁴ Meta removed it for violating its rules on social issues, elections and politics, and the page was subsequently disabled. Its billing currency, short advertising run and predominantly male Lebanese audience resemble the earlier network’s activity. Dong billing is a useful point of comparison, but it does not establish that LT Media supplied this account.

MLGA also continued the use of synthetic imagery to ridicule political figures, extending it to fabricated speech and video; one video was publicly denounced as fabricated by the Lebanese prime minister’s office.³⁵ Even the use of the logo in the corner of the creatives resembles the phase 1 campaign. Taken together, the reported brand continuity and advertising similarities warrant further investigation. However, no shared payer, administrator or domain has been identified between MLGA and the report’s three clusters. It is therefore treated as a potential continuation, with its exposure and spending figures excluded from the operation’s totals.

Measured on the report’s tiers (section 14.6), MLGA stands at 8.1 million recorded exposures without X and 57.1 million with it; YouTube views count as exposures because the channel had subscribers in the hundreds against views in the millions, and the X figure is ARIJ’s and is not priced.³⁶ The YouTube views price at $49,700 at $6.09 or $33,500 at $4.11, and Misbar’s estimate for one 800,000-view ad sits inside that range.³⁷ Projected, because the videos were deleted and ARIJ’s total is a monitoring-window minimum, YouTube exposure would be about 18 million if Misbar’s 23 paid ads averaged the views of the one it priced: 8 to 18 million without X and 57 to 67 million with it. None of that is in the operation’s totals in section 9.

4.6 Potential links to Al Ghaliboun

There is also another potentially linked Arabic account. Al Ghaliboun (آل غالبون), the channel that opened on 30 June 2026 after MLGA’s removal, shares the operation’s later methods. Six episodes of 17 to 64 seconds, animated as a Simpsons pastiche and voiced in clumsy Levantine Arabic apart from the most recent episode (which is in English) follow one Shia family in a bombed town and end on the same title card and the same punchline; hands, signage and background figures carry the artefacts of generative video, as the phase-3 material does. Views run to 28.4 million on 1,480 subscribers and 693 likes, the bought-reach signature of section 5.2. The six Meta ads found for it ran Lebanon-only from three pages. Two of the ads were removed by Meta within an hour and the July page was since disabled, which is the pattern of the phase-1 Lebanon pages and the MLGA page above. The billing is in US dollars rather than dong, and no advertiser, payer or page administrator in its records appears anywhere in Appendix D. The resemblance is one of method, a tradecraft link on the definition in Section 14.1, and on its own it does not meet the inclusion test there.

Reach

The channel's six episodes had 28,397,421 views, 693 likes and 160 comments on 13 September 2026, on 1,480 subscribers: 24 likes per million views.³⁹ The channel was still live on 25 September 2026. Across the operation's 15 YouTube channels the 189 archived videos average about 700,000 views; Al Ghaliboun averages 4.7 million, and its largest episode, at 10.3 million, is exceeded by one video in the ad archive, a Qatar's Behind This upload at 16.2 million. The newest episode had 1.0 million views three days after upload, so the total is a snapshot of a channel still being bought.⁴⁰

On Meta, three of the six ads carry figures. The ad of 2 to 8 July 2026 delivered more than one million impressions for $2,000 to $2,500, the one seeding buy of the campaign; the one-hour ads of 6 July and 6 August delivered 10,000 to 15,000 and 4,000 to 5,000 impressions for under $100 each before Meta removed them. Delivery was Lebanon only, in the same governorate proportions as the MLGA page and the 2024 pages: Mount Lebanon 34 to 37 per cent, North 21 to 23, Beirut 13 to 19, Beqaa 12 to 13, South 5 to 10, Nabatieh 1 to 3. Impressions went 61 to 69 per cent to men, and the two youngest age brackets took about half. Meta estimated the audience of each ad at more than one million accounts. The three ads launched on 12 September 2026 from the third page were live without figures when captured.⁴¹

4.7 Billboards

The phrase ‘Thanks Iran’ runs through the phase-3 Lebanon material, where it is used ironically (Section 4.4), and the slogan also ran, unironically, as a billboard campaign in Lebanon. The provenance of the “شكراً إيران” (“Thanks Iran”) billboard campaign remains unclear. The message itself was consistent with Hezbollah’s public position at the time. Hezbollah’s political, ideological and material relationship with Iran is longstanding, and in June 2026 the organization was itself publicly expressing gratitude to Tehran. On 9 June, Hezbollah thanked Iran following its attack on Israel, and on 15 June it expressed “profound gratitude” for Iran’s insistence that Lebanon be included in ceasefire arrangements.⁴² Photographs from the same period show “Thanks Iran” billboards carrying images of Iranian leaders on the Rafic Hariri International Airport road.⁴³ In other words, the slogan closely reflected authentic Hezbollah messaging and was not obviously anomalous or implausible.

What is less clear is who actually commissioned the advertisements. Contemporary Lebanese reporting routinely associated the billboards with Hezbollah and its political milieu, but this does not establish that Hezbollah paid for or organized them. The displays were part of a commercially contracted advertising campaign, yet neither the purchaser nor, in the reporting reviewed here, the contracting entity was publicly identified. None of the reporting reviewed here identifies who rented the billboards. The available evidence supports describing the campaign as pro-Iran and consistent with Hezbollah messaging, but not yet as a campaign demonstrably commissioned by Hezbollah.

Anonymous or opaque political billboard campaigns are not unprecedented in Lebanon. In November 2023, a large “Lebanon Does Not Want War” campaign appeared on billboards and social media. One of its organizers said financing came from unnamed young Lebanese and businessmen rather than a clearly identified institutional sponsor.⁴⁴ Another anti-war billboard campaign appeared in August 2024 carrying slogans such as “Enough—we’re tired” and “We don’t want war.” Lebanese reporting described this campaign as effectively “fatherless”: political parties, NGOs and civil-society organizations did not publicly claim responsibility for it, despite its evident political message opposing Hezbollah’s involvement in the conflict.⁴⁵ The absence of a named purchaser behind the 2026 “Thanks Iran” advertisements therefore does not, by itself, indicate deception.

The timing nevertheless warrants attention. “Thanks Iran” billboards were visible in June, with the airport-road displays reported around 21 June.⁴⁶ Within days, the same rhetorical device was being inverted by Hezbollah’s opponents. On 25 June, MTV mocked the slogan with formulations including “Thanks to the victimised South” and “Thanks to the villages that were destroyed.”⁴⁷ On 27 June, the “Thanks Iran” advertisements were removed and replaced by “Lebanon First” and similar messaging.⁴⁸

The subsequent influence operation examined in this report pushed the inversion further, using formulations such as “شكراً على تدمير الجنوب” (“Thanks for destroying the South”). The linguistic continuity is striking: rather than introducing an entirely new narrative, the later campaign appears to have appropriated an existing pro-Iran slogan and weaponized the word “thanks” against Iran and Hezbollah.

There are consequently several possible explanations for the original billboards. They may have been commissioned by Hezbollah or an affiliated organization; they may have been independently purchased by a wealthy supporter, association, municipality-linked actor or other genuinely pro-Iran entity; or, more speculatively, they could have been placed by an adversarial actor as a provocation. Under the latter scenario, an anti-Hezbollah actor could have deployed an exaggerated but entirely plausible pro-Iran message in order to generate controversy and provide material for a subsequent counter-campaign. Such tactics would amount to creating the stimulus and then amplifying the backlash to it. There is currently no evidence sufficient to establish that third explanation, however. Their significance to this investigation lies less in proving common sponsorship than in establishing the immediate narrative environment from which the subsequent mocking campaign emerged.

5. The cross-platform structure

Digital advertising was the largest part of the operation,and the 2024 investigation found it running at the same time on Facebook, Twitter/X, Telegram, TikTok and web display advertising. However, Wikipedia was edited to SEO-boost the reference sources beneath the story, and Change.org used to give the appearance of public demand.

5.1 Facebook

Facebook is the one platform the operation used in all three phases. Of its 72 campaigns, 62 ran Facebook pages: 26 of the 28 in phase one, all 23 in phase two and 13 of the 21 in phase three, when YouTube and TikTok carried most of the audience. The ad archive holds 1,018 Facebook advertisements for phase one, 97 for phase two and 358 for phase three, with 40.7 million, 4.5 million and 49.5 million archived reach (Section 3). Meta’s takedown report for phase one also counted 49 Instagram accounts alongside the 65 pages.

When the July 2024 investigation closed, the Facebook arm comprised 978 advertisements across 25 campaign pages, supported by roughly 44 "burner" pages whose only function was to sponsor ads for the others. Minimum recorded reach from the Ad Library was 41,074,052 (excluding ad clarity numbers). These are mid-2024 numbers; the ad archive has since grown to 1,473 Facebook advertisements. They are given here because they show what was already visible, and unaddressed, two years ago.

5.2 Twitter/X

The operation ran at least 13 branded X accounts: @TheQatarPlot, @Qatarsis24, @ShameOnQatar24, @MadeInQatar_EN, @DontfundQatar, @NeFinancezQatar, @Defense_laicite, @ItsIn_YourHands and @DirtDoha69163, the last tied to the dohadirt.com site, for the phase-one campaigns, and @TenzkrWmaTen3ad, @KowtnabeWe7dtna, @Shi3aDodelharb and the No to the Iranian Occupation account for the Lebanese strand; the last was suspended and re-registered in September 2024 under a near-identical handle (Section 4.3). The paid promotion came from a separate set of Premium accounts, some created for the purpose with apparently AI-generated profile pictures, others older accounts that had been scrubbed, renamed and reused. Promoted posts are unlisted and there is no account-linked ad transparency, so these could only be found by searching for replies that happened to mention the handle. The operation's own accounts also amplified established and emergent anti-Muslim accounts, including @EuropeInvasionn and the @RadioGenoa cluster, which provided much of the xenophobic video the campaign recaptioned as evidence against Qatar. After Meta’s enforcement many of the creatives were posted on X and Telegram instead, and for a time the operator dropped individual page identities and posted wherever it still had accounts.

The investigation has collected 118 posts from two of the branded accounts, @Qatarsis24 and @TheQatarPlot, which was later renamed @IslamistWeb. They run from 9 May 2024 to 5 February 2025 and record 2,272,677 views between them, with 18 posts showing no view count. All but one are IslamistWeb’s: its 117 posts drew 72,677 views in all, while the single Qatarsis post, on the Qatari entry to Eurovision, drew 2.2 million on its own, so the total is one post that reached an audience and an account that reached relatively few.

X activity resumed in phase three. Five posts carrying Stop Qatar material appeared between 10 and 26 October 2025 on five other accounts, @Chickwbadl, @Bbohutg, @lolaearmstrong1, @thys_moordk and @Barbara3351hcl, and recorded 299,400 views between them, 100,000 on the largest; one shows no count. X publishes nothing that would show whether they were promoted. The Make Lebanon Great Again strand used X on a larger scale: ARIJ counted 1,010 posts with 49 million views between May 2025 and May 2026 (Section 4.5). Neither set is counted in the 2,126.

5.3 Wikipedia

In January and February 2024, a network of at least 24 Wikipedia accounts and 11 exposed IP addresses ran an operation against Qatar on English Wikipedia, during the fourth month of the Gaza war and while Qatar was mediating over hostages. The operation overlapped directly with the advertising campaign. Accounts inserted the campaign domain, shameqatar.com, into citation tags on high-traffic articles, uploaded the Shame on Qatar logo into Al Thani biographies, used “shame Qatar” as an edit summary, and added links from the same constellation of Qatari-owned assets, including Paris Saint-Germain and Harrods, targeted by the boycott advertising. The edits were made using deliberate and coordinated vandalism countermeasure evasion tactics, such as sneaking operation content into an edit made prior to a non-operation edit-and-revert, or into a revert of an earlier edit by a collaborator.

The operation had two complementary arms. One inserted hostile material into articles concerning alleged Qatari terrorism financing, the ruling family, Qatar-Iran relations and Qatari funding of American universities. The other created a new article, Qatari soft power, and seeded links to it from dozens of pages concerning Qatari holdings and sponsorships. Together these created a network of pathways through Wikipedia that directed readers from prominent Qatari-linked assets towards material framing Qatar's investments as instruments of political influence. (see section 7.3 for more information on attribution)

5.4 Change.org

A petition matching the campaign's messaging was posted under the name "John Anderson" of "Citizens for Human Lives", an organisation for which no evidence of existence was found before or outside this operation. It gathered over 7,500 signatures, was promoted by minor celebrities and organisations, and was promoted via paid META advertising. It was also cited in news coverage. No contact details or website were ever given. A dated letter from the same body, over the same signature, appeared on the campaign's Facebook page.

During our initial investigation, when we approached Change.org, they suspended the petition - presumably because they could not verify the authenticity of the petition’s creator.

5.5 Telegram and TikTok

Telegram channels created in the second wave gave the operation a host with no advertising rules or robust content moderation policies. These were ‘Made in Qatar’ and ‘Doha Dirt’. One channel began by mirroring a video series already used on Facebook and Twitter, then produced its own: short clips blaming Qatar for individual incidents of alleged criminality by people it identified as Muslim or immigrant, each closing on the card "Everything that happens in Europe does not happen by chance. Qatar is behind the rapid Islamization of Europe", followed by "You just have to CONNECT THE DOTS"

Made in Qatar alone contained around 80 video files. The editing files of 18 of the channel’s videos name the clips they were cut from. Each clip has the filename twittervid.com gives a video downloaded from an X post, which records the posting account. Twelve come from the anti-Muslim account @RadioGenoa, and the captions burned into the operation’s versions repeat or closely reword RadioGenoa’s own text. The caption on an assault in Spain repeats RadioGenoa’s post of 1 January 2024 word for word, dropping only the closing “Intolerable”; a Milan clip RadioGenoa posted the same day as “Dramatic testimony of an Italian girl chased in Milan by two Arab immigrants” is recaptioned in her voice. The operation added its “Made in Qatar” stamp and the closing card blaming Qatar for the Islamization of Europe. All twelve were rendered on 23 May 2024, the day after the channel was created. The other six videos use clips from @EuropeInvasionn, Tommy Robinson’s @TRobinsonNewEra, Éric Zemmour’s @ZemmourEric, the LCI programme account @24hPujadas and ABC News.⁴⁹

On TikTok, the phase-one presence was one documented item, a Eurovision parody video attacking Qatar that drew 1.2 million views, 15,200 likes and 934 bookmarks, and not a single comment, which is hard to square with organic virality. On X, it was only really shared by right-wing, pro Israel accounts like Visegrad24 and TheMossadIL. Visegrad24 is also an account that the campaign relies on for source material.

In Phase 3 TikTok ads ran across three channels, Grand Theft Qatar, Euro Summer Fest, and Qatar is Responsible, accumulating 43.8 million of recorded reach. Interestingly, the videos run as ads were predominantly run only as ads, and not as videos on the main channels. In other words, the videos were highly visible in the ad space, but not on the channels.

6. Infrastructure

The branded campaigns ran on a laundered commercial supply chain.

6.1 A commercial proxy operator

The phase-one investigation traced the Facebook advertising infrastructure to the Vietnamese digital-asset trade, and specifically to a proxy operating as "Lê Văn Tính", alias "Le Tinh Lee", trading as "LT Media". The operator advertised openly on YouTube and on a Facebook business page, describing moderation-evasion techniques, displaying stock of pre-verified accounts and showing collections of forged identity documents. On one occasion the operator's own business page sponsored an advertisement for one of the campaigns. Eventually by documenting all connections related to beneficiary and payer across the campaign they all connected to a single network connected to LT Media.

Two further signals support the Vietnamese connection: nearly all visible advertising spend was billed in Vietnamese dong, and where Page Transparency disclosed administrator locations, they were in or included Vietnam.

A proxy service sells to whoever pays, so identifying the operator says nothing about the client - unless they are lying. Section 14.7 sets out the distinction. When contacted by AFP, Le Tinh Lee as part of our original investigation, he claimed someone had approached him anonymously on Telegram to purchase services. ⁵¹

6.2 Stolen and boilerplate pages

On two campaigns Meta's own beneficiary field names the proxy as payer: "LT Media - FB Advertising Agency" against Don't fund Qatar, and "LeTinhLee", the proxy's own handle, against Défendons la laïcité. Elsewhere, the front was usually a stolen or fabricated page. Advertising was sponsored not by the campaign pages, but by a pool of other pages. Some were fabricated, sets of near-identical skeletal pages sharing one template, one stock image, and even the same nonsense names. Others were taken from real people and businesses. Sponsor pages were also warmed up first, running a few cheap, apolitical advertisements at the Philippines to pass moderation before switching to political advertising aimed at Europe.

Counting sponsor pages attributable to the proxy on any of four grounds (Meta naming it outright, a Vietnamese personal or business name, a page identified as stolen, or membership of the boilerplate sets) gives 34 sponsor pages paying for 235 advertisements across 9 of the 26 phase-one campaigns: Dirty Game, Don't fund Qatar, Défendons la laïcité, Europe First, Le Projet, Le Projet (2), Le vestiaire du PSG, The Plot Against Europe and The Qatar Plot. These cover the French secularism material, the anti-Qatar boycott material and the European-threat material alike.

6.3 Front organisations

At least three organisations were invented to give the messaging an author and make it appear more credible. "Citizens for Human Lives" sponsored the Change.org petition and signed an open letter, with no address, website or prior existence. "European Extremism Monitoring Project" was cited as the authority for a video blaming Qatar for radicalisation in a Paris neighbourhood; its URL redirected to a defunct site for an unrelated body. "One Peace Global", the campaign that opened the operation in Lebanon, ran a website whose staff page was unmodified boilerplate and whose only contact was a Swedish telephone number.

6.4 The website estate

Nine websites supported the campaigns: shameqatar.com, itsinyourhands24.com, plotvseurope.com, dohadirt.com, eurovision2024.net, 1701now.com, onepeaceglobal.com, shi3adodelharb.com and kowatnabewe7detna.com. Eight no longer exist; their registrations were no longer in the registry when checked on 2 September 2026, so no ownership record survives. The exception, kowatnabewe7detna.com, was registered in April 2024 and is paid through to April 2027.

Six of the nine ran WordPress with Elementor on hello-elementor, the blank starter theme used when a site is assembled from scratch. Their Elementor versions run through consecutive releases between February and June 2024: 3.19.0, 3.19.2, 3.20.1, 3.20.4, 3.21.5 and 3.21.8. Three shared the identical WordPress 6.4.3 build. A seventh, eurovision2024.net, used the same stack on a stock theme. The set spans English and Arabic and both the European and Lebanese strands, which are otherwise separate in creative and targeting.

The other two, onepeaceglobal.com and 1701now.com, were built with Zyro, Hostinger's own website builder. kowatnabewe7detna.com is registered through Hostinger and uses Hostinger nameservers. The hosting itself is recorded in the sites’ own server responses: every archived capture of all nine, from November 2023 to December 2024, carries the header “platform: hostinger”, with Hostinger’s LiteSpeed servers and, on later captures, its hPanel control panel. All nine domains sat with one hosting provider, across two of its products. Their certificates are consistent with that but are not evidence of it: five took a Let's Encrypt and a Google Trust Services certificate on their first day, and eurovision2024.net only ever had ZeroSSL ones.

Four of the WordPress installations were set up under an account named after the site's own domain, identifying no one. The other two use personal accounts, held in the investigation's working files. Neither of those sites was ever tidied; both still carried WordPress's default first post and placeholder comment when archived.

One Peace Global's staff page claimed "the generous backing of the European Union, contributions from philanthropic families, and donations from peace-promoting NGOs" while naming no staff at all, listing instead categories of expertise in diplomacy, homeland security, conflict resolution and humanitarian aid coordination. The page even backdated its activity on Facebook to appear older than it was.

Two associated social accounts are gone. The Facebook page for 1701 Now returns as unavailable, and X suspended the account of the same name for breaking its rules. The rest of the network's assets were abandoned rather than removed.

7. Attribution and offline events

Almost every element of this operation ends in an untraceable entity: a proxy, a company registered elsewhere, an organisation with no prior existence or paper trail. Two strands are exceptions.

7.1 Offline activity

The physical activity ran alongside the digital. In Lebanon, it came first: the billboards there in October 2023 preceded the paid social campaign. Times Square billboards, a presence at CPAC, staged protests including models demonstrating in a shopping mall, and approaches to public figures all belong to the same operation as the ads.

The Paris photograph was traced to a 7 February tribute to the victims and hostages of the October 7 attacks, held at the Hôtel des Invalides; the campaign posted it the following day. Attendance at a real event is not evidence that the event was staged, and this report does not suggest the organisers of these gatherings had any connection to the operation.

7.2 Other events

Other examples of “in real life” appearances of the operation include at the International Religious Freedom (IRF) Summit in 2024, and at demonstrations in DC and Paris. At IRF, Lantos Foundation president Katrina Lantos Swett tweeted an image of herself holding up a poster of the “You Have The Power” campaign poster, and called on Sheikha Moza to release the hostages. It is not clear who gave Swett the posters, but Swett’s tweet QTs a tweet thread by Congress of Christian Leaders president, Combat Antisemitism Movement advisory board member, and All Arab News advisory board member Johnnie Moore. An ostensibly unrelated Kathie Lee Gifford video with similar plea directed at Sheikha Moza, originally posted on Twitter, was then used by the “It’s In Your Hands” campaign and distributed on their YouTube channel. This video is embedded in the aforementioned thread by Moore, followed by the petition link.

Asked by AFP about the poster she was photographed holding, a spokeswoman for Katrina Lantos Swett said she had been asked to promote it by Johnnie Moore⁵². It is the only documented instance of campaign material passing through a named individual rather than an anonymous account.

Moore was approached. He initially accepted an interview request from AFP, then stopped responding when he was put on the account of the poster and asked about his apparent association with the campaign. That exchange is the closest the evidence comes to an answer from anyone connected to the material.⁵³

This establishes that campaign material and campaign publicity passed through a named US public-relations firm and its principal, on at least two occasions, while the campaign itself was concealing its sponsorship behind fictitious organisations. There is no evidence of JDA Worldwide having registered with FARA for this campaign.

The connection is not isolated. Two former US pageant winners Hannah Roberts (Miss Mississippi 2015) and Justice Enlow (Miss Tennessee 2020) staged a protest outside Valentino and Balmain stores in a mall in Atlanta, targeting the brands’ Qatari ownership. The event was covered in All Arab News⁵⁴, at which Moore is on the Advisory Board⁵⁵, and which is a sister publication of All Israel News⁵⁶, where Moore is a writer⁵⁷; oddly, the article was published in March 2024⁵⁸, with a corresponding "March 11, 2024" publication date, and matching “…uploads/2024/03/…” file upload folder structures in the page source, but was backdated to December 2023 by the 2nd of May⁵⁹. Wearing makeup to simulate bruises, the two women represented female hostages held in Gaza and were tied and led on a rope by an actress portraying Sheikha Moza. The performance cast Sheikha Moza as personally responsible for the hostages’ fate, reinforcing the campaign’s claim that Qatar could secure their release if it chose to. Moore’s public-relations firm, JDA Worldwide, issued the press release publicising the event⁶⁰. Two separate offline events, on two occasions, run through the same named individual and his firm.

The NYPost and Jerusalem Post are at least two outlets that covered the Times Square ad. The authenticity of the Times Square ad was confirmed by the existence of user generated content, and the owner of the billboard refused to disclose who the paying client was. The Jerusalem Post included a ‘cheapfake’ video of Sheikha Moza published on the “It’s In Your Hands” YouTube channel, in which Moza’s words are altered to make it sound like going back on a previous (and non-existent) declaration of support for Hamas. The Jerusalem Post does not qualify that the video is a fake. The cheapfake video was also run as an ad on Twitter for high reach there.

7.3 Technical signals

The second path is technical, and is predominantly the result of Telegram and Wikipedia. Data.

Telegram

The second path also runs through the operation’s own files from the phase 1 channel madeinqatar24.⁶¹ Usually most social media platforms strip metadata from files when uploaded, but this is preserved on Telegram if items are sent as a file. The Telegram channel published the video files themselves, and 78 of them were recovered with their Adobe XMP edit history intact. 77 share one encoded signature, the MainConcept MP4 export written by Adobe Media Encoder and After Effects. On its own that shows only that they were exported from Adobe tools, which any number of unrelated editors would share; it corroborates a single toolchain rather than establishing one.

The shared project paths are instructive. 70 name After Effects on macOS and six name After Effects 2025 on Windows. The renders run from 21 April to 27 October 2024, and the channel posted from 22 May to 17 November 2024. They also reveal portable storage and computer names and filepaths. The account names are macOS short usernames, which are set once when an account is created and normally never published anywhere; searched against 14 platforms they return empty profiles and collisions with unrelated private individuals, so they are recorded here as evidence of distinct production seats,

The strongest observation in that metadata is a working calendar. Across 107 extracted XMP packets there are 4,030 dated edit events, and 3,626 of them record UTC+03:00. Every operator render falls inside a Sunday to Thursday week and a local working day, the earliest at 08:00 and the latest at 17:43. Friday is empty. The one Saturday render is the single file in the corpus that was recycled rather than produced, an iOS-captured clip carrying no Adobe history at all. That working week excludes the countries at that offset which take Saturday and Sunday, leaving Israel and the Gulf states, and the content excludes Qatar and its Gulf partners. A second test uses the clock change. The Windows seat stamped +03:00 on 15 and 22 October 2024 and +02:00 on all four of its renders on 27 October, so that machine’s clock moved back between those dates. The fixed-offset zones at +03:00 do not change, which excludes Moscow, Turkey, the Gulf and East Africa. Israel, Lebanon, the Palestinian territories and the European countries on UTC+2 all moved their clocks back that weekend, and Egypt on 31 October; of these, only Israel and the Palestinian territories also work a Sunday-to-Thursday week.

The embedded paths describe a managed production. 30, operator-side paths are recoverable. A shared project tree named Q-April24 holds numbered campaign strands, among them one for The Plot Against Europe and one for Save Europe, and three of its folders appear under more than one storage root, which is what copying between drives or handing work between editors could produce. Two macOS accounts render their own project files and a third account renders on Windows. The Windows account produced five of the eleven videos attacking Al Jazeera, using a project whose version numbering reaches 19. The final four renders were exported within 50 seconds on 27 October 2024.

The labels on that storage are Hebrew. One is a volume labelled ShukidToGo. Shuki is the standard Israeli diminutive of Yehoshua. NachashOti is built on nachash, Hebrew for snake - but also Nachash Oti was a popular viral meme in Israel.⁶³ The name chezyim, which maps to Chezi, a diminutive of Yehezkel, occurs only in the history of one imported image, not as an editing account. A working folder inside the main editing account is named nati 5.8.2024, Nati being a diminutive of Netanel and the date written day first. The Windows seat keeps its projects under a folder named SHAHAR, a Hebrew given name. An After Effects composition is named טקסט לפיצוץ, "text for explosion". Five of these, two volume labels, two folder names and a composition, are chosen by whoever sets up the drive, creates the folder or builds the composition rather than shipped with purchased software. A composition named Küçük_şeytan, Turkish for "little Satan", is immaterial to attribution. It takes its name from an image file of the same name, saved under its original title like the other web material in the same project, a Getty image, an Iranian flag wallpaper and archive news footage, and it appears in nine videos because that segment was reused. The stock vector that gives the channel its name, VectorStock item 16189318, appears in 23 videos, and the news photographs in the material retain intact IPTC credits to Anadolu, AFP, Reuters, Le Monde via Hans Lucas and Bob Daemmrich.

The working calendar, timezone changes and Hebrew-language traces together support the assessment of Israel-based production.⁶⁴ The other account names, poulkat, jhonmax and Sam, do not necessarily read as Hebrew, which does not exclude Hebrew-speaking users. The file metadata points to production in Israel, which is consistent with the Israeli fixed-line address in the Wikipedia editing session of 30 January 2024 (see next section). It says nothing about who commissioned or paid for it, and a contracted commercial studio and a state-directed cell would leave the same traces.

A volume labelled ShukidToGo contained the campaign's own project tree, Q-April24, including Premiere projects for the chapters of The Plot Against Europe documentary series and for the Save Europe strand. The ‘Shukid’ element matches the professional name used by Shuki Duchovni (Shuki.D), an Israeli graphic designer who has worked as Shukid, and held the domain shukid.com, since 2003. The investigation has not established that Duchovni owned or used this volume, or contributed to the operation. Baobab Group, a campaign consultancy registered in Prague, listed Duchovni on its website from 2016 until at least 2023 as leading its creative and graphic design unit. Baobab was founded, by its own account in 2012, by Barbora Fialová, its sole director from its registration in 2016 until 2021 and since 2013 a board member of Prism Group SE.⁶⁵ Shuki.d’s published portfolio shows his election films for candidates and parties in Israel and in more than a dozen other countries, among them Malawi, Zimbabwe, the Democratic Republic of Congo, Ukraine, Armenia and the Czech Republic. The files on his own websites were made in Adobe applications on macOS, the toolchain of the corpus, with timestamps at UTC+2 and UTC+3. The most recent, from September 2024, used the same Photoshop build that appears in the campaign's later renders. A designer of political video, working in the same software and the same time zone under a professional name that matches part of the volume label, is a lead the investigation has not resolved.

On 11 March 2023 the Israeli political strategist Lior Chorev posted one of Duchovni's artworks, a black-and-white portrait captioned “שתיקת הכבשים (שוקי דוכובני)” (“The Silence of the Lambs (Shuki Duchovni)”), crediting him by name.⁶⁶ Lior Chorev is co-founder, chairman and chief strategy officer of Percepto International, which he founded with Royi Burstien, who had previously established and managed Psy Group.⁶⁷ Lior Chorev was among the group of people mentioned amongst those initially recruited for the supposedly aborted anti-Qatar campaign.⁶⁸ Chorev and Duchovni worked on the same campaign: Chorev ran Kulanu's campaign for the April 2019 Knesset election, and Duchovni's showreel includes that campaign's “A leader who chooses you” spot, with Moshe Kahlon in front of a portrait of Menachem Begin.⁶⁹

Baobab built the website of Adi Timor, an Israeli campaign consultant whose international work includes Africa: the archived timorgroup.com of August 2018 carries “Created by Baobab Group” in its footer, at a time when Duchovni led Baobab's design unit.⁷⁰ Timor and Duchovni both worked on Gideon Sa'ar's March 2021 Knesset campaign, Timor according to the Times of Israel and Duchovni according to a job folder named for Sa'ar in the embedded file paths of his own portfolio images.⁷¹ His showreel includes campaign material for Lazarus Chakwera in Malawi and for campaigns in Mozambique, Eswatini and Angola.⁷²

None of these people appears in the corpus, and work on the same national campaign does not make two vendors partners: a Times of Israel report has Timor and Tal Silberstein, Sa'ar's strategist, on opposite sides of Albania's election.

The label appears in the imported-project history of four videos. These paths record project material brought into the delivered renders; they do not establish where the final videos were edited. Ten classes of identifier were compared between the 107 metadata packets in the corpus and 1,123 files in the research collection, including Duchovni's, Baobab's and Timor's published material. The classes included document identifiers, camera serial numbers, embedded fonts and asset paths, and no distinctive identifier match was found: the one shared value is Adobe Illustrator's default Print startup profile, which many unrelated files carry. None of the corpus's account, drive or project names (jhonmax, poulkat, NachashOti, Q-April24 and the others) occurs in his files. His name, domains and company appear nowhere else in the corpus. Duchovni is recorded here as a lead for further inquiry.

Wikipedia

In January and February 2024, a network of at least 24 Wikipedia accounts and 11 exposed IP addresses ran a short-burst operation against Qatar on English Wikipedia, during the fourth month of the Gaza war and while Qatar was mediating over hostages. The operation overlapped directly with the advertising campaign. Accounts inserted the campaign domain, shameqatar.com, into citation tags on high-traffic articles, uploaded the Shame on Qatar logo into Al Thani biographies, used “shame Qatar” as an edit summary, and added links from the same constellation of Qatari-owned assets, including Paris Saint-Germain and Harrods, targeted by the boycott advertising.

The network was subsequently investigated through Wikipedia's Sockpuppet Investigations process, including CheckUser analysis of non-public connection data, which technically linked several clusters of accounts; additional identities were connected through overlapping technical and behavioural evidence. CheckUser establishes shared technical connection characteristics, rather than proving that every account was controlled by the same individual. ⁷³

The sock puppet operation (called Tron Network) was coordinated and resourced. Identities handed work to one another at intervals as short as six seconds, two-thirds were active for less than two hours in total, and the network used commercial residential-proxy access alongside aged accounts taken over from uninvolved people. Four of the accounts belonged to victims of account compromise or takeover and should not be described as participants in the operation.

The infrastructure also produced a potentially significant lead to Israel. During a concentrated editing session on 30 January 2024, a single Israeli fixed-line IP address on a static organisational block made three campaign edits while alternating with a campaign account and German residential-proxy exits from the Israeli company Nimbleway. At points the transitions occurred within seconds or minutes. The most economical explanation is that a proxy failed or was bypassed, exposing the workstation's underlying connection. If so, an operator was physically in Israel on 30 January 2024. That the address is Israeli matters less than where it falls in the editing sequence: it was a fixed-line address rather than an identified proxy exit, sat on a static organisational block rather than a dynamic consumer pool, and repeatedly interleaved with the campaign during a session otherwise routed through German proxies.

This remains an inference from one session on one date, but it does not identify the client. A second Israel connection is considerably weaker. The residential-proxy infrastructure used by the operation was attributed to Nimbleway, a Tel Aviv-headquartered commercial proxy provider. But residential proxies are sold internationally, and the nationality of the vendor says little about the nationality of its customers.

The evidence is therefore compatible with a single commissioning entity procuring different commercial capabilities from suppliers in different jurisdictions: one infrastructure for paid distribution, and another for Wikipedia manipulation. Whether the same contractor operated both arms is not established, and the available evidence does not identify the commissioning entity.

As with Meta's enforcement against the advertising campaign, Wikipedia disrupted the infrastructure more successfully than the content it produced. Editors reverted 57 per cent of campaign revisions and 76 per cent of campaign-adjacent revisions, and the identity cluster was eventually blocked. Yet the flagship Qatari soft power article survived its deletion discussion on a no-consensus close and remains on Wikipedia, since the encyclopedia's assessment of whether an article is sufficiently notable is separate from the circumstances in which it was created.

7.4 Narrative Analysis

The third path is comparative: who has run campaigns of this kind before. Three bodies of evidence are relevant to contextualising who might want to demonise Qatar, Muslims, and Iran and its proxies - culminating with the most likely.

The first is the Gulf. The 2017 blockade of Qatar by Saudi Arabia, the United Arab Emirates, Bahrain and Egypt was accompanied by paid influence on both sides of the Atlantic. In Washington, George Nader, an adviser to the UAE, wired $2.5 million through a Canadian company to the Republican fundraiser Elliott Broidy in April 2017 to fund advocacy against Qatar; a month later Broidy sponsored a conference at the Foundation for Defense of Democracies on Qatar’s alleged ties to extremism, at which the chairman of the House Foreign Affairs Committee announced a sanctions bill, and neither Nader nor Broidy registered under the Foreign Agents Registration Act.⁷⁴ On the platforms, Stanford Internet Observatory researchers found that of fifteen takedowns originating in Egypt, Saudi Arabia or the UAE, at least ten portrayed Qatar, Turkey or Iran as sponsors of terrorism.⁷⁵ Facebook’s removal in August 2019 of a network it linked to two marketing firms, New Waves in Egypt and Newave in the UAE, whose Pages “alleged support of terrorist groups by Qatar” across the Middle East and Africa on about $167,000 of advertising, is the closest structural precedent for a commercial cut-out running anti-Qatar advertising for an undisclosed client.⁷⁶ The blockade was formally settled at Al-Ula in January 2021.⁷⁷ The terrorism-funding frame, the targeting of Qatari-owned assets abroad and the use of a marketing firm as payer are all present in phase 1 of this operation.⁷⁸ The UAE’s fixation on Islamism and the Muslim Brotherhood also fits with the overall tenor of the campaign, although the Islamophobic nature is perhaps a bit too salient to make the UAE the most likely candidate.

The second is the wider market for Islamophobic and anti-migrant content in the same five countries, where two state-linked producers are documented. Russia’s Doppelgänger operation impersonated Le Parisien, 20 Minutes, Le Figaro and Le Monde to carry at least 58 false articles, alongside French-language sites built to run divisive content on national politics,⁷⁹ and the German Foreign Office identified more than 50,000 inauthentic German-language accounts on X posting 1.8 million times in one month of the winter of 2023–24;⁸⁰ Meta priced Doppelgänger’s advertising at $105,000 per takedown, a figure this operation exceeds eleven times over on Meta’s own numbers simply for phase 1 (section 9.6). But Russian operations have not really emphasised Qatar. With regard to India, EU DisinfoLab’s “Indian Chronicles” report documented an operation by the Srivastava Group running since 2005 that used more than 750 fake outlets in 119 countries and more than ten UN-accredited NGOs to reach the European Parliament and the UN Human Rights Council, the closest precedent for fictitious organisations addressing European institutions;⁸¹ researchers found India-based accounts among those that fanned the 2022 Leicester unrest,⁸² and India-based Hindu nationalist-linked accounts and outlets among the amplifiers of the Islamophobic “grooming gangs” discourse on X in Britain.⁸³ The commercial tracker records 5.9 million phase-1 impressions delivered in India, 4.3 million on Shame on Qatar and 1.6 million on the Arabic-language حرب ٢٠٠٦ تنذكر وما تنعاد, so this operation bought an Indian audience as well as a European one.

The more likely candidate is Israel, based on precedent and the metadata, although collaborations between actors should not be ruled out. On 14 September 2026 Haaretz reported that, in the days after 7 October 2023, one of Israel’s veteran strategic advisers opened a WhatsApp group of some thirty consultants, influence and psychological-warfare specialists, advertising professionals and government figures to run a global civilian campaign for a boycott of Qatar as Hamas’s funder. Its slogan was “Qatar funds Hamas > Hamas is ISIS > Boycott Qatar 2023”; its position paper, “Hamas’ Blood Money Train”, was drafted by the former head of Mossad’s Harpoon unit; its members proposed shaming Qatari-owned businesses such as the Ritz in London, shaping opinion among lawmakers in the United States and France, and a workaround for FARA; a multilingual website and Facebook, X, Instagram and YouTube accounts were opened. It was halted without explanation a month later, reportedly bought no advertising, and its participants did not know where its funding came from. Researchers from Active Info found two meetings between the initiator, a communications adviser, and the director general of the Diaspora Affairs Ministry in the director general’s calendar, held as the initiative was winding down; Haaretz does not name the director general. The government afterwards centralised its influence activity in a single body.⁸⁴

That ministry was separately reported to have paid the Tel Aviv firm STOIC about $2 million for a covert campaign (Zero Zeno) of fake accounts and news sites aimed at US lawmakers. One of this report’s authors first identified that network in early February 2024, as more than 130 X accounts amplifying Israel’s allegations against UNRWA; Marc Owen Jones (author), Fake Reporter, and DFRLab then traced it to more than 160 accounts across Facebook, Instagram and X boosting a “United Citizens for Canada” persona with claims that Muslim immigrants were imposing Shariah law.⁸⁵ Meta and OpenAI attributed it to STOIC in May 2024, and Meta recorded that its accounts posted calls for the release of the hostages and claims that “radical Islam” threatens liberal values, and had bought their likes and followers from Vietnam.⁸⁶

STOIC’s ‘Zero Zeno’ operation promoted explicitly anti-Muslim, anti-immigrant and anti-Qatar narratives that closely resemble several themes documented in this investigation. Its Canada-focused campaign used hostile messaging and imagery to present Muslims and immigrants as threats. In the United States, it portrayed Qatari investments as a threat to the American way of life, while a separate strand targeted universities, accusing pro-Palestinian protesters of promoting antisemitism and terrorism. The overlap is therefore specific: the demonisation of Muslims and migrants, the portrayal of Qatar’s overseas investments as a means of threatening Western societies, and attacks on pro-Palestinian mobilisation at American universities.

The objectives, the two priority countries and the month of the civilian campaign coincide with the start of this operation, whose first archived placements date from October 2023 and whose first wave targeted France, the United Kingdom and the United States.

8. Evasion methods

Four mechanisms explain how a hate campaign of this size has run for 37 months in open advertising markets without being stopped.

8.1 Disposable identities

At least 64 Facebook page identities were used and discarded, alongside YouTube channels and TikTok advertiser accounts. The largest ran 203 advertisements; below it, the distribution falls away sharply into pages that ran a handful of ads and were abandoned. Many more were used on Facebook and on X to fake engagement (possibly to put a thumb on the scale of algorithm-perceived attention). Many were entered into sponsor/beneficiary disclosure fields (on Facebook Ads) or funder disclosure fields (on Google Ads) with no identity verification or information, and without even hyperlinks (just plain text instead) that could permit traceability to an identifiable real-world entity or a specific digital entity.

8.2 Payment through rotating third-party companies

The operation used appropriated, purchased or hacked Google Ad accounts and Facebook Pages. The companies recorded by Google and Meta as paying for or benefiting from the advertising were registered in Brazil, Belgium and Vietnam, with no disclosed connection to any of the countries targeted, and the recorded payers and beneficiaries changed repeatedly. It is unlikely that those companies were placing the advertising on their own account. The Vietnamese entity, LT Media, said he was working for an anonymous client.

The individuals and companies recorded in registries or in platform payer, advertiser and beneficiary disclosures are Lê Văn Tính (Vietnam) and, in Brazil, Idezita Maria de Oliveira, Patrick de Oliveira Mendes, Larissa Fernanda Pereira Padilha, Cassio Hugo Carvalho Dias, Olimpio Lucas Pereira Silva, Tailine Ferreira Pinheiro, Laiza Cristina Carvalho de Oliveira, Social Media Para Empresa Ltda and Agência de Tráfego Pago Ltda.

Two of those companies, Social Media Para Empresa Ltda and Agência de Tráfego Pago Ltda, are also run by the owner of Agência Moll, an established advertising agency in São Paulo. The Google advertising was distributed across a fragmented set of advertiser identities rather than a single declared buyer. At least ten names appear in the records, including the Brazilian individuals Idezita Maria de Oliveira, Patrick de Oliveira Mendes, Cassio Hugo Carvalho Dias, Larissa Fernanda Pereira Padilha, Olimpio Lucas Pereira Silva, Tailine Ferreira Pinheiro and Laiza Cristina Carvalho de Oliveira, the Belgium-verified advertiser name Liliane Kaufman, and the companies AGENCIA DE TRAFEGO PAGO LTDA and SOCIAL MEDIA PARA EMPRESA LTDA.

Cassio Hugo Carvalho Dias, advertiser record AR00244948590550581249, is recorded against Euro Summer Fest. Three further Brazil-based advertiser records, each declaring itself as its own payer, are listed against the same properties: Olimpio Lucas Pereira Silva against AirAlert and Grand Theft Qatar, Tailine Ferreira Pinheiro against Euro Summer Fest, and Laiza Cristina Carvalho de Oliveira against Qatar is Responsible.⁸⁷ The same Qatar-focused campaign properties recur across these different advertisers, including Euro Summer Fest, Qatar is Responsible, Grand Theft Qatar, Qatar's Behind This and the Arabic-language ما بدنا تكونوا حدنا. Kaufman's advertiser record is associated with a particularly broad set of later properties, including The Godmother, The Silent Invasion, Save Europe Stop Qatar, Doha Did It and Qatari Christmas is Here.

The advertiser names remained the same despite changes to the Google advertiser IDs. In at least one documented case, the company name remained the same while the advertiser ID changed, showing that activity associated with the same named entity was being conducted through a new Google advertiser record. Similar multiplicity appears elsewhere in the dataset: Idezita Maria de Oliveira is associated with AR09191019809150599169 and AR16987357694547460097; AGENCIA DE TRAFEGO PAGO LTDA with AR02691902784634093569 and AR14144183765156495361; and SOCIAL MEDIA PARA EMPRESA LTDA with AR06018648937307570177 and AR07534025412083449857. For researchers, this means that searching Google's archive by advertiser ID alone can make activity appear to stop when the same named advertiser has instead reappeared under a different ID. It also suggests some form of account turnover or restructuring behind the campaign, although the transparency data alone cannot establish whether this resulted from enforcement, account replacement, administrative changes or another cause.

Two companies are identifiable Brazilian corporate entities, with CNPJ numbers 54.763.108/0001-65 and 54.738.154/0001-04 respectively. The research notes also connect SOCIAL MEDIA PARA EMPRESA and AGENCIA DE TRAFEGO PAGO through Gabriel Da Cruz, the head of Agencia Moll. Approached by the authors, employees of Agência Moll said the agency was winding down its operations and selling its advertising accounts, and that those accounts were bought by an unknown user on Facebook who then used them to run the campaign. They say the buyer’s account was removed afterwards.⁸⁸ Soon after, Agencia Moll closed its website and announced it was no longer responsible for the dissemination of the content in the ads. Its shape is the same as the one Lê Văn Tính gave in phase one: assets sold on, control passing to a purchaser who cannot now be identified. Agencia Moll’s website now holds a notice denying involvement in the advertising occurring on their assets.

A new Grand Theft Qatar account appeared on TikTok in September 2026. @grand.theft.qatar8 was opened on 22 September and had posted two videos by 9 October, and TikTok records both as uploaded from Brazil.⁸⁹ TikTok’s upload-location field gives the network or SIM region of the device that uploaded the video and can be altered with a VPN; it agrees with the Brazilian advertiser records above.

Liliane Kaufman provides another link across the campaign. Her Google advertiser record (AR05546548374104178689) promoted a particularly broad collection of campaign properties, including Qatar's Behind This, Islamic Terms You Need to Know, Qatari Christmas is Here, Doha Did It, The Godmother, The Silent Invasion and Save Europe Stop Qatar. These span the campaign's later anti-Qatar and anti-Muslim/anti-migrant narratives rather than a single advertising property. As with the Brazilian companies, Kaufman’s record disappeared from Google’s Ads Transparency Center, but the videos associated with her campaign did not.

Some of the advertisers, such as Agencia De Trafego Pago LTDA, had separate entities for ‘funded’ by, including Corp MJJA, and Muham. It is not clear if these are legacies belonging to the original advertiser.

TikTok

A name in an advertiser, payer or beneficiary field identifies an entity, but not necessarily a clear operator. Meta’s beneficiary and payer strings and Google’s “paid for by” appear to be self-declared: Google’s own panel notes that the funder information is supplied by the advertiser and not confirmed, and TikTok’s field is the clearest demonstration, returning the strings “IRAN” and “Gog” across the archived placements, neither of which identifies anybody. Similarly, the TikTok ads were often run by an entity registered in Germany, even though they appeared to be operated from Brazil.

Google’s advertiser identity, by contrast, can be verified, but the verification attaches to whichever person or company presented the documents or already held the account, and this operation is documented to have obtained its advertising assets by that route: LT Media displayed forged identity documents and stock of pre-verified accounts (section 6). Hijacked advertiser accounts are a commodity in their own right. Push Security’s analysis of the malvertising economy describes compromised Google, Facebook and LinkedIn ad-manager accounts sold or rented on criminal forums, listed by age, billing history and spend limit, and prized precisely because an established compliance history makes them less likely to be flagged; it reports that Google’s Threat Analysis Group traced one cluster of such takeovers to Vietnamese actors who hijacked marketing accounts to “either sell ads to other actors, or sell the accounts themselves”.⁹⁰

A verified name can therefore belong to a victim as easily as to a supplier. The appearance of a name in any of these fields is not evidence that the named person placed the advertising, paid for it, or knew what it contained. Novatech Solutions GmbH, one of the companies listed in the TikTok ads, is a real company, and it is not clear whether it was involved.

8.3 Avoiding political-ad classification

The most effective evasion required no subterfuge at all. Platforms publish spend only for advertising filed as political or social-issue content. Almost none of this campaign was categorised that way, so the transparency systems built to expose operations like these were largely ineffective. An operation that stays out of the political category is, in practice, unaudited, however visible its individual advertisements are. The fact that actors are supposed to self disclose political campaigns is rather pointless if such measures can be obviated by simply using the methods adopted by this campaign.

8.4 Activity after the takedown

Meta told AFP in early July 2024 that it had removed the network nearly two months earlier, about mid-May. Advertising on the phase-one pages had mostly stopped by 21 May, but one of them, Défendons la laïcité, ran 27 more advertisements on 13 and 14 June, and pages grouped into phase two ran 22 between 1 June and 1 July; the record does not show whether that page survived the removal or Meta’s date is approximate. The authors published their first investigation on 7 July 2024 and Meta disclosed the takedown in August. Paid placement stops for three months, although the campaign’s X account posted 65 times across them and its Telegram channel 52 times, then resumes in November and December 2024 at a fraction of its former volume under a series of short-lived new identities. No further paid placement is recorded until October 2025; the No to the Iranian Occupation TikTok account began posting videos in August 2025, while the campaign’s X account kept posting until 5 February 2025; it returns at scale in October on YouTube, Meta and TikTok, where advertising transparency is weaker than on Meta. It was still running in October 2026.

9. Advertising spend: recorded and projected

This advertising was renewed across three phases and two rebrands, including after the operation had been publicly exposed and removed by Meta. The anchor is the commercial tracker’s measurement of phase one and of one phase-two page. It recorded 261,758,827 impressions against $1,594,324 of spend across 17 pages in 21 countries, giving a blended cost of $6.09 per thousand impressions. That CPM is the basis for every projection here except YouTube, which is priced per view.

9.1 Understating spend

Meta’s report on the takedown states the operation spent around $1.2 million on Meta placements in phase one. Meta’s own Ad Library, for the same pages over the same period, showed a spend for 43 of the 1,018 advertisements (incomplete) in the ad archive, between $726 at the bottom of the ranges it displays and $896 at the top, six of the 43 open-ended above ₫1 million so that the top is not a bound, 42 of them in Vietnamese dong; the other 975 have no spend listed at all. Across all three phases the ad archive holds a spend for 268 of 1,473 advertisements, $98,000 to $135,000 in all, most of it phase 3, where the operation is billed in US dollars, in Vietnamese dong, in Brazilian real, and in EU euro.

The visible spend can be extrapolated, and the exercise is instructive. The 43 phase-one advertisements that show a spend average $17 to $21 each, or $0.68 to $0.84 per thousand accounts reached. Pricing all 1,018 archived advertisements at those rates gives $17,000 to $34,000 for the phase, against Meta’s own figure of around $1.2 million. The hypothesis assumes the visible advertisements are typical of the rest: even priced onto every advertisement in the ad archive, the ad archive’s own rates account for at most 3 per cent of what Meta says was spent. The remainder is advertising that is not archived, which is what the tracker’s ratio measures on the 17 pages it covered. The same exercise gives $5,000 to $25,000 for phase 2 and $132,000 to $217,000 for phase 3, where 220 of 358 advertisements show a spend and the rate, $2.69 to $3.72 per thousand reached, is closer to the tracker’s CPM. Those two phases have no disclosure to check them against.

Two structural causes explain the gap. The first is the category rule: the Ad Library publishes a spend figure only for advertising filed as political or social-issue content, and almost none of this operation’s advertising was categorised that way, so for most of it the ad archive reports no spend at all. The second is that the ad archive is not a census of every ad that ran. It holds what was still retrievable when it was captured, and an advertisement deleted before capture contributes nothing to any total, spend included. Even if Meta published a spend figure for every advertisement the ad archive holds, the ad archive would still understate this operation’s spending, because the operation placed advertisements that were not found.

The gap therefore measures both effects at once, and the ad archive’s own partial capture on top of them, and cannot be attributed to any one of the three. It is a floor on all of them. The comparison sets Meta’s own disclosure against what we retrieved from Meta’s own ad archive, and the disclosure is itself given as “around” $1.2 million. The ad archive figure is the sum of the ranges that were visible when the advertisements were captured, and the ad archive is missing an unknown number of advertisements. Nothing about the category rule changed after phase one, but the disclosure that exposed it did, which is why phase one is the only phase with two independent measures.

9.2 Correcting the later phases

A second, independent comparison points the same way. The tracker’s 17 campaign labels match 18 pages in the public archive, 17 from phase one (Le Projet ran on two pages under one label) and one from phase two. On those pages, the tracker recorded 261,758,827 impressions against 33,917,831 of archived reach, a ratio of 7.72.

We use that ratio to estimate impressions for reach the tracker did not include. YouTube and TikTok figures are left as reported by the platforms. Across all three phases, the archive holds 60,761,896 in reach that the tracker never saw. We scale only 44,400,504 of it. The other 16,361,392 comes from 181 rows whose Reach cell was copied from the advertisement’s own impressions band. Those figures are already impressions, so they’re added unscaled (Section 14.5). By phase: phase one is 259,998,231 tracker impressions plus 7,109,501 × 7.72; phase two is 1,760,596 tracker impressions plus 1,747,089 × 7.72 plus 2,426,000 unscaled; phase three is 35,543,914 × 7.72 plus 13,935,392 unscaled.

The results are in the projected column below. Earlier editions scaled the whole archive-only reach, which gave 915,037,366 instead.

That total, and every exposure figure here, combines three different units: 52% is impressions, the commercial tracker’s and the impression-band figures transcribed into 181 Reach cells, 22% is reach (accounts rather than views, including the analysts’ phase-one estimates), and 26% is YouTube and TikTok account public view counts. These are not interchangeable. The Estimated tier exists to convert the reach component toward impressions; the YouTube component is left as views throughout, because nothing in the record separates paid delivery from organic viewing.

9.3 Differences between ad tracker and ad archive

The 7.72 factor combines three gaps, and two of them can be measured here. The channel gap is small: the tracker’s reports put about 99.6 per cent of its impressions on Facebook, the platform the ad archive covers. The reach-to-impressions gap can be read on the 66 archived advertisements that carry both a platform reach figure and a closed impression band; rows whose reach is an analyst estimate or was copied from the band are left out, since they cannot measure how often an account was served. At the band midpoint the ratio has a median of 1.29, an interquartile range of 1.12 to 1.68 and a range of 0.89 to 2.25, and averages 1.49 weighted by reach. It differs by phase. The 11 phase-one pairs, from the period the tracker measured, run 0.89 to 1.40 (median 1.12). The 55 phase-three pairs run up to 2.25, 26 of them above 1.5; the highest, two Euro Summer Fest advertisements of July 2026, delivered 900,000 to 1 million impressions to 446,529 accounts in Rome and 450,000 to 500,000 to 211,283 in Paris, about 2.0 to 2.4. With the channel gap, a phase-one ratio near 1.1 leaves a residual of about 6.8 times, and even the highest ratio in the archive would leave about 3.4. That residual is archive loss, advertising the tracker recorded but the ad archive did not capture, together with whatever the tracker’s own impression model adds. The data cannot separate the two, so archive loss is the likely largest component, not an established one.

The tracker covers 18 of the 64 page identities in this operation, one of them in phase two and none in phase three. Projecting its ratio onto the pages it never saw assumes those pages lost as much to the archive, and differed as much between reach and impressions, as the pages it covered. The tracked set is dominated by a single page, Shame on Qatar, which accounts for about two-thirds of tracker spend, so it is a narrow basis for that assumption.

9.4 Estimating exposure and spend

The 7.72 ratio mixes three gaps: channel, archive loss, and reach versus impressions. The first is small and the third can be read only on 66 rows, while archive loss, probably the largest, cannot be measured (Section 9.3). So we don’t give a single corrected total as if it were a measurement. Instead, we start with what the public archives show on their own, then add one source or assumption at a time and show how much each changes the figure.

Buying commercial tracking data for 18 of the 64 page identities lifts the measured total by 75 per cent, from 305 million exposures to 533 million, and the advertising cost, at the tracker’s CPM with YouTube priced per view, from $3.70 million to $5.08 million. A researcher without a commercial subscription would report the smaller figure with no way of knowing it was about 57% of the tracked total. The remaining 46 identities have never been measured this way, and nothing in the record shows whether they behaved the same way or not.

Unobserved activity can only add to the recorded total; its magnitude and cost are unknown. The recorded total itself contains estimates, and how much of the advertising on the pages the tracker did not cover the archive failed to capture is not known. The cost figures price Facebook and TikTok exposure at a single blended CPM of $6.09, itself set largely by one page’s United States buying, and YouTube views at $0.02 a view, $0.03 in the projection.⁹³ Priced at the tracker’s rate excluding that page, $4.11, the dollar figures above fall by 9 to 17 per cent.

9.5 Total operational cost

Advertising is not the whole budget. Video and graphic production in five languages, website and hosting infrastructure, corporate formation in three jurisdictions, a Times Square billboard, a conference screening, staged demonstrations, and the account and payment overheads of an operation that discarded 64 identities all sit on top of the figures above. None of it is priced here, because no line item can be sourced to a document, and for the same reason no total operational cost is published in the summary table.

9.6 Where this sits among known operations

Among the operations in Meta’s published reports on coordinated inauthentic behaviour and adversarial threats, we found none targeting European Union member states with higher documented Meta advertising spend than this operation’s first phase. The comparison set is every coordinated inauthentic behaviour and adversarial threat network Meta has publicly reported between 2018 and 2025: 211 networks, coded from Meta’s own published reports and checked against Meta’s full wording where a short label could hide a target. The coding is not exhaustive. Of those, 154 carry a spend figure, and the figures total $24,191,008.

Twenty of the 211 named an EU member state among their targets, counting a country only where Meta says the network targeted it or localised content for it, not where it was the origin or a subject, and 13 of those state a spend. Together they come to $1,746,886, one of them, Iran’s network of January 2019, a ceiling (“less than $30,000”) counted at its top. This operation is one of them: Meta’s April to June 2024 report names LT Media, a Vietnam-based firm, and states $1,200,000. That one network is 69 per cent of the entire EU-facing total. Every other operation Meta has reported against EU member states in eight years adds up to $546,886.

The gap to the next operation is wide. The next largest is a domestic Romanian network at $177,000, smaller by a factor of 6.8. Below that sit a Sputnik-linked network Meta removed in January 2019, about $135,000, whose pages posed as local news for Romania, Latvia, Estonia and Lithuania among other countries, and the Russian operation publicly known as Doppelgänger, at $105,000: announced in September 2022 and attributed, in Meta’s report for the last quarter of that year, to Structura National Technologies and the Social Design Agency, both later sanctioned. It targeted Germany, France, Italy, Ukraine and the United Kingdom. Doppelgänger is the reference point for state-backed interference in Europe. On Meta’s own figures this operation spent 11 times what Meta stated for Doppelgänger (although these figures are not up-to-date).

That $1,200,000 covers phase 1 alone: nine months of an operation that has now run for 36 months, and the only phase Meta ever published on. Phases 2 and 3, and the YouTube and TikTok buying that came with them, appear nowhere in the coordinated inauthentic behaviour record at any price. Meta has not reported this network since. The ad archive’s most recent dated placement falls in October 2026.

The top row of the ranking is therefore doubly understated. It prices one phase of three, carrying 70 per cent of the Facebook placements and half of the recorded exposure, and on that basis alone it still outspends the next largest EU-facing network by a factor of 6.8 and every other one put together by 2.2.

Not all of that $1,200,000 was spent against EU audiences. Meta’s target list for the network runs Lebanon, the United States, the United Kingdom, France, Saudi Arabia and Qatar, and Meta publishes no geographic breakdown of spend for any network it reports: not for this one, and not for any of the operations it is being compared against. Every figure in the ranking is therefore a whole-network figure, which is what makes them comparable. Apportioning this operation to its EU share while leaving the comparators whole would not be a like comparison, and this report does not do it, though doing so would not change the result. In the ad archive, 45 per cent of recorded exposure fell on the 12 EU member states, which puts the EU share of the floor at about $2.27 million and of the corrected figure at about $3.68 million. Either still exceeds every other EU-facing operation Meta has disclosed put together. Apportioning at a flat rate across countries is rough, which is why those two are given to the nearest ten thousand and the comparison is not run on them.

Meta’s own description of this network is narrower than the ad archive. Its target list names France as the only EU state; the ad archive records 12. This report’s modelled advertising cost across all three phases is $5,083,373, which is 21 per cent of everything Meta has disclosed across 211 networks in eight years, and the corrected figure of $8,222,375 is 34 per cent. Neither is on Meta’s basis and neither is directly comparable to it, but they place the order of magnitude.

The comparison measures one thing: advertising spend that a platform disclosed. It is silent on operations that bought no advertising, bought it somewhere that publishes nothing, or were never caught, and Meta’s figures are floors rather than budgets. Doppelgänger is the clearest case of what it misses. That operation spent little on advertising. Most of its money went on registering and running fake news sites at scale. So the comparison doesn’t support the headline claim, only a narrower one: of the operations Meta has disclosed buying ads aimed at EU member states, none spent as much as this one.

9.7 Scale and scope against the wider record

Section 9.6 ranks the operation against the networks in Meta's record that targeted EU member states. The same 211-network set answers the wider question of where it stands against everything Meta has disclosed.⁹⁵ Of the 154 networks with a stated spend, the median is $7,100 and 37 exceed $100,000. On Meta's own figure of $1,200,000 for phase 1, this operation ranks sixth. The five above it are CLS Strategies, a Washington public relations firm working on Venezuela, Mexico and Bolivia ($3,600,000, August 2020)⁹⁶; MAS Agency, for the Batkivshchyna party in Ukraine ($2,100,000, October 2020)⁹⁷; Postmen DA, a Ukrainian advertising agency ($1,910,000, July 2020)⁹⁸; Estraterra, a Canadian public relations firm working in six Latin American countries ($1,380,000, July 2020)⁹⁹; and Pragmatico, a Ukrainian public relations firm ($1,600,000, September 2019), which the original coding missed.¹⁰⁰ All five are commercial firms placing advertising for political clients, which is the shape of this operation, and each is in the record once, at a single takedown. The BL network, which Meta linked to Epoch Media Group in December 2019, is in the dataset without a figure because Meta gave only a ceiling, less than $9,500,000; if it spent more than $1,200,000, phase one is seventh.¹⁰¹ On this report's own modelled cost of $5,083,373, or the corrected $8,222,375, the operation would rank first among networks with an exact figure. The BL's ceiling is above both. Neither figure is on Meta's basis, and the ranking on them is given for order of magnitude only.

The reference point outside Meta's record is the Internet Research Agency's advertising in the 2016 United States election, which Facebook put at about 3,000 ads, roughly $100,000, seen by an estimated 11.4 million users in the United States.¹⁰² Meta's stated spend for phase 1 of this operation is twelve times that sum; the ad archive's 1,473 Facebook advertisements are half the IRA's count; and the 94.7 million recorded exposures on Meta alone are more than eight times the audience Facebook estimated for the IRA ads, in different units. The IRA's advertising was the minor part of an operation built on organic posting, so the comparison is advertising against advertising.

Set against the audience figures that other documented investigations have published, this appears to be one of the largest influence operations in terms of known, publicly documented reach. It is hard to compare though, since parsing specific operations can be difficult, and platforms are either inconsistent or incomplete in how they report operations. Nonetheless, other comparable operations include:

The operation is also wider than the record's norm. Meta's target list for this network names six countries; the ad archive records 17, the commercial tracker 21, and the two together 30. In Meta's record the median network targets one country, and the widest, Iran’s network of January 2019, names 26. Spamouflage, which Meta in 2023 called the largest known cross-platform covert influence operation in the world, is the inverse case: about 9,000 Facebook accounts, pages and groups removed, activity on more than 50 platforms, and about $3,500 of advertising.¹⁰⁹ This operation has few assets, 64 Facebook page identities, 15 YouTube channels and 5 TikTok advertiser accounts, and bought its reach. Spamouflage's reach was organic and, by most accounts, small; all of this operation's 533 million recorded exposures are priced as bought, though the public view counts on YouTube and on the No to the Iranian Occupation TikTok account do not show what share of a video’s views the advertising bought. The cost model prices all 132.2 million of them as bought, at $0.02 to $0.03 a view, $2.64 million to $3.97 million: the channels had no audience of their own and the videos reached that scale through the advertising, so every view is taken to be paid.¹¹⁰

Meta's reports record a takedown and not a run, although its posts of 2018 and 2019 give the dates of a network's first and last advertisements. Operations whose persistence is documented elsewhere, Doppelgänger since 2022 and Spamouflage since 2017¹¹¹, are state-run and mostly unpaid. Among networks funded through advertising, some are documented buying for longer: a Sputnik-linked network advertised from October 2013 to January 2019, and two Iranian networks removed in August 2018 from 2012 and 2015. None of them approaches this operation's spend; the Sputnik network's was about $135,000.¹¹² This operation is in Meta's record once, in August 2024, and two years of its advertising postdate that entry.

The limits set out in Section 9.6 apply here too. The comparison covers only advertising spend that Meta chose to disclose, and only on Meta, so it is a minimum. It tells us nothing about operations that bought no ads, bought them on platforms that publish nothing, or were never caught.

What it does show is this. Of all the operations Meta has caught buying ads anywhere in the past eight years, this one ranks in the top six or seven on Meta’s own partial figure, and at or near the top on this report’s estimate. The operations ranked around it were mostly commissioned work by advertising and PR firms.

10. The accountability gap

The findings above describe a covert propaganda and hate campaign that ran for nearly three years, in the open, on mainstream platforms, and was paid for at commercial rates. This was possible because of four failures, all of them policy choices.

• Advertising that vilifies a religious group as a demographic threat was accepted, served and charged for at scale, across multiple platforms, for multiple years.

• Because spend and funding data are published only for advertising categorised as political, an operation that stays outside that category is effectively unaudited. This one did, almost entirely.

• The public archive on which external scrutiny depends reported a fraction of what the platform itself later disclosed for the same advertising, with nothing to signal to a researcher that the figure was incomplete.

• Enforcement removed identities but not capability. Archived activity resumed within three months of Meta’s August disclosure, about six months after the removal itself, at low volume and under new names, and returned at scale fourteen months after it on Meta and platforms with even weaker transparency tools. It was still running two years after it was first exposed.

Any researcher relying solely on public ad archives will materially understate operations of this kind, with no indication that they are doing so. And an operator that keeps its hate advertising out of the political category can buy the same reach again tomorrow and again go uncounted.

10.1 Transparency failures by platform

The 2024 investigation catalogued the specific mechanisms that defeated scrutiny. They are reproduced here in condensed form because each is a fixable design decision, and none has since been fixed.

Two of these work against transparency. Removing payer information at the moment an advertisement is judged to have violated the rules destroys the evidence at the moment an investigator needs it. And withdrawing a terminated page’s data from the engagement-monitoring tool means the pages that mattered most are the ones that can no longer be measured.

10.2 Ad lifespans, reach and revenue per ad

Every ad in the ad archive comes from a Facebook page Meta ultimately suspended for violating its advertising rules, so the ad archive is a sample of advertising from pages Meta found in violation, not a census of violating ads. 1,038 of the 1,473 carry both a start and an end date. Across those the average violating ad was live for 2.5 days and the median for 2. 41% ran for a day or less, 77% were finished within three days, and the longest ran for 29. Meta’s own notices separate run time from takedown: among phase-one ads carrying an enforcement message, ads flagged retroactively, “run by an account that we later disabled”, outnumber ads recorded as removed by 353 to 144. The typical violating ad ran its scheduled two days, delivered in full, and was only ruled violating later when its page was suspended. The short lifespans reflect the operator’s disposable-page strategy, not Meta’s response time. At the network level Meta removed the pages about seven months in, by its own account to AFP, and disclosed the takedown at about ten.

On reach, the average archived ad reached about 42,000 accounts where Facebook itself published a figure, with a median of 15,000. Across all three phases the mean is roughly 67,000 per ad and the median 37,000: the later phases bought bigger audiences per placement, and a small number of very large buys pull the mean well above the median. In total, Meta’s own reported reach figures sum to 94.7 million per-ad reach before the pages were suspended (94,679,727 across the three phases, one capture per ad, including the phase-one analyst estimates), not 94.7 million distinct accounts. It counts only captured ads but is not a strict minimum: 395 phase-one ads carry an analyst estimate rather than a platform figure, and reach counts accounts rather than the larger number of times each ad was served.

On revenue, Meta’s report on the takedown states the operation spent around $1.2 million on its platforms in phase one. Across the 1,018 archived phase-one advertisements that is an average of $1,179 per archived ad, Meta’s whole-network figure spread over the archived count rather than a measured price, all of it billed before enforcement. The Ad Library carries a spend figure for only 268 of the 1,473 archived ads, because spend is published solely for ads filed as political content, the category this campaign avoided. For 82% of the archived ads, 1,205 of 1,473, the public record shows no spend at all. The per-ad average is knowable only because Meta disclosed the total once, after the fact, in a takedown announcement, and only because the number of assets in the campaign had already been documented.

10.3 Identity lifespans

Grouped by page identity, the 1,453 dated Facebook rows resolve into 61 identities with a datable run. Measured from first ad to last, the average identity ran 34 days, but the median was 3, because a handful of long-running pages stretch the mean. 57% placed their entire ad run inside a single week and 69% inside a month. At the other end, Défendons la laïcité ran ads across 184 days, The Plot Against Europe across 165, Sauvons le Liban across 155 and Shame on Qatar across 150. Twelve identities sustained ad buying for three months or more.

The average identity placed about 24 ads (median 7, maximum 203) and accumulated roughly 1.5 million in platform-reported reach, with a median of about 306,000. Against Meta’s stated phase-one spend of $1.2 million, the 26 phase-one page identities average out to roughly $46,000 collected per suspended identity.

Two caveats apply. Spans are measured first to last archived ad, so any ads lost before archiving can only shorten a recorded span, which makes every figure here a minimum. And 3 of the 64 page identities carry no dateable ad and are excluded, as are ten phase-one rows dated January 2023 on a page that did not exist until 2024.

11. Approaches for comment

The findings concerning the phase-one parties were put to them in 2024, in the course of the reporting that produced the first published account of this operation. Their responses are set out below and repeated in relevant sections. Of the Brazilian parties, only Agência Moll has been approached; its response is below and in Section 7.

Three of these are denials, reproduced at the point of the finding they concern, as well as here. Beyond the Agência Moll exchange, no response has been sought on the material that is new to this report: the phase-two and phase-three campaigns, the Brazilian individuals and companies named as payers, advertisers or beneficiaries, the German TikTok advertiser names, or the Wikimedia findings. JDA Worldwide has been approached only through its principal Johnnie Moore. Shuki Duchovni, Baobab Group, Barbora Fialová, Adi Timor, Lior Chorev, Royi Burstien and Percepto International, named in Section 7.3, have not been approached. Nor have Liliane Kaufman and the four Belgian advertiser names recorded against Make Lebanon Great Again, the TikTok advertisers Alemira, Goge and NovaTech Solutions GmbH, or Google, TikTok and Meta on the phase-two and phase-three advertising.

12. Audience response

How the advertising impacted viewers can be tested only where audiences answered it in public. Coding of 406 Facebook comments on a sample of UK-targeted advertisements from one page gives a direct, if narrow, reading of the response. Section 14.8 sets out how the coding was done and what it does not cover.

249 of 406 comments (61%) supported Islamophobic views, against 76 opposing them. The recurring themes were an anti-immigration framing that conflated immigration with Islam, a fatalistic “too late” narrative about European demographic change, explicit “invasion” and replacement conspiracism, and calls for drastic action. A minority of comments were antisemitic, invoking tropes of Jewish financial and political control. The advertising generated bigotry beyond the category it targeted.

Engagement was substantial where it could be measured. Before the pages were terminated and their data withdrawn from the monitoring tool CrowdTangle, five first-wave anti-Qatar pages had accumulated the following:

These figures are partial by construction: pages terminated before the data was captured contribute nothing, and terminated pages disappear from the tool entirely. The tool itself has since been retired.

12.1 YouTube comments

The YouTube channels give a larger and later reading. The comment sections of the 173 archived videos hold 4,465 comments from 2,507 accounts, posted between August 2024 and August 2026; 140 of the videos carry at least one, and 1,905 of the comments are replies to other commenters rather than to the video. The videos make three claims: that Muslim immigration is replacing Europe’s native population and culture, that the migrants bring crime, terrorism and the loss of Christian Europe, and that Qatar is paying for it. Each of the 2,560 top-level comments was coded as supporting those claims, opposing them, or neither. A comment supports them if it agrees that Europe is being Islamised, invaded or replaced, that Qatar or Muslims are to blame, or that the answer is remigration or violence, or if it says the advertisement is true even while calling it propaganda. It opposes them if it rejects the message as propaganda, racist, hateful or false, attributes it to a sponsor, defends Muslims, migrants or Qatar, or reports it as hate. A comment that only says the material is AI-generated, or only remarks on the placement (why it is being served, that it cannot be blocked, who paid for it), takes no position on the message and is neutral; both remarks are recorded as flags. Emoji, jokes with no position, off-topic and unintelligible comments are neutral. Four flags were added independently of stance due to their sheer prevalence: whether the comment names Israel, Mossad, Zionists or “hasbara” as the sponsor; whether it names another actor; whether it says the material is AI-generated; and whether it shows awareness of the paid placement, by asking why the advertisement is being served, saying it cannot be blocked, reporting it, or quoting the About-this-advertiser panel. Every comment was read in its original language, English, French, Italian, German or Arabic, by an AI agent (Claude, Anthropic) working as a single coder; the scheme and the code assigned to each comment are in the comments workbook, and the figures here should be read as indicative rather than measured to the point.

The YouTube comments generally lean the other way from the Facebook sample. 1,070 comments, 42%, oppose the advertisement’s message: they call it propaganda, racist, hateful or false, defend the people it depicts, or attribute it to a sponsor. 714, 28%, support it, and 776, 30%, take no position: emoji, jokes and unreadable comments, and 163 that only notice the AI production or the paid placement. Setting the neutral comments aside, 40% support the message and 60% oppose it, against 77% support in the Facebook coding on the same basis. The two samples differ in platform, years, campaigns, audience and coding procedure, so the difference between them is not evidence that the platform changed the response. Weighting by likes widens the gap: opposing comments took 56% of the 13,070 likes on top-level comments, supporting comments 22%, and of the twenty most-liked comments in the corpus fourteen oppose the advertising and two support it.

Of the 2,560 coded comments, 462, or 18%, name a perceived sponsor for the advertising, and most of those name Israel. Among the 695 that engage with the advertising as advertising, by naming a sponsor, showing awareness of the paid placement or identifying it as AI-generated, two thirds name a sponsor. 393 top-level comments, 15% of all of them, attribute the advertising to Israel, Mossad, Zionists, “hasbara” or Tel Aviv, 384 of them among the comments opposing the message, 36% of that group. “Zio Bots, Mossad is that you?” is the most-liked comment in the corpus at 421 likes, followed by “Nice one Israel” at 334 and “nice try mossad” at 258. A further 77 name someone else, Russia, the UAE, the CIA, the AfD, the Rassemblement National or General Vannacci, or the Brazilian and Belgian advertisers whose names commenters had read off Google’s About-this-advertiser panel; 66 cross from attribution into antisemitic tropes of Jewish money and control. Few engage with the claim the advertising actually makes, that Qatar is behind Muslim migration: 49 of the 2,560 take any position on Qatar; the argument is about who bought the ad. The record traced in Sections 6 and 8 supports none of these attributions: the buying runs through Vietnamese and Brazilian proxies and the ultimate funder is not established. Viewers assign an unattributed hate advertisement to whichever actor they already distrust, and the guess circulates as fact.

185 comments show awareness of the placement itself. Viewers ask why the advertisement is being served to them, say they have seen it seventeen times in a day or cannot block it, report that it reached them inside a mobile game, a weather app or 9gag, or say they have reported it and that YouTube found no violation; some forty say they have reported it. Fourteen transcribe the advertiser panel, Liliane Kaufman of Belgium or Social Media Para Empresa Ltda of Brazil, the same disclosures Section 8.2 examines, and 102 identify the material as AI-generated, usually as grounds for dismissing it.

Interestingly, support varies more with the language of the audience than with the content. By the language of the comment (Figure 75), Italian-language comments run 45% supportive, French 36% and German 29%, against 21% for English and 12% for Arabic. On Qatar is Responsible, whose comments are mostly Italian and French, support and opposition are level at 42% each; Euro Summer Fest, the largest, runs 34% to 36%; Grand Theft Qatar 15% to 37%; Stop Qatar, with an English-speaking audience, 12% to 77%. The supportive comments read like the Facebook sample: remigration, invasion, crusades, “Oriana Fallaci was a prophet”, “it’s true even if it’s propaganda”. That last form recurs often: a share of viewers recognise the advertisement as propaganda, guess at a sponsor, and endorse the premise anyway.

The Lebanon-targeted Arabic channels drew a different audience again. Comments on the anti-Hezbollah channel are largely pro-resistance, “we will not kneel”, “I am from Lebanon”, with the advertising attributed to Israel; the caricature channel aimed at Sheikha Moza drew Gulf viewers who had been served the video while studying and defended her. Across all channels, comments are a self-selected fraction of the audience, 48 per million views, and the people moved to comment, viewers irritated by an unskippable placement, Muslim viewers, political partisans, are probably not the people the advertising was bought to reach. Several commenters also report their comments disappearing and reappearing, so the corpus is what survived moderation, by the channel or the platform, at the time of capture. The coding is a single reading by an AI agent with no human second coder, unlike the cross-validated Facebook sample.

Top-level comments on the 173 archived videos, coded September 2026 and recoded 21 October 2026 (Section 14.8) from youtube_comments.xlsx; the coded sheet and scheme are in that workbook. “Names Israel” counts comments attributing the advertising to Israel, Mossad, Zionists or hasbara, whatever their stance. The four small channels are the Arabic-language caricature channel listed in Appendix A, Islamic Terms You Need to Know, It’s In Your Hands and ThanksIran.

The same split by the language of the comment (Figure 75) puts Italian at the top. Of the 2,337 top-level comments with enough text to place, 460 are in Italian and 45% of those support the advertisement’s message against 37% opposing; French runs 36% support to 41% oppose, German 29% to 45%, English 21% to 50%, Spanish 14% to 57% and Arabic 12% to 42%. The language is detected from the text and a short comment can be misplaced, but the order matches the channel figures: the campaigns placed in Italy and France (Qatar is Responsible and Euro Summer Fest) drew the most agreement; and the English-language audience, which is the largest, was the most hostile.

Stance says whether a comment agrees with the advertisement. It does not say what the comment is against. A second pass over the same 2,560 comments coded what each one is hostile to, or defends, independently of stance; a comment can carry several codes and 828 carry at least one (Figure 76). Naming a sponsor is not counted as hostility, and calling the advertisement racist is not counted as defending Muslims. The largest category is hostility to Muslims or Islam as such: 283 comments, 11% of the total, from “Islam is cancer” and “Europistan” to agreement that Europe is being Islamised. 128 comments call for remigration, deportation or closed borders, or tell the people in the footage to go home. 66 call for or welcome violence: napalm, flamethrowers, “kill them all”, the police shooting, a new crusade, civil war as something to look forward to. 49 use a racist slur or dehumanising language, most often vermin, cockroaches, “Pack” or a hunting metaphor (“the hunting season is open”, “safaris”). 41 are hostile to Qatar as a state, as a sponsor of terrorism or slavery, and 66 blame their own politicians, the European Union or the left for immigration. Of the 714 comments coded as supporting the advertisement, 423 carry at least one of the anti-Muslim, anti-migrant, slur or violence codes; the rest agree without naming a target (“sad but true”, “bravo”, “reality”).

The propaganda also provokes antisemitism. The second largest category is hostility turned on Israel and Jews. 162 comments are hostile to Israel or Zionism beyond the bare attribution counted in Figure 73: insults, “Free Palestine”, genocide accusations, and on the Lebanon channels support for the resistance against the Israeli enemy. 67 carry an antisemitic trope: Jewish or Zionist control of media, finance or politics, “the chosen people”, the juice-box emoji used as a slur, Kalergi, Soros, the Talmud. 205 of the 1,070 opposing comments carry one or both, so about a fifth of the opposition to the advertising is expressed as hostility to Israel or Jews, and 35 of the 67 antisemitic comments also name Israel as the sponsor. Explicit defence of Muslims, migrants or Islam is rare, 29 comments, and defence of Qatar rarer, 8; the opposition mostly attacks the advertisement rather than defending its targets. The channels differ. Euro Summer Fest, with the largest and most European audience, carries 135 of the anti-Muslim comments, 94 of the anti-migrant ones and 40 of the calls for violence. Qatar is Responsible, placed in Italy and France, carries 40 of the 66 comments blaming the commenter’s own politicians and 20 of the 67 antisemitic ones. Stop Qatar and Qatar’s Behind This, which drew Muslim and Arabic-speaking audiences, carry 73 of the 162 comments hostile to Israel and seven of the 66 calls for violence. In its own comment sections the advertising produced hostility to Muslims and migrants among the audience it was aimed at, and antisemitic attribution among the audience it was aimed against.

The most important thing to note is that the videos are generative of polarised discussion, potentially contributing to existing stances on the issues of Islam and immigration.

12.2 Reddit

Reddit was a useful forum for information about the advert sponsors. On Reddit, people who had come across the advertising without looking for it discussed it at length. The workbook records eight threads found during discovery (there are more).¹¹⁷ The fourteen threads run from 6 July to 5 September 2026, in French, German, Italian and English, and contain 268 comments. All concern the Phase 3 YouTube and TikTok advertising: Euro Summer Fest, Grand Theft Qatar and Qatar is Responsible. Two comments reach back to the “Qatar is behind this” Muslim-Santa advertising of Christmas 2025.¹¹⁸ The largest thread, in r/beschissene_Werbungen (“shitty adverts”), has 254 points and 56 comments. This list of Reddit links is not exhaustive.

Reddit threads about the Phase 3 advertising, July to September 2026. Points are the post score at retrieval; comments exclude bots and deleted comments. Titles are translated where the original is not English.

Few posters took the advertising at face value. Most describe seeing the same sponsored Short again and again (“I have honestly seen the video 40 times”), first taking it for an event promotion, then recognising it as propaganda. Commenters spotted that it was AI-generated and listed its mistakes, from the Eiffel Tower at a Spanish festival to Seattle pasted into Italy. Several had also seen it on TikTok, on Instagram and inside the mobile game Last Cloudia. The question they kept asking was the same one this report asks: who is paying?

Their answers were guesses, the same ones found in the YouTube comments. Israel came first in the French, German and Italian threads, usually because of its motive, and Russia second, linked to upcoming French and German elections. The UAE, Iran, Saudi Arabia, the AfD and others were each named at least once.

Users reported seeing them on websites like Physics and Maths Tutors, including UK-students studying for their GCSEs.

Some posters got as far as the advertiser panels. The r/italy and r/france posts name the Phase 3 identities set out in Section 6, and one commenter traced an account to a businesswoman in Brazil. The r/italy author even asked whether the campaign was linked to the 2023–24 “Qatar Plot”, which is the question this report answers. Nobody got further than that.

Users in France, Italy and Germany said they had reported the ads repeatedly and either heard nothing or were told no action would be taken. The one success was the r/AntifascistsofReddit author, who received an email from Google Ads saying the ad would be removed within 24 hours (Figure 78). Complaint threads quickly turned to ad-blocker advice. Some objected that this helps only the user: “the problem is not for us; it is the people this propaganda is aimed at.” Moderators or Reddit removed four of the fourteen threads, and automoderator filters held two more when they were posted.

Support for the message was a minority view in every thread. More common was partial agreement: upvoted comments in r/italy and r/KeineDummenFragen attacked Qatar over Hamas and the Muslim Brotherhood while calling the ads themselves propaganda. The few who accepted the whole message were downvoted. The longest argument, in r/italy, became a fight over whether anyone should defend Qatar, which is probably one of the reactions the ads were designed to provoke. Elsewhere, a r/NoStupidQuestions reply of 23 August cites the ads as an example of right-wing propaganda that the left calls Israeli.¹¹⁹

These threads show that the advertising unsettled people, that viewers recognised the AI production, and that the discussion centred on who had paid rather than on Muslims in Europe. They also show what the lack of a named sponsor did: viewers blamed Israel, Russia and the Gulf states in turn, Israel most often. They capture the reactions of a few hundred people to advertising viewed tens of millions of times. They say nothing about its effect on the people who didn’t post.

13. Limitations

• Archive-derived figures cover only what was captured, and some rows carry estimates rather than platform figures. The 7.72 factor combines three gaps; the two this data can measure leave a residual of about 3.4 to 6.8 times, which rests on archive loss and the tracker’s own estimation together, and neither can be measured, and it is applied only in the projected scenario, never to the recorded total; Section 9.3 explains why and Section 9.4 reports the resulting figures separately.

• 286 recorded items carry no targeting field and are absent from the country analysis. A country total counts placements the ad archive could see, not delivery, and the 13 countries recorded only by the commercial tracker are absent from it too.

• Where an advertisement names several target countries it is counted once under each, so a country total is a count of placements rather than of advertisements. Items naming more than one country add 908 placements, so the 1,840 items that carry a targeting field give 2,748. Reach and monthly figures keep the first-listed country instead, because no archive but TikTok’s publishes a per-country split by which a multi-country buy could be apportioned. YouTube views are allocated to the target country recorded for each video; YouTube publishes no viewer location.

• Non-advertising costs (production, hosting, corporate formation, offline events) are real but not quantified here, because no line item can be sourced to a document. The figures are advertising cost only, and the true outlay is higher by an unknown margin.

• No response has been sought from the parties named in connection with phases two and three, or from the German entities; of the Brazilian entities, Agência Moll was approached and its response is in Section 11, which records what was put to whom, and when.

• 395 phase-one rows carry an analyst reach estimate where the ad archive published no platform figure, amounting to 35.9% of phase-one archived reach. Appendix A marks the pages this dominates.

• Phase-one rows without an ad-library link, 88 of the 1,018 advertisements, cannot be distinguished from one another on page, date, reach and target. They are retained as distinct creatives on the archiving judgement made at the time.

• Material deleted before it could be captured is absent from every count here and cannot be quantified. Discovery was iterative, so a campaign sharing no identifier, creative or infrastructure with something already known would not have been found.

• The composite exposure total mixes commercial tracker impressions, archived reach and YouTube public view counts. It is not a count of people, and the YouTube component does not separate paid delivery from organic viewing.

• The commercial tracker covers 18 of the 64 page identities, one of them in phase two and none in phase three, and the tracked set is dominated by a single page. The tracker-to-archive difference combines three distinct effects and cannot be applied as a universal correction factor. This report does not apply it as one.

• The narrative coding covers 117 creative units and 173 of the 189 YouTube videos, not the full corpus of 2,126 recorded items. Theme shares are shares of what was coded, not of what was published.

• The procedure used to translate the Arabic, French, German and Italian material is not documented in this edition. See Section 14.9.

• Platform identifiers cover only part of the corpus, so the 2,126 recorded rows cannot be fully deduplicated: the phase-one sheet carries an ad-library link on 956 of its rows and none on the rest, and the 34 rows that repeat an identifier on any sheet are collapsed to one before anything is counted. Item counts are of distinct identifiers unless stated otherwise.

• Attribution to an ultimate client is not established by this evidence. The report documents infrastructure, spend and behaviour; it does not identify who commissioned them.

14. Methods

The findings rest on an archive of individual advertisements, videos and posts, each recorded with the metadata the platform published at point of capture, alongside platform reporting, corporate registry records and one commercial advertising tracker. Where possible, videos and images were downloaded and saved. This section sets out what was collected, how, what qualified an asset as part of the operation.

14.1 Units of analysis

The unit is the individual paid or published item: one Facebook advertisement, one YouTube video, one TikTok advertisement, one X post. Where published, each record notes the platform, the page name identity that ran it, the platform's item identifier, title or caption, first and last date shown, reach or impressions, Meta's spend and impression bands for political advertising, target countries, the declared payer or beneficiary, enforcement status and source URL. Facebook rows add page creation date and hosting platform; TikTok rows add advertiser location, objective, target languages and call to action; YouTube rows show payer and advertiser separately, since they often differ, both inferred from Google Ad Transparency where data was available.

Empty fields are left empty rather than inferred. Meta publishes spend and impressions only for advertising filed as political or social-issue content, which almost none of this was. 286 items show no targeting field. Where an item names more than one target country it is counted once under each, so country totals are counts of placements (item-country pairs), not items: the 1,840 targeted items resolve to approximately 2,748 placements.

Collection was iterative. Starting from the assets identified in the 2024 investigation, we searched campaign and page names in the Meta, Google and TikTok ad libraries, then searched the advertiser and payer identifiers those results returned. Reddit threads and tips from students, journalists and other social-media users all surfaced pages, channels and accounts that no keyword search had found. This kind of snowball discovery yields a minimum, not a full count. Because the operator concealed its activity and platform archives are incomplete, advertisements that were not captured while live, or not flagged by Meta, may be missing.

Resemblance was often how a candidate was first noticed: a familiar aesthetic, a similar format, the same targets. Noticing was not enough for inclusion. An item was counted only where evidence linked it to an asset already in the ad archive, and each item admitted this way then served as a starting point for further links, so the ad archive grew outward from the 2024 assets instead of being limited to them. The evidence is of two kinds: record links and tradecraft links.

Record links are specific, checkable connections between one asset and another. Some are recorded by a platform, registrar or registry: a shared declared payer, advertiser or beneficiary; a shared sponsor page, advertising account, business manager or registrant; a shared domain or hosting account; a page renamed from one identity to another. Others are visible in the material itself: the same creative reappearing under another identity, the same website build, cross-posting or referral between identities, relaunched branding, and shared offline material such as posters or billboards.

Tradecraft links are resemblances of method: billing currency and disclosed administrator location; obfuscation techniques such as leetspeak spellings; production aesthetic, video formats and end-card grammar; targeting footprint and timing; and the narrative itself, where specific enough to be rare.

A record link was sufficient on its own. Tradecraft links were accepted only as a conjunction of several low-frequency features, and never on a single resemblance. The claim that Qatar is financing the Islamisation of Europe is made by almost nobody else; when it is advertised with the same aesthetic, the same obfuscation, the same formats, the same five markets and the same months, the conjunction is taken as a link. The two phase-three clusters entered the ad archive largely on this basis.

At least 64 Facebook page identities, 15 YouTube channels and 5 TikTok advertiser accounts passed this test. Candidates that resembled the operation in method but passed neither part of it are excluded from every total. Where the resemblance is close enough to matter, as with Make Lebanon Great Again and Al Ghaliboun, they are described separately as potential links (Sections 4.5 and 4.6) and their figures are reported outside the operation's totals. The difference is the rarity of the narrative: anti-Hezbollah content in Lebanon is common, so a Lebanese campaign that matches the operation's method is weaker evidence than a European one that also repeats a claim almost no one else makes.

14.2 Clusters, phases and evidence links

We identified three clusters and three phases. The chronological phases and the evidentiary clusters do not correspond perfectly. There are three phases and three clusters (A, B and C). Phase (timing) accounts for when the campaign appeared; cluster (infrastructure) accounts for the metadata links binding the assets together.

Cluster A covers phases 1 and 2 and is one connected component. Its campaigns are tied together by the Vietnamese sponsor-page infrastructure in Section 6.1, by Meta's beneficiary field naming LT Media and LeTinhLee on two of them, by shared creative and page templates, and by the single hosting provider and site build behind the website estate in Section 6.4. The Arabic campaign “The war of 2006 is remembered and will not be repeated” is tied to the cluster by the page that ran it. That page was created on 26 June 2012 as a pizza restaurant in Gávavencsellő, Hungary, and was still categorised “Pizza place” in Page Transparency after it had been renamed حرب ٢٠٠٦ تنذكر وما تنعاد, by which point its profile picture was LT Media’s own logo (Figure 81). LT Media is the Vietnamese proxy Meta named when it disclosed the takedown in August 2024.حرب ٢٠٠٦ تنذكروماتنعاد

Phase 3 divides in two. The Brazilian cluster runs through Larissa Fernanda Pereira Padilha, named as Meta beneficiary for Euro Summer Fest, Grand Theft Qatar and Qatar is Responsible; through Idezita Maria de Oliveira, Patrick de Oliveira Mendes, Cassio Hugo Carvalho Dias, Olimpio Lucas Pereira Silva, Tailine Ferreira Pinheiro, Laiza Cristina Carvalho de Oliveira, Social Media Para Empresa Ltda and Agência de Tráfego Pago Ltda as declared Google Ads advertisers on those campaigns and on Thanks Iran and Wedontwantyoutobewithus; and through Alemira on TikTok. The Kaufman cluster runs through a single Google Ads advertiser record, Liliane Kaufman, registered in Belgium and since delisted from the Ads Transparency Center, covering Qatar's Behind This, Qatari Christmas is here, The Silent Invasion, Islamic Terms You Need to Know, Q2B, Stop Qatar and Stoppons Le Qatar.

On Facebook the Kaufman cluster is held together by a declared beneficiary. Thirty-one advertisements across four page identities, Qatar's Behind This, Stop Qatar, Keep Qatar out and QATAR Awarness, name the beneficiary as "i don't no". Two of the four pages sit outside the Kaufman advertiser record, so the beneficiary string reaches further than the Google Ads field does.

No disclosure field on any platform names an entity common to the Brazilian and Kaufman clusters, and none links either to cluster A. The clusters are one operation on the evidence of narrative, tactics, techniques and procedures, and three separate components on the evidence of the disclosure records. The table below lists each connection across the clusters, and to the two potential links. Appendix D shows the payment chains.

In Phase 3 the Lebanon portion of the campaign was connected by shared ad infrastructure. Agencia de Trafego Pago LTDA hosted ads for both Euro Summer Fest and the Thanks Iran campaign, and also run via Brazil. A few days after we identified this the Lebanon ads disappeared, shortly before all advertisers disappeared.

14.3 Identities, names and items

Several phase-3 pages ran under names used earlier on different page IDs. Those are counted as one identity under the main name, with the underlying page IDs recorded in the workbook (phase 3: 15 page names, 14 identities once the two spellings of Euro Summer Fest are merged, on 23 public page IDs). For example, ‘Euro Summer Fest’ as a name, but the canonical ID changed multiple times. A platform identity is a page, channel or advertiser account as the platform identifies it. Capitalisation and spelling ‘variants’ are merged; in this edition, Euro Summer Fest, from "EURO Summer Fest" and "Euro Summer Fest". “Campaign” is used to describe all ads or content occurring within a specific identity across variants and platforms. For example, Euro Summer Fest consists of multiple YouTube ads, Facebook ads and TikTok ads, but will be described as one campaign.

An item is a single advertisement, video or post, deduplicated on the platform identifier where one is published: the ad-library ID in a Facebook link, the YouTube URL, the TikTok Ad ID. Every count is of distinct identifiers: 956 phase-one rows carry an ad-library link, 930 distinct IDs, and phase one contains 1,018 advertisements once the 26 repeated captures are collapsed; 444 phase-two and phase-three rows yield 442 distinct IDs; three rows on the Facebook sheets that are YouTube videos count on the YouTube sheet only; YouTube resolves to 189 distinct URLs and TikTok to 359 distinct Ad IDs. Where one ID was captured twice with different reach, the later, higher reading is kept and the two are not summed.

14.4 Archiving and preservation

Pages, advertisements and accounts disappeared throughout, sometimes within days of being recorded, so capture was treated as the point at which the evidence existed. Alongside it the project holds the creative that could be downloaded before it disappeared, still images and video organised by campaign with downloaded metadata. In some cases, disclosure panels, enforcement notices and transparency readings were screenshotted where the panel was itself the evidence, because Meta strips transparency data from a removed advertisement and withdraws a terminated page's data altogether, which is extremely unhelpful. We have downloaded all the YouTube and TikTok videos, and recorded a number of the Facebook videos, although there is overlap between the content. Parts of what follows can no longer be re-checked against the live web. Eight of the nine campaign websites are no longer registered (Section 6.4), and the engagement-monitoring tool behind Section 12 has been retired as it became too costly.

14.5 Reach, impressions and views

The platforms report different forms of engagement, reach, views, and impressions. Meta reports reach, the number of accounts served at least once by each advertisement, so a total is a sum of per-ad figures and not a count of distinct accounts; TikTok reports an advertiser-facing figure of the same broad kind; Ad Clarity, the commercial tracker, reports impressions, the number of times an advertisement was served (always the larger number). YouTube publishes view counts that mix organic and paid delivery inseparably, and count a Shorts view when playback starts, so a public view is neither a completed nor a billable view; the TikTok account’s views are of the same kind. Not every Facebook figure in the Reach column is reach: 16.4 million, on 181 rows, was transcribed from the advertisement's own impressions band and is an impression figure, and 3.7 million, on 100 phase-one rows the tracker did not cover, is an analyst estimate. The composite total mixes all four and is given as exposures: recorded deliveries in mixed units, not people. Section 9.2 gives the composition: 52% impressions, 22% reach, 26% YouTube and TikTok account views (278.1, 116.6 and 137.9 million of 532.6 million; the impressions are 261.8 million from the tracker and 16.4 million from impression bands).

14.6 Four tiers of confidence

Spend and exposure are reported in four tiers, from what the public archives record to what a model projects.

• Public archive total. What the platforms' own archives publish. 305 million exposures, which price at $3.70 million at the tracker’s CPM with YouTube views at $0.02 each. The archives themselves publish spend for 268 advertisements, $98,000 to $135,000.
• Recorded. The above with tracker impressions substituted for the 18 page identities the tracker covered under 17 tracker labels, 17 in phase 1 and one in phase 2: 533 million exposures, $5.08 million at the same rates. This is the figure to cite for the recorded and documented numbers.
• Estimated. Recorded, with archived reach converted toward impressions at the scenario rate of 1.0 to 1.5 impressions per account, 1.5 being about the reach-weighted average of the 66 rows that declare both (median 1.29, highest 2.25), not their maximum: 533 to 555 million, $5.08 to $6.54 million, the top with YouTube at $0.03 a view.
• Projected. Recorded, with the archived reach the tracker did not cover scaled by the tracker-to-archive ratio of 7.72, on the assumption that the advertising the tracker did not cover was undercaptured by the archive, and differed between reach and impressions, as much as the advertising it did: up to 831 million exposures and $8.22 million, with YouTube at $0.03 a view.

The projected tier is a modelled estimate, not a measurement. Section 9.4 sets out each step and Section 9.3 why the factor is used only for that scenario and not as a correction to the recorded total.

Spend follows the same tiers. The recorded figure prices Facebook and TikTok exposure at a single blended $6.09 CPM, set largely by one page's United States buying, and YouTube views at $0.02 each; at the tracker's rate excluding that page, $4.11, the dollar figures fall by 9 to 17 per cent. Advertising is also not the whole outlay: production in five languages, hosting, corporate formation in three jurisdictions, billboards, a conference screening and staged events are real costs that we are not party to. Total operational cost is unknown and higher than the advertising figure by an unquantified margin. The known unknowns, if you will. We should also factor in elements of the campaign we have not detected, both on and offline.

14.7 Levels of attribution

Four kinds of claim, in ascending order:

• Observed relationship. A disclosure, filing, IP record or account history directly records something: e.g. Meta's beneficiary field naming LT Media; a Brazilian company as a Google Ads advertiser; an Israeli address in a Wikipedia edit log, metadata from Telegram pointing to specific devices.
• Operational linkage. Assets connected through shared infrastructure, payment, accounts or reuse, placing campaigns in one operation without identifying anyone.
• Supplier or intermediary. A party that provided a service: an advertising proxy, a company whose account placed the buys, a PR firm that issued a release.
• Ultimate client. Who commissioned, directed or funded the operation.

The ultimate client remains unknown. We know suppliers or intermediaries. These include a Vietnamese proxy, the German TikTok advertiser strings, the Brazilian ad accounts, the Belgian ad accounts, the Israeli IP evidence, the Wikimedia accounts, and the United States connection in Section 7.1, which is a documented handling of campaign material rather than a payment record. A supplier, payer, company officer or IP address does not identify a client. This report characterises no individual's knowledge or intent. The Telegram metadata also points confidently to Israel-based production.

14.8 How the content was coded

We also analysed reactions to the content where possible, mostly by analysing Facebook and YouTube comments on operational material.

Creative themes. 117 creative units (advertisement images, page branding, video thumbnails and one physical placement) and 173 of the 189 YouTube videos were each coded to one primary theme from a fixed vocabulary of 20, with secondary themes, persuasive techniques, language and intended audience recorded alongside. Codes about the Qatari state include "Sportswashing pressure", "Qatar as funder", "Demonisation of Qatari leadership" and "Gulf isolation of Qatar"; codes about Muslims, migrants and demographic change include "Islamisation of Europe", "Great Replacement", "Islam as inherent threat", "Migrant crime and disorder", "Christian identity under threat" and "Qatar funding migration". An item entered the second group only where the creative itself framed Muslims or migrants as a demographic, civilisational or religious threat; criticism of Qatar was never coded as Islamophobic. "Islamisation of Europe" is the largest theme in both sets, 75 of 173 videos and 23 creative units, with "Migrant crime and disorder" next in the video corpus at 18.

Comment stance. The 406 UK comments in Section 12 were coded for stance with model assistance and cross-validated by a human coder during the 2024 investigation. The 2,560 YouTube comments of Section 12.1 were read by an AI agent (Claude, Anthropic) working as a single coder in September 2026, against the scheme in the comments workbook. On 21 October 2026 the 227 comments first coded as opposing whose only content was a remark on AI generation or the paid placement were read again by the same means: 64 reject the message and stay opposing, and 163 take no position and were moved to neutral, keeping their flags. The decision on each is recorded in data/youtube_comment_recode_2026-10-21.csv [ask authors].

14.9 Languages

The corpus runs in English, Arabic, French, German and Italian. Of 141 coded creative records, 94 are English and 30 Arabic; the rest are French, Italian, German and mixed. Arabic page names are reproduced in the original and listed in Appendix A; where the typeface cannot render them, figures label those pages by language.

14.10 Sources

The sources used were as follows:

Public ad archives retain only what was still live when they were scraped, so every archive-derived figure covers only what was captured. Availability is patchy, partly because reporting requirements on the platforms differ between jurisdictions, partly because the archives themselves have time limits. Section 9 quantifies the effect where it can be quantified, and Section 13 lists what it cannot.

Appendix A. Every page identity, channel and advertiser

Archived reach is the platform-reported figure where the ad archive published one. It is not always one: 395 of the 1,018 phase-one advertisements carry an analyst estimate of 36,988 rather than a platform figure, amounting to 35.9% of all phase-one archived reach. Pages marked † are majority-estimated on this basis, and their reach should be read as an order of magnitude rather than a measurement. Thirteen of the imputed rows also carry an Ad Library audience-size figure of over one million, which is potential audience rather than reach and is not counted. For pages covered by the commercial tracker, the tracker’s impression figure is substantially higher.

Appendix B. Quantities and provenance

Quantities come from two places. Computed figures are generated directly from the investigation workbook. None are transcribed manually, so refreshing the source data and regenerating updates every one of them. Cited figures are quantities established by the prior published investigation, reproduced here because the activity they measure was never entered into the advertising workbook.

Page identities are merged across capitalisation variants of the same name, so a page whose name was recorded inconsistently counts once. Merged in this edition: Euro Summer Fest (EURO Summer Fest, Euro Summer Fest).

Appendix C. Cited source

The Qatar Plot, Sohan Dsouza and Marc Owen Jones, July 2024 (v1, 7 July 2024; 77 pp.). Published under CC BY-SA. https://web.archive.org/web/20260211134056/https://sites.google.com/view/theqatarplotreport/report

Sections 5 to 8 of this report, and the phase-one quantities marked “Cited” in Appendix B, draw on that investigation, which documented the operation’s Twitter/X, Wikimedia, Change.org and Telegram activity, its proxy infrastructure, and the audience response to its advertising. This report extends that work across phases 2 and 3 and re-bases the advertising figures on a larger archive.

Appendix D. The entity chain

The recorded links form a supply chain: the individuals and firms named in corporate registries and platform disclosures, then the funding, advertiser and beneficiary accounts that placed the buys, then the campaigns those accounts paid for. Three national clusters run through it, each behaving differently (Figures 84 to 86). The Vietnamese cluster is the widest: it supplies the sponsor-page infrastructure behind 9 phase-one campaigns, and on two of them Meta’s beneficiary field names the proxy itself. The Brazilian and German accounts converge on the phase-three campaigns, several paying into the same campaign as each other, and the Arabic-language campaign chains onward to two further ones. The United States connection, JDA Worldwide, is set out in Section 7.1 and is not part of this chain: no payer, advertiser or beneficiary field records it, and the chain is built from recorded links only.

The chain also ends, at the top, in an entity we cannot identify. Everything documented here describes the machinery and the people who operated parts of it. Named individuals and corporations appear in this chain because they are recorded as company officers, listed payers, declared beneficiaries or advertisers in registries and platform disclosures.

Appendix E. Campaign abbreviations

Campaign abbreviations used in the cited source and occasionally retained here: DFQ, “Don’t Fund Qatar”; DLL, “Défendons la laïcité”; DD, “Doha Dirt”; EF, “Europe First”; IIYH, “It’s In Your Hands”; LVDP, “Le vestiaire du PSG”; MIQ, “Made in Qatar”; NFQ, “Ne Financez pas le Qatar”; PVE/TPAE, “Plot vs Europe” / “The Plot Against Europe”; QS, “Qatarsis”; SLL, “Sauvons le Liban”; SOQ, “Shame on Qatar”; TQP, “The Qatar Plot”; YHTP, “You Have The Power”.

Notes

1. Exposures: a recorded composite total of ad deliveries, including some estimates, combining tracker impressions, archive-reported reach (unique people), and YouTube view counts; units are mixed and not interchangeable, so the figure understates total ad views. ↩
2. It includes 3.7 million of reach estimated by the analysts for 100 phase-one advertisements that the platform published no figure for; without them it is 528.9 million. ↩
3. Ad Clarity exports, 55 reports. Every page report is filtered to “Social, All devices” and lists facebook.com as 100 per cent of placements. The only video reports are for itsinyourhands24.com: United States 711,701 impressions (FanSided 44 per cent, youtube.com 19 per cent), Spain 160,476, the Netherlands 145,286 and South Africa 1,356, about 1.02 million in all, or 0.4 per cent of the 261.8 million. ↩
4. See https://web.archive.org/web/20260727101054/https://cibdashboard.netlify.app/ ↩
5. The rows outside the workbook are the 60 items of sections 4.3, 4.5 and 4.6. The 22 of Section 4.3, three 2024 Meta advertisements and the 2025 YouTube channel of لا للإحتلال الإيراني, belong to a brand Meta named in its takedown and are added to the spend in the row below them. The 38 of MLGA and Al Ghaliboun are potential links and are added to no total. Exposure is YouTube views and Meta impressions as published by the platforms, ARIJ and Misbar. Spend is the Meta Ad Library ranges where they exist and otherwise exposure at $4.11 per thousand in the recorded column and $6.09 in the projected column, the two rates Section 9 uses; the per-view YouTube price of the main model is not applied to them. ↩
6. Shares are of the recorded total. The Facebook row is the archived reach on the pages that the commercial tracker did not cover: 7,109,501 in phase 1 (9 pages), 4,173,089 in phase 2 (23 pages) and 49,479,306 in phase 3 (15 pages). 16,361,392 of it, on 181 phase-two and phase-three rows, was transcribed from the advertisement’s own impression band (Section 14.5) and sits in the impressions column. The tracker row replaces, rather than adds to, the archived reach of the 17 pages it covered, 16 in phase one and one in phase two; that displaced reach is the first memo line, and adding it to the Facebook row gives the 94,679,727 Facebook reach cited in the executive summary. The second memo line is the public-archive total of Section 14.6, 305 million. Impressions, reach and views are not interchangeable and the total is not a count of people; Sections 14.5 and 9.2 set out the consequences. The last three lines cover material outside the workbook, with Meta impressions from the Ad Library ranges at their midpoints and YouTube views as published by the platforms, ARIJ and Misbar. The No to the Iranian Occupation advertising and YouTube channel of Section 4.3 belong to a brand Meta named in its takedown and are added in the line below them. MLGA and Al Ghaliboun (Sections 4.5 and 4.6) are potential links whose connection rests on method and one currency, not on a payer record, and are added to no total. ↩
7. 189 YouTube videos delivered more reach than 1,473 Facebook ads. TikTok combines the reach of 359 advertisements with the views of the No to the Iranian Occupation account’s 105 videos. ↩
8. The same exposures as Figure 1, placed in the year each item first ran. Facebook carries 2023 and 2024 on its own; YouTube arrives in 2025 and TikTok scales in 2026. Items are dated by first appearance; 11 of the 2,126 carry no usable date and are left out, and 2026 runs to October, where the archive ends. ↩
9. Of the 2,126 recorded items, 11 carry no usable date and 2,115 do. Ten of those 2,115 bear an implausible January 2023 date on a page created later and are excluded, leaving 2,105 plotted. The No to the Iranian Occupation account’s TikTok videos are their own hatched series from August 2025. The rule across the top is that brand’s own run, November 2023 to the month of writing: solid where the ad archive holds it, its first advertisement and its TikTok account, dotted between. Its unarchived items, three 2024 advertisements and the 19 videos of its removed YouTube channel, are drawn as hollow bars spread flat over their documented windows, since no per-item dates survive; its X account, re-registered in September 2024 and posting from October 2024, is posts rather than items and is drawn as a rule from the month posting began, with a marker at registration. The dotted bars are the operation’s own Telegram channel, t.me/MadeInQatar24: 86 posts between May and November 2024, unpaid distribution that is not counted in the 2,126 and is drawn because it shows the autumn 2024 silence to be the Facebook advertising’s rather than the operation’s. The cross-hatched bars are 118 posts from the Qatarsis and IslamistWeb accounts, IslamistWeb being The Qatar Plot renamed, running to 5 February 2025; they are not counted in the 2,126 either. The one dashed rule left is the No to the Iranian Occupation X account, which is not archived. Between them the operation is observable without a break from October 2023 to February 2025: the advertising archive is empty for seven months from January 2025, and the months with nothing recorded anywhere are the five from March to July 2025 (Section 4.3). ↩
10. Bar length is months live, shading is the number of archived items (advertisements and videos) and the figure at right is the same count. Spans are taken from the curated project timeline, not computed from the ad archive, so a bar can run past the last advertisement the ad archive holds for that campaign. The counts beside the bars are computed from the archive, so where a curated span had fallen behind the workbook it has been brought forward to the last archived item rather than left where it was typed. The Qatar Plot is the case to watch: its row runs to February 2025 because its X account carried campaign content until 5 February, while the 52 items shading the bar are advertisements that stop in June 2024. A red dotted run continues each YouTube campaign to October 2026, because Google stopped serving the advertisements but the promoted videos remain online. Two campaigns are exceptions and carry no such run: Qatarsis, whose videos were removed, and No to the Iranian Occupation, whose channel was removed around the time Make Lebanon Great Again appeared (Section 4.5). No to the Iranian Occupation is one row from its first archived advertisement in November 2023 to September 2026: the archived stretches, that advertisement and its TikTok account from August 2025 to its capture on 20 September 2026, are solid, and the black dotted run between them covers three 2024 advertisements, an X account and a YouTube channel that are not in the ad archive (Section 4.3). Seven campaigns whose names are wholly in Arabic are labelled by language and row number, because the report typeface cannot render the script; their names appear in Appendix A. A campaign named in both languages keeps its English name. ↩
11. Circle area is recorded exposure delivered to each country, 520 million across 28 countries, booked to the country each item targeted; lines run from each payer’s recorded location to the countries its advertising named, thickness by placements. Europe is enlarged in the inset. ↩
12. Facebook, YouTube and TikTok together, counted one placement per target country named: 1,840 items carrying a targeting field give 2,748 placements. A further 286 items carry no targeting field and are excluded, as are the 13 countries the tracker alone recorded. ↩
13. Combines commercial tracker impressions for the pages the tracker covered with archived reach and YouTube views for the rest. The ranking by audience is close to the reverse of the ranking by placement count in Figure 6. YouTube views are allocated to the target country of each video, an assumption, since YouTube publishes no viewer location. Units are mixed, as Sections 14.5 and 9.2 set out. ↩
14. Every count in this section is of placements, meaning one item-country pair, so an advertisement naming three target countries contributes three. 1,840 of the 2,126 recorded items carry a targeting field and resolve to 2,748 placements. The other 286 carry none and are left out entirely, as are the 13 countries recorded only by the commercial tracker. A country total here is the number of placements the archive could see, which is a different thing from how much of the operation's content reached that country's audience, and should not be read as a full account of where the operation went. ↩
15. French buying runs from January and is spent by late May; the UK spike falls in the fortnight before the election was called on 22 May. Placement does not stop at the vote. ↩
16. The burst opens in Lebanon: 185 of Lebanon’s 206 placements in the window fall in the two weeks from 22 June, about seven weeks after the May elections were postponed. Only May carries no paid placement; its eight dated items are the No to the Iranian Occupation account’s videos. March and April hold 760 TikTok placements and 15.8 million of reach between them, 615 of them in March, while Facebook and YouTube carry nothing from March to May. A TikTok advertisement aimed at several countries counts once for each. Lebanon is the dark grey band. The pale grey Other band holds the smaller targets, among them Switzerland and the Netherlands, and the No to the Iranian Occupation account’s videos, which record no target country. ↩
17. Birmingham City Council, “Sparkhill ward results 2026”, https://www.birmingham.gov.uk/info/50385/election_2026_-_results_by_ward/3249/sparkhill_ward_results_2026. ↩
18. Felix Pope, “The Birmingham council candidate who was jailed for terrorism”, New Statesman, 26 April 2026, https://www.newstatesman.com/politics/uk-politics/may-2026/2026/04/the-birmingham-council-candidate-who-was-jailed-for-terrorism; Paul Carey, “Yemen terror plot past of independent candidate in UK local elections”, The National, 29 January 2026, https://www.thenationalnews.com/news/uk/2026/01/29/shahid-butt-yemen-terror-uk-elections/; “Britons in Yemen complete jail term”, Al Jazeera, 24 December 2003, https://www.aljazeera.com/news/2003/12/24/britons-in-yemen-complete-jail-term. Butt was sentenced to five years in Yemen in 1999; he says his confession was obtained under torture. ↩
19. Q2B (“Qatar’s 2 Blame”), YouTube Shorts uploaded 10 February 2026 by the Liliane Kaufman channel, UK-targeted: https://www.youtube.com/shorts/_xdIwtRno88 (57 seconds, 193,166 views) and https://www.youtube.com/shorts/CMJpOREmVX4 (20 seconds, 221,617 views); copies in the project files. Both show Butt in a mugshot captioned “convicted terrorist” over an ITV News headline; the longer cut pairs him with Abu Hamza, says “they want to take over the UK” and ends “Now you know, Qatar is Islamising England!”. ↩
20. Facebook, YouTube and TikTok together. A month band counts items under their first-listed target country rather than placements, because the ad archive records no split to apportion a multi-country buy by month. The six most targeted countries are named and the remainder grouped. 286 items carry no targeting field and are excluded. ↩
21. Each panel has its own scale and unit: Facebook counts accounts served, YouTube views and TikTok unique users. Removed TikTok advertisements are returned to the advertiser whose business-id listing they sit on. The Facebook volume ranking differs, as the text above sets out. Arabic-language pages are labelled by language because the report typeface cannot render the script; their names appear in Appendix A. ↩
22. Each mark is one archived item at the date it first ran, 2,021 Facebook advertisements, YouTube videos and TikTok advertisements in all: the 34 brands with the most recorded exposure by name, the remaining 42 identities together. Mark area is recorded reach or views, shape is the platform and colour the theme; a TikTok advertisement takes its theme from its caption or archived cover, as in Figure 47, and is hollow where neither shows it. ↩
23. https://web.archive.org/web/20250811184137/https://today.lorientlejour.com/article/1467903/whos-behind-the-make-lebanon-great-again-videos-and-ads.html ↩
24. https://archive.ph/RqA0o, checked 13 September 2026: 12.6K posts, 10.5K followers, 9,684 following; X's "About this account" panel shows it joined in September 2024, is based in Lebanon, was verified since January 2026, and made one username change. The account ID (1839272700952383488) dates creation to 26 September 2024. Meta's Q2 2024 Adversarial Threat Report lists the earlier handle, twitter.com/lallihtilalalir, in its appendix of LT Media network indicators. ↩
25. Charbel El Khoury and Khuzama Makarem, حملة إلكترونية ترّوج للسلام مع إسرائيل ونزع سلاح حزب الله بفيديوهات مفبركة لسياسيين ومسؤولين في لبنان, ARIJ with Manateq and Raseef22, 21 August 2026, https://web.archive.org/web/20261009092706/https://arij.net/investigations/lebanon-coordinated-influence-campaign-hezbollah-fabricated-videos/. The YouTube figures for لا للاحتلال الإيراني (channel launched 13 January 2025, 19 videos, about 3.5 million views) are ARIJ's, drawing on an earlier investigation by the same author. ↩
26. https://web.archive.org/web/20250824031607/https://www.tiktok.com/@lalihtilalalir, checked 13 September 2026: 7,926 followers, 74.8K likes, oldest video 18 August 2025, pinned videos at 1M and 577K views. TikTok's suggested accounts on the profile included MLGA (@mlga10452); suggestions are drawn from co-follow graphs and are a weak signal. ↩
27. Charbel El Khoury and Khuzama Makarem, حملة إلكترونية ترّوج للسلام مع إسرائيل ونزع سلاح حزب الله بفيديوهات مفبركة لسياسيين ومسؤولين في لبنان, ARIJ with Manateq and Raseef22, 21 August 2026, https://web.archive.org/web/20261009092706/https://arij.net/investigations/lebanon-coordinated-influence-campaign-hezbollah-fabricated-videos/ ↩
28. Meta, Adversarial Threat Report, Second Quarter 2024, August 2024, https://web.archive.org/web/20261009094822/https://transparency.meta.com/sr/Q2-2024-Adversarial-threat-report/, appendix (threat indicators for the LT Media network). ↩
29. https://archive.ph/RqA0o, checked 13 September 2026. Creation date from the account ID and from X's "About this account" panel (joined September 2024, based in Lebanon, one username change). ↩
30. Misbar editorial team, مسبار يكشف حملة دعائية منظمة استهدفت لبنان من بلجيكا, 11 July 2025, https://web.archive.org/web/20250805172059/https://www.misbar.com/editorial/2025/07/11/%D9%85%D8%B3%D8%A8%D8%A7%D8%B1-%D9%8A%D9%83%D8%B4%D9%81-%D8%AD%D9%85%D9%84%D8%A9-%D8%AF%D8%B9%D8%A7%D8%A6%D9%8A%D8%A9-%D9%85%D9%86%D8%B8%D9%85%D8%A9-%D8%A7%D8%B3%D8%AA%D9%87%D8%AF%D9%81%D8%AA-%D9%84%D8%A8%D9%86%D8%A7%D9%86-%D9%85%D9%86-%D8%A8%D9%84%D8%AC%D9%8A%D9%83%D8%A7. Misbar spells the advertiser "Victore Wilde"; the Ads Transparency Center record reads "Victor Wilde". ↩
31. Google Ads Transparency Center, advertiser AR08101858030355742721, https://web.archive.org/web/20260608150144/https://adstransparency.google.com/advertiser/AR08101858030355742721?region=LB, retrieved 13 September 2026. ↩
32. "Those AI ads on Youtube", r/lebanon, 12 September 2025, https://web.archive.org/web/20261009094844/https://www.reddit.com/r/lebanon/comments/1nf78j8/those_ai_ads_on_youtube/?solution=0d5154d1214b77cd0d5154d1214b77cd&js_challenge=1&jsc_token=2824be10929bdc604753c70a67a1c3312b81a3016c22471a937fb9d240a85920&jsc_orig_r=. The Claes panel is the post image (https://web.archive.org/web/20261009092826/https://www.reddit.com/media?url=https%3A%2F%2Fi.redd.it%2Fi65p8wp6crof1.jpeg); the Vergottini/Meyer panel is a commenter's image (https://web.archive.org/web/20261009094916/https://www.reddit.com/media?url=https%3A%2F%2Fpreview.redd.it%2Ffe8oipq4mtof1.jpeg). Both are photographs of YouTube's "About this advertiser" panel and the names are transcribed from them. ↩
33. Searches of the open web, Reddit and X for "Ethan Claes", "Vergottini", "Warre Meyer", "Liliane Kaufman" and "Victor Wilde", run 14 September 2026, returned no advertising-related record for any of them outside the r/lebanon thread and this investigation. ↩
34. Meta Ad Library, page 940208189165617, https://www.facebook.com/ads/library/?view_all_page_id=940208189165617&country=ALL&active_status=all (live record; Meta’s Ad Library cannot be archived), Library ID 841930588640929, retrieved 13 September 2026. ↩
35. Lebanon PM's office: AI generated video of Nawaf Salam is fake, LBCI, https://web.archive.org/web/20261009095002/https://www.lbcgroup.tv/news/lebanon-news/938682/lebanon-pms-office-ai-generated-video-of-nawaf-salam-is-fake/en ↩
36. ARIJ, 21 August 2026 (cited above): 28 MLGA YouTube videos with about 8.1 million views during the monitoring period; 49 million post views on X across 1,010 posts, May 2025 to May 2026; paid-view cost estimated at $24,300 to $121,500 at $0.003 to $0.015 per view. ↩
37. Misbar, 11 July 2025 (cited above): 23 paid ads between 18 May and 5 July 2025; individual videos approaching one million views in Lebanon; one 800,000-view ad priced at $1,646 to $4,115. Meta figure: Ad Library, ad 841930588640929, retrieved 13 September 2026. ↩
38. The airport-road billboards of episode 01, the cleric cut-out of episode 06, the Iranian flag as an awning in episode 08, and the title card that closes every episode. Frames from the archived videos. ↩
39. Recorded, Al Ghaliboun stands at 28.4 million YouTube views and more than one million Meta impressions, on $2,000 to $2,700 of recorded Meta spend. The YouTube views price at $174,100 at $6.09, $117,500 at $4.11, or $85,000 to $426,000 on ARIJ's Lebanese rates. The July Meta ad's own price, more than a million impressions for at most $2,500, is a CPM of $2.50 or less, well under the blended rate, so for Lebanese inventory the $6.09 figure is more likely to overstate cost than to understate it. No projection is made beyond the snapshot: the channel and three of its ads were live when captured, and the next capture will be higher. Lebanon Reborn, the one-video #MLGA channel of the same week, had 1.99 million views and is not added to these totals.^# None of this is in the operation's totals in section 9. ↩
40. YouTube channel UCyzyAi62-oBQ0DNjQZ3h-gQ (@آلغالبون-ك7ل), captured 13 September 2026 with yt-dlp: 28,397,421 views, 693 likes and 160 comments across six videos (episodes 01, 03, 05, 06, 07, 08; 02 and 04 are not on the channel), 1,480 subscribers. Archive average from the 189 videos and 132.2 million views in Appendix A. ↩
41. Meta Ad Library, pages 1148241098379379, 1128770713662948 and 103413362079918, captured 13 September 2026: ads 4161572710806996 (2 to 8 July 2026, >1M impressions, $2K–2.5K), 2058377191720910 (6 to 7 July, active one hour, 10K–15K, <$100), 1355305033382265 (6 to 7 August, active under one hour, 4K–5K, <$100), all removed under Meta's rules on social issues, elections and politics; 1046000214940396, 1254154111122854 and 1616668766636807 launched 12 September 2026 with no figures yet. Lebanon Reborn: https://archive.ph/h4OXl, 1,990,000 views on 13 September 2026. ↩
42. Hezbollah statement, 15 June 2026, reproduced by LBCI, https://web.archive.org/web/20261009095118/https://www.lbcgroup.tv/news/940436/ar, and Lebanon Debate, https://web.archive.org/web/20261009095157/https://www.lebanondebate.com/article/848411-%D8%AD%D8%B2%D8%A8-%D8%A7%D9%84%D9%84%D9%87-%D9%81%D9%8A-%D8%A8%D9%8A%D8%A7%D9%86-%D9%86%D8%A8%D8%A7%D8%B1%D9%83-%D9%84%D8%A5%D9%8A%D8%B1%D8%A7%D9%86-%D8%A7%D9%84%D8%AA%D9%88%D8%B5%D9%84-%D8%A5%D9%84%D9%89%D9%89-%D8%AA%D9%81%D8%A7%D9%87%D9%85-%D9%85%D8%B9-%D8%A7%D9%84%D9%88%D9%84%D8%A7%D9%8A%D8%A7%D8%AA-%D8%A7%D9%84%D9%85%D8%AA%D8%AD%D8%AF%D8%A9-%D8%A3%D9%81%D8%B6%D9%89-%D8%A5%D9%84%D9%89-%D9%88%D9%82%D9%81. The party congratulated “the Islamic Republic of Iran, leadership and people” on “the great achievement” of the memorandum of understanding with the United States that produced a comprehensive ceasefire including Lebanon, and stated that Iran had insisted Lebanon be present in any understanding ending the war. This establishes the 15 June statement quoted in the text. The 9 June statement is reported in “Hezbollah thanks Iran for attack on Israel, urges Lebanon to ‘correct’ ties with Tehran”, L’Orient Today, 9 June 2026, https://today.lorientlejour.com/article/1537619/hezbollah-thanks-iran-for-attack-on-israel-urges-lebanon-to-correct-ties-with-tehran.html, and “حزب الله يدعو السلطة اللبنانية إلى «تصحيح العلاقة» مع إيران”, Al Jazeera, 9 June 2026, https://www.aljazeera.net/news/2026/6/9/%d8%ad%d8%b2%d8%a8-%d8%a7%d9%84%d9%84%d9%87-%d9%8a%d8%af%d8%b9%d9%88-%d8%a7%d9%84%d8%b3%d9%84%d8%b7%d8%a9-%d8%a7%d9%84%d9%84%d8%a8%d9%86%d8%a7%d9%86%d9%8a%d8%a9-%d9%84%d8%aa%d8%b5%d8%ad%d9%8a%d8%ad. Hezbollah called Iran’s missile strike of 7 June “a message of moral, political and field commitment from Iran towards Lebanon” and said Iran’s stance “deserves gratitude from the authorities”. ↩
43. “Lebanese display banners lauding Iran’s support for end to Israeli aggression on Lebanon”, Press TV, 21 June 2026, https://web.archive.org/web/20260625223232/https://www.presstv.ir/Detail/2026/06/21/770841/Lebanese-display-banners-hailing-Iran; “‘Thank You, Iran’? Airport road billboards spark debate over sovereignty and Lebanon’s future”, Now Lebanon, https://web.archive.org/web/20261009102648/https://nowlebanon.com/thank-you-iran-airport-road-billboards-spark-debate-over-sovereignty-and-lebanons-future/; “Khamenei posters expose struggle over who owns Lebanon’s ceasefire”, Iran International, 26 June 2026, https://web.archive.org/web/20260702123850/https://www.iranintl.com/en/202606263525. The reporting gives the slogan as “Thank you, loyal Iran” (شكراً إيران الوفية). The portraits are of Ali Khamenei, assassinated on 28 February 2026, and his son and successor Mojtaba Khamenei, supreme leader since 9 March 2026. ↩
44. Paula Astih, Asharq Al-Awsat, republished as “«لا نريد الحرب»: لوحات على الطرقات لتفادي الأسوأ”, Trend Lebanon, 15 November 2023, https://web.archive.org/web/20261009092950/https://www.trendlebanon.com/lebanon/20379/. The campaign ran on billboards and by SMS under the slogan لبنان لا يريد الحرب. Ghina al-Khazen, described as the head of an advertising company in the Gulf and one of the organisers, said the campaign was financed by “a group of young Lebanese men and businessmen who want political, military and security stability, from all Lebanese regions”. ↩
45. “شعارات «بيكفّي - تعبنا» و«ما بدنا حرب» تنتشر في لبنان... ولا أحد يتبنّاها”, Asharq Al-Awsat, https://web.archive.org/web/20261009093242/https://aawsat.com/%D8%A7%D9%84%D8%B9%D8%A7%D9%84%D9%85-%D8%A7%D9%84%D8%B9%D8%B1%D8%A8%D9%8A/%D8%A7%D9%84%D9%85%D8%B4%D8%B1%D9%82-%D8%A7%D9%84%D8%B9%D8%B1%D8%A8%D9%8A/5049526-%D8%B4%D8%B9%D8%A7%D8%B1%D8%A7%D8%AA-%D8%A8%D9%8A%D9%83%D9%81%D9%91%D9%8A-%D8%AA%D8%B9%D8%A8%D9%86%D8%A7-%D9%88%D9%85%D8%A7-%D8%A8%D8%AF%D9%86%D8%A7-%D8%AD%D8%B1%D8%A8-%D8%AA%D9%86%D8%AA%D8%B4%D8%B1-%D9%81%D9%8A-%D9%84%D8%A8%D9%86%D8%A7%D9%86-%D9%88%D9%84%D8%A7-%D8%A3%D8%AD%D8%AF. The report gives the slogans as «بيكفّي - تعبنا» and «ما بدنا حرب», says the campaign remained of unknown identity (مجهولة الهوية), and is the source of the characterisation quoted here: it calls the slogans «يتيمة الأب», fatherless, because neither the opposition forces nor the civil organisations and associations adopted them. Undated on the page; the surrounding events place it in August 2024. ↩
46. Press TV, 21 June 2026, and Now Lebanon, both cited above. ↩
47. MTV Lebanon, “شكراً إيران”, https://web.archive.org/web/20261009095232/https://www.mtv.com.lb/news/1707368, and the newscast item “شكراً إيران، لافتاتٌ غطّت طريقَ المطار”, 25 June 2026, https://web.archive.org/web/20261009093109/https://www.mtv.com.lb/newscast/260410/446535. MTV’s inversion runs “thank you to the victimised South, thank you to the destroyed villages, thank you to the child soldiers”. ↩
48. “‘Lebanon first’ billboards replace ‘Thank you, Iran’ signs on the road to Beirut airport, and set on fire”, L’Orient Today, https://web.archive.org/web/20260828062504/https://today.lorientlejour.com/article/1539595/lebanon-first-billboards-replace-thank-you-iran-signs-on-the-road-to-beirut-airport-and-set-on-fire.html; MTV Lebanon, “بالصّور: لبنان بدل شكراً إيران”, https://web.archive.org/web/20261009095310/https://www.mtv.com.lb/news/1711670. The replacements read “Lebanon first” and “Lebanon unites us”, and were partially burned overnight on 27-28 June. ↩
49. حملةإلكترونيةترّوجللسلاممعإسرائيلونزعسلاححزباللهبفيديوهاتمفبركةلسياسيينومسؤولينفيلبنان Clips by account, from the twittervid.com filenames in each video’s Adobe XMP, with the caption burned into the operation’s version. @RadioGenoa, all rendered 23 May 2024: “Cultural enricher molests defenseless woman in Spain and no one intervenes”; “Terrified Italian girl: ‘I was chased in Milan by two Arab immigrants who wanted to rape and rob me.’”; “Muslim cultural enricher tears down cross in London church”; “Dutch police raze Hamas supporters’ camp at Amsterdam University”; “‘I’ll burn everything!’ The African ‘asylum seeker’ in Italy is very angry so he sets fire to a petrol station”; “The religion of peace and love in London”; “African ‘asylum seeker’ strangles a female supermarket employee in Spain”; “London has lost its identity”; “The usual suspect in UK attacks a security officer who reacts promptly”; “German police educate violent Muslim immigrants”; “Pro Palestine march in Pisa stopped by Italian police”; and one with no caption layer. @ZemmourEric, 23 May 2024: “Tous les jours, le niveau de violence dans nos rues augmente un peu plus.” @24hPujadas, 19 April 2024, in chapter 3 of the “Europe” documentary series. @TRobinsonNewEra and @EuropeInvasionn, 12 August 2024, in the London Stock Exchange and Grand Hotel Paris asset-ownership shorts. @ABC, 10 September 2024, in two segments on Hezbollah and Qatar’s relations with Iran. RadioGenoa’s posts of 1 January 2024 as embedded in The Gateway Pundit, January 2024, https://web.archive.org/web/20240305221025/https://www.thegatewaypundit.com/2024/01/italy-fallen-milans-duomo-occupied-invaders-as-young/. ↩
50. 359 advertisements, one dot each at the date first shown; dot area is proportional to recorded reach and colour shows the theme. The theme is read from the caption where it names the subject (the Iran captions, Euro Summer Fest, Grand Theft Qatar, Qatar is Responsible and the two flight captions) and otherwise from the archived cover, coded one by one (data/tiktok_creative_themes.csv). Seventy advertisements whose caption is generic and whose cover is lost or shows no subject are drawn hollow. @away.fromus and the one شكرا ايران advertisement are coded Iran / Lebanon by their account and caption. The No to the Iranian Occupation account is excluded. ↩
51. https://web.archive.org/web/20260525064615/https://www.france24.com/en/live-news/20240708-shadow-campaign-global-influence-op-targets-qatar-in-wartime ↩
52. https://web.archive.org/web/20260525064615/https://www.france24.com/en/live-news/20240708-shadow-campaign-global-influence-op-targets-qatar-in-wartime ↩
53. https://web.archive.org/web/20260525064615/https://www.france24.com/en/live-news/20240708-shadow-campaign-global-influence-op-targets-qatar-in-wartime ↩
54. https://web.archive.org/web/20260818080514/https://allarab.news/us-pageant-models-call-out-human-rights-abuser-qatar-for-not-helping-to-free-israeli-hostages/ ↩
55. https://web.archive.org/web/20201021154911/https://allarab.news/advisors/ ↩
56. https://web.archive.org/web/20250717003223/https://allisraelnews.com/impact-report ↩
57. https://web.archive.org/web/20251104100027/https://allisraelnews.com/writer/johnnie-moore ↩
58. https://web.archive.org/web/20240404234458/https://allarab.news/us-pageant-models-call-out-human-rights-abuser-qatar-for-not-helping-to-free-israeli-hostages/ ↩
59. https://web.archive.org/web/20240502174439/https://allarab.news/us-pageant-models-call-out-human-rights-abuser-qatar-for-not-helping-to-free-israeli-hostages/ ↩
60. https://web.archive.org/web/2/https://catholicvote.org/miss-usas-against-qatar-affiliated-fashion-designers/ ↩
61. https://t.me/madeinqatar24 ↩
62. Taken from the Adobe timestamps embedded in the 78 videos recovered from the operation’s Telegram channel. Friday is empty, and the single Saturday mark is the one file in the corpus that was recycled rather than produced. The working week is the strongest single indicator of where the work was done, and it does not depend on reading any drive label. ↩
63. “נחש אותי נחש”, Hebrew Wikipedia, https://web.archive.org/web/20250910195409/https://he.wikipedia.org/wiki/%D7%A0%D7%97%D7%A9_%D7%90%D7%95%D7%AA%D7%99_%D7%A0%D7%97%D7%A9; Yiftach Carmeli, “מצאנו את האיש מאחורי נחש אותי נחש”, Mako, 30 November 2023, https://web.archive.org/web/20250708015055/https://www.mako.co.il/music-news/Article-51a95ecf95f1c81026.htm. The trend began with a WhatsApp voice message a labourer sent his employer, and Oded Davidov’s remix against “The Sound of Silence” was posted on 19 November 2023. Israeli outlets are the only record of an Israeli internet trend, which is why they are cited here. ↩
64. Other observations support the same reading. The narration is synthetic: 13 ElevenLabs generations feed 16 videos between 2 June and 18 September 2024, and their download timestamps read coherently only as local time on the same UTC+3 clock, which places a second application from a different vendor on the operators’ machines. 14 screen recordings record Apple hardware identifiers for three distinct Macs. 56 packets name a prerelease After Effects build, which requires an account opted into Adobe’s beta channel. ↩
65. Baobab Group staff page, “Shuki Duchovni”, archived 24 July 2019: https://web.archive.org/web/20190724091740/http://baobabpr.com/team-core/shuki-duchovni/. The domain shukid.com was registered on 12 October 2003 (registrar record). Portfolio, archived 21 April 2026: https://web.archive.org/web/20260421171055/https://www.shukid.com/. ↩
66. @liorchorev, 11 March 2023, https://x.com/liorchorev/status/1634458801754472448. X refuses Wayback captures of the post page, so the archived copies are X's own embed record of the post, https://web.archive.org/web/20261009185541/https://cdn.syndication.twimg.com/tweet-result?id=1634458801754472448&token=a, and the image, https://web.archive.org/web/20261009185601/https://pbs.twimg.com/media/Fq7DnlDXgAEVAoh.jpg. The Hebrew word set over the portrait, וַּיִּשְׁתֹּקוּ, means “and they were silent”. ↩
67. Percepto International, “About us”, https://perceptointernational.com/about-us/: Chorev as “Co-Founder, Chairman & Chief Strategy Officer”; Royi Burstien as “Co-Founder, CEO & Chief Intelligence Officer”, who “established and managed Psy Group”. ↩
68. Behadrei Haredim, summarising Haaretz of 14 September 2026, lists “the strategic adviser Lior Chorev” among the participants named in the initiative, with Noam Lanir and Alon Pinkas; the names of its initiators are barred from publication. Archived: https://web.archive.org/web/20261009192811/https://www.bhol.co.il/news/1739029. Haaretz (Hebrew), archived: https://web.archive.org/web/20261009192955/https://www.haaretz.co.il/news/security/2026-09-14/ty-article-magazine/.premium/000001a0-575f-d3eb-abf5-575f32b00000.מנהיגשבוחרבךוַּיִּשְׁתֹּקוּ, ↩
69. Walla, 27 December 2018, on Chorev heading Kulanu's 2019 campaign, archived: https://web.archive.org/web/20261009214255/https://elections.walla.co.il/item/3209878. Mako, 28 March 2019, describing the “מנהיג שבוחר בך” spot, archived: https://web.archive.org/web/20261009214549/https://www.mako.co.il/news-israel-elections/elections_2019-campaigns/Article-89bc1821306c961006.htm. Duchovni showreel, Adobe Creative Cloud video CXpge-yAJUK on shukid.com/political-campaigns, at 0:34. The showreel is his own claim to the work and does not show who hired him. The two men also appear in one 2018 procurement story: at the Or Yehuda municipality the mayor's office named a company of Duchovni's among three bidders for graphics work alongside two firms of the consultants Maor Avigal and Nadav Abramovich, whom Chorev describes as friends and who ran Kulanu's 2015 field campaign with him. TheMarker, 2 October 2018, archived: https://web.archive.org/web/20261009214159/https://www.themarker.com/law/2018-10-02/ty-article/0000017f-e77b-da9b-a1ff-ef7f0ecb0000.וַּיִּשְׁתֹּקוּ, ↩
70. timorgroup.com, archived 5 August 2018, page footer: https://web.archive.org/web/20180805095946/http://timorgroup.com/. Baobab's logo is also held in the Timor Group site's own media library, uploaded in October 2018. The Timor site images were made in Photoshop on Windows; Duchovni's own files are all macOS, so the build is Baobab's, not demonstrably his. ↩
71. Tal Schneider, “After Knesset election-rama, Israeli political advisers turn to Tirana”, Times of Israel, May 2021, archived: https://web.archive.org/web/20210621135125/https://www.timesofisrael.com/after-knesset-election-rama-israeli-political-advisers-turn-to-tirana/. The article describes Timor as a communications consultant with expertise in international campaigns, including in Africa. The Sa'ar folder is in the embedded path of an image on Duchovni's portfolio site, under a job folder named סער (Sa'ar) with the subfolder GS. ↩
72. Duchovni showreel, Adobe Creative Cloud video 7shERL2SZGt, embedded on shukid.com/political-campaigns: Malawi (“Lazarus Chakwera 2025”) at 0:16, Eswatini at 0:18, Mozambique at 0:33 and Angola at 0:53. Archived player: https://web.archive.org/web/20261009185254/https://www-ccv.adobe.io/v1/player/ccv/7shERL2SZGt/embed?bgcolor=%23191919&lazyLoading=true&api_key=BehancePro2View. Zimbabwe and the Democratic Republic of Congo appear in separate reels on the same page. ↩
73. Data for this section were obtained from public Wikimedia records. The accounts, the published CheckUser findings and the blocks are taken from the English Wikipedia sockpuppet investigation case file, https://web.archive.org/web/20250822144605/https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/TronFactor; the edit timestamps, hand-offs between accounts, revert outcomes and the article counts in Figure 61 from the revision histories and contribution logs of the accounts and of the affected articles on English Wikipedia and Wikidata; and the 11 IP addresses from edits made while logged out, which Wikipedia attributes publicly to the address used. CheckUser data itself is not public; only the checking administrators’ published conclusions are used. The first nine accounts were documented in the July 2024 investigation (Appendix C). ↩
74. Associated Press, “Witness in Mueller probe aided UAE agenda in US Congress”, 26 March 2018, https://web.archive.org/web/20251110235212/https://www.aljazeera.com/news/2018/3/26/witness-in-mueller-probe-aided-uae-agenda-in-us-congress; Associated Press, “AP investigation: A Trump fundraiser’s secret lobbying effort to win $1B in business”, 21 May 2018, https://web.archive.org/web/20250723195347/https://www.nbcnews.com/politics/white-house/ap-investigation-trump-fundraiser-s-secret-lobbying-effort-win-1b-n876206 (“Neither Broidy nor Nader registered with the U.S. government under the Foreign Agents Registration Act”). ↩
75. Renée DiResta, Josh A. Goldstein and Shelby Grossman, “Middle East Influence Operations: Observations Across Social Media Takedowns”, POMEPS Studies, August 2021, https://web.archive.org/web/20261009094226/https://pomeps.org/middle-east-influence-operations-observations-across-social-media-takedowns. ↩
76. Meta, “Removing Coordinated Inauthentic Behavior in UAE, Egypt and Saudi Arabia”, 1 August 2019, https://web.archive.org/web/20261006131920/https://about.fb.com/news/2019/08/cib-uae-egypt-saudi-arabia/. The UAE and Egypt network comprised 259 Facebook accounts and 102 Pages with about $167,000 in advertising; the Saudi network 217 accounts, 144 Pages and about $108,000. ↩
77. “Gulf Arab leaders sign declaration to ease rift with Qatar”, Associated Press via PBS NewsHour, 5 January 2021, https://web.archive.org/web/20240607182915/https://www.pbs.org/newshour/world/gulf-arab-leaders-sign-declaration-to-ease-rift-with-qatar. ↩
78. Marc Owen Jones, Digital Authoritarianism in the Middle East: Deception, Disinformation and Social Media (Hurst, 2022), https://web.archive.org/web/20261009102827/https://hurstpublishers.com/book/digital-authoritarianism-in-the-middle-east/. ↩
79. VIGINUM, “RRN: a complex and persistent information manipulation campaign”, technical report 19 June 2023, English summary 19 July 2023, https://web.archive.org/web/20260923124746/https://www.sgdsn.gouv.fr/files/files/Publications/20230719_NP_VIGINUM_SYNTHESE_RAPPORT-CAMPAGNE-RRN_EN_0.pdf (“at least 49 false articles in Le Parisien, seven in 20 Minutes, one in Le Figaro and one in Le Monde”). ↩
80. Federal Foreign Office (Auswärtiges Amt), “Technical Report on an Analysis by the Federal Foreign Office”, 5 June 2024, https://web.archive.org/web/20261002111825/https://www.auswaertiges-amt.de/resource/blob/2682484/2da31936d1cbeb9faec49df74d8bbe2e/technischer-bericht-desinformationskampagne-doppelgaenger-1--data.pdf; first reported by Der Spiegel on 26 January 2024, summarised at https://web.archive.org/web/20260524102655/https://www.eurointegration.com.ua/eng/news/2024/01/26/7178270/. ↩
81. EU DisinfoLab, “Indian Chronicles: deep dive into a 15-year operation targeting the EU and UN to serve Indian interests”, 9 December 2020, https://web.archive.org/web/20261004200130/https://www.disinfo.eu/publications/indian-chronicles-deep-dive-into-a-15-year-operation-targeting-the-eu-and-un-to-serve-indian-interests/ (“750+ fake media outlets, covering 119 countries”, “10+ UN Human Rights Council accredited NGOs”, “running since 2005”). ↩
82. Network Contagion Research Institute, “Cyber Social Swarming Precedes Real World Riots in Leicester: How Social Media Became a Weapon for Violence”, 16 November 2022, https://web.archive.org/web/20260217110321/https://networkcontagion.us/reports/11-16-22-cyber-social-swarming-precedes-real-world-riots-in-leicester-how-social-media-became-a-weapon-for-violence/. ↩
83. Center for the Study of Organized Hate, “Racialized Grooming Gangs: Elon Musk, X, and Amplification of Islamophobia in the UK”, May 2025, https://web.archive.org/web/20260308131033/https://www.csohate.org/wp-content/uploads/2025/05/Elon-Musk-X-and-Amplification-of-Islamophobia-in-the-UK-1.pdf (“scattered instances of engagement by India-based Hindu nationalist-linked accounts in promoting anti-Muslim and far-right narratives in the UK”; OpIndia among the non-UK handles amplifying the discourse). ↩
84. Bar Peleg and Omer Benjakob, “Israeli Experts Mounted an anti-Qatar Campaign. It Was Abruptly Halted, Without Explanation”, Haaretz, 14 September 2026, https://web.archive.org/web/20260916210842/https://www.haaretz.com/israel-news/security-aviation/2026-09-14/ty-article-magazine/.premium/israeli-influence-experts-mounted-anti-qatar-campaign-and-then-it-was-halted/000001a0-9f26-d9a4-a3a7-9f762e360000 (archived at https://archive.is/2F1iQ; full text, including the calendar meetings, at https://archive.is/JetJp). ↩
85. Derek B. Johnson, “Israeli influence operation highlights global disinformation industry”, CyberScoop, 5 June 2024, https://web.archive.org/web/20260929045052/https://cyberscoop.com/israel-influence-operations-stoic/ (“flagged earlier this year by the independent researcher Marc Owen Jones and the Digital Forensic Research Lab, which identified a network of more than 160 accounts across Facebook, X and Instagram”); DFRLab, “Inauthentic campaign amplifying Islamophobic content targeting Canadians”, 28 March 2024, https://web.archive.org/web/20261006140258/https://dfrlab.org/2024/03/28/inauthentic-campaign-amplifying-islamophobic-content-targeting-canadians/ (“The network targeting UNRWA was first reported by open-source researcher Marc Owen Jones in early February 2024”). ↩
86. “Israel Secretly Targets U.S. Lawmakers With Influence Campaign on Gaza War”, New York Times, 5 June 2024, https://archive.ph/w7Z2R; NPR, “How Israel tried to use AI to covertly sway Americans about Gaza”, 9 July 2024, https://web.archive.org/web/20260928222857/https://www.npr.org/2024/07/09/nx-s1-4994027/israel-us-online-influence-campaign-gaza; Meta, Adversarial Threat Report, First Quarter 2024, May 2024, https://web.archive.org/web/20261006140257/https://transparency.meta.com/sr/Q1-2024-Adversarial-threat-report (510 Facebook accounts, 11 Pages and 32 Instagram accounts removed; the network “appeared to have purchased inauthentic engagement (i.e. likes and followers) from Vietnam”). ↩
87. Google Ads Transparency Center, advertisers AR02434148809220030465 (Olimpio Lucas Pereira Silva), https://adstransparency.google.com/advertiser/AR02434148809220030465; AR12609951456238239745 (Tailine Ferreira Pinheiro), https://adstransparency.google.com/advertiser/AR12609951456238239745; AR12886315250067963905 (Laiza Cristina Carvalho de Oliveira), https://adstransparency.google.com/advertiser/AR12886315250067963905; retrieved 12 October 2026. Each record gives the country as Brazil and names the advertiser as its own payer. None is registered as a company, and none was approached. ↩
88. Message exchange with Gabriel Cruz ↩
89. TikTok account @grand.theft.qatar8, https://www.tiktok.com/@grand.theft.qatar8, created 22 September 2026. Videos 7690597760407457046 (28 September 2026) and 7694460164723739926 (9 October 2026); the locationCreated field on each video page read BR when checked on 9 October 2026. ↩
90. Dan Green, “Analysing the malvertising criminal ecosystem”, Push Security, 12 January 2026, https://web.archive.org/web/20260930142728/https://pushsecurity.com/blog/cyber-criminal-ecosystem-analysis/ (accessed 17 September 2026). The Vietnamese attribution is Google Threat Analysis Group reporting as summarised by Push Security. ↩
91. The spend visible in the Ad Library for the Facebook advertisements the ad archive holds, the recorded exposures priced at the tracker’s CPM, and the projection for archive loss. Phase 1’s recorded and projected bars rest on the commercial tracker, whose impressions are almost all on Facebook but are counted as impressions, not reach; phase 2 adds the tracker’s impressions for Make the West Great Again, its one tracked page, and phase 3 is Facebook archive reach only. Meta’s own disclosure for phase 1 is the dashed rule. The axis is logarithmic; the ad archive bar is the range captured, stopping at the floor where a band is open-ended, a partial figure by construction. ↩
92. Phase 3 accounts for most of the difference; TikTok advertising and the No to the Iranian Occupation account’s videos are separate rows. The unit differs by source, as the table below sets out. ↩
93. YouTube counts a view only after 30 seconds of watching, the whole of a shorter advertisement, or a click, so a view costs more than an impression: at the $6.09 CPM a view would cost $0.006, below anything Google sells. Industry guides put ordinary view campaigns at “about $0.01 – $0.03 per view” (Stack Influence, “How Much Do YouTube Ads Cost?”, 2025, https://stackinfluence.com/blog/how-much-do-youtube-ads-cost) and broad consumer targeting at “$0.03 to $0.10” (IQFluence, “How much do YouTube ads cost?”, June 2026, https://iqfluence.io/public/blog/youtube-ads-cost). Phase three bought broad audiences, mostly in European markets, so the recorded tiers use $0.02 and the projection $0.03. Public view counts are treated as bought, since the channels had no audience of their own. At the $6.09 CPM the same views priced at $805,431 and the recorded and projected totals at $3,244,063 and $5,060,695. ↩
94. Thirteen of the twenty such networks carry a stated spend; Iran’s of January 2019 is a ceiling, “less than $30,000”, drawn at its top. Meta publishes one figure per network covering all of its targets, so these are whole-network figures and each is a floor rather than a budget. The 2022 Russian row is the Doppelgänger takedown, announced in September 2022 and restated with its attribution in the report for the last quarter of that year. ↩
95. Meta's coordinated inauthentic behaviour and adversarial threat reports, 2018 to 2025, coded by the authors: 211 networks, 154 with a stated spend, including Pragmatico (note 108), which the archived dashboard lacks, and corrected on 22 October 2026 against Meta’s original posts: the January 2019 Sputnik and Iran networks’ EU targets added from Meta’s full country lists, duplicate rows for the Chinese network of September 2022 and three networks of the fourth quarter of 2022 removed, the August 2019 Saudi network added and one mis-keyed spend corrected (data/cib_ops.json), https://web.archive.org/web/20260727101054/https://cibdashboard.netlify.app/. Spend figures are Meta's, rounded as Meta gives them. ↩
96. Facebook, August 2020 Coordinated Inauthentic Behavior Report, 1 September 2020, https://web.archive.org/web/20261009093805/https://about.fb.com/news/2020/09/august-2020-cib-report/: 46 Facebook accounts, 41 Pages and 24 Instagram accounts linked to CLS Strategies, focused on Venezuela, Mexico and Bolivia. ↩
97. Facebook, October 2020 Coordinated Inauthentic Behavior Report, November 2020, https://web.archive.org/web/20260927025149/https://about.fb.com/news/2020/11/october-2020-cib-report/: 46 Facebook accounts, 44 Pages, one Group and three Instagram accounts linked to MAS Agency and individuals associated with Yulia Tymoshenko's campaign and Batkivshchyna. ↩
98. Facebook, July 2020 Coordinated Inauthentic Behavior Report, August 2020, https://web.archive.org/web/20260812154142/https://about.fb.com/news/2020/08/july-2020-cib-report/ (detailed report: https://web.archive.org/web/20260824075134/https://about.fb.com/wp-content/uploads/2020/08/July-2020-CIB-Report.pdf): 65 Facebook accounts, 32 Pages and 8 Instagram accounts linked to Postmen DA; about $1.91 million in advertising, paid for primarily in US dollars. ↩
99. Same report: 38 Facebook accounts, 76 Pages and 55 Instagram accounts originating in Canada and Ecuador, focused on El Salvador, Argentina, Uruguay, Venezuela, Ecuador and Chile, linked to Estraterra and to political consultants and former government employees in Ecuador. ↩
100. Meta, “Removing Coordinated Inauthentic Behavior From Iraq and Ukraine”, 16 September 2019, https://about.fb.com/news/2019/09/removing-coordinated-inauthentic-behavior-from-iraq-and-ukraine/ (linked to “Pragmatico, a Ukrainian PR firm”; “About $1.6 million spent on Facebook and Instagram ads”). The network was missing from the coded dataset of note 86 and has been added to it. ↩
101. Meta, “Removing Coordinated Inauthentic Behavior From Georgia, Vietnam and the US”, 20 December 2019, https://about.fb.com/news/2019/12/removing-coordinated-inauthentic-behavior-from-georgia-vietnam-and-the-us/ (linked to Epoch Media Group; “Less than $9.5M in spending for ads”). The dataset of note 86 records the network but no spend, since Meta's figure is an upper bound. ↩
102. Facebook, Hard Questions: Russian Ads Delivered to Congress, 2 October 2017, https://web.archive.org/web/20261005005730/https://about.fb.com/news/2017/10/hard-questions-russian-ads-delivered-to-congress/ (about 3,000 ads, roughly $100,000, an estimated 10 million people in the United States). ↩
103. Twitter’s prepared testimony to the Senate Select Committee on Intelligence, as reported in “What Congress Should Ask Tech Executives About Russia”, WIRED, 31 October 2017, https://web.archive.org/web/20250827020806/https://www.wired.com/story/what-congress-should-ask-tech-executives-about-russia/. The account set is broader than the accounts Twitter attributed to the Internet Research Agency. ↩
104. US Senate Select Committee on Intelligence, Report on Russian Active Measures Campaigns and Interference in the 2016 U.S. Election, Volume 2: Russia’s Use of Social Media (2019), pp. 44–45, https://web.archive.org/web/20250513051242/https://www.intelligence.senate.gov/sites/default/files/documents/Report_Volume2.pdf; Facebook, Response to Committee Questions for the Record, January 2018, https://web.archive.org/web/20260702044332/https://www.intelligence.senate.gov/wp-content/uploads/2024/08/sites-default-files-documents-facebook-response-to-committee-qfrs.pdf. The 126 million is Facebook’s estimate of unique exposure including redistribution; 56% of the advertising impressions fell after election day. ↩
105. David Gilbert, “A US-Sanctioned Oligarch Ran Pro-Kremlin Ads on Facebook—Again”, WIRED, 10 January 2024, https://web.archive.org/web/20260511035952/https://www.wired.com/story/ilan-shor-facebook-ads-moldova-elections/, reporting research by Reset; the underlying dataset was not examined for this report. ↩
106. Australian Strategic Policy Institute, “Shadow Play: A pro-China technology and anti-US influence operation thrives on YouTube”, 14 December 2023, https://web.archive.org/web/20260902044034/https://www.aspi.org.au/report/shadow-play/. ASPI established coordinated inauthentic activity; the view count does not establish state direction. ↩
107. AI Forensics, “No Embargo In Sight: Meta lets Pro-Russia Propaganda Ads Flood the EU”, 17 April 2024, https://web.archive.org/web/20261009094709/https://aiforensics.org/work/meta-political-ads. The figure covers the August 2023 to March 2024 study window, not the operation’s lifetime, and is the report’s own “reach” label, not a deduplicated audience. ↩
108. US Department of Justice, “Two RT Employees Indicted for Covertly Funding and Directing U.S. Company that Published Thousands of Videos in Furtherance of Russian Interests”, 4 September 2024, https://web.archive.org/web/20261001125259/https://www.justice.gov/archives/opa/pr/two-rt-employees-indicted-covertly-funding-and-directing-us-company-published-thousands; the company is identified as Tenet Media in Reuters, “YouTube terminating Tenet Media channel after US indictment”, 6 September 2024. Funding and direction are allegations in the indictment. ↩
109. Meta, Adversarial Threat Report, Second Quarter 2023, 29 August 2023, https://web.archive.org/web/20261009102131/https://transparency.meta.com/sr/Q2-2023-Adversarial-threat-report: the China-based network removed for coordinated inauthentic behaviour comprised 7,704 Facebook accounts, 954 Pages, 15 Groups and 15 Instagram accounts, was active on more than 50 platforms and forums, and spent about $3,500 on advertising. Meta’s announcement of the same date describes Spamouflage as the largest known cross-platform covert influence operation in the world. ↩
110. Section 9 and Appendix B for the derivation of the 533 million recorded exposures, the $5,083,373 modelled cost and the $8,222,375 projected figure; the CIB dataset is the same one used in section 9.6. ↩
111. Meta, Removing Coordinated Inauthentic Behavior From China and Russia, 27 September 2022, https://web.archive.org/web/20261009093939/https://about.fb.com/news/2022/09/removing-coordinated-inauthentic-behavior-from-china-and-russia/ (first Doppelgänger takedown); Meta, Adversarial Threat Report, Second Quarter 2023, https://web.archive.org/web/20261009102131/https://transparency.meta.com/sr/Q2-2023-Adversarial-threat-report (Spamouflage traced to 2017 and linked to individuals associated with Chinese law enforcement). ↩
112. Meta, 17 January 2019, https://about.fb.com/news/2019/01/removing-cib-from-russia/; Meta, 21 August 2018, https://about.fb.com/news/2018/08/more-coordinated-inauthentic-behavior/. ↩
113. A comment can carry more than one flag. 393 name Israel, Mossad, Zionists or “hasbara” as the sponsor, 77 name another actor, 185 show awareness of the paid placement and 102 say the material is AI-generated. None of the attributions is supported by the record in Sections 6 and 8. ↩
114. Top-level comments, for the nine channels with thirty or more comments. Opposition leads on every channel except Qatar is Responsible, where the two are level at 128 each, and on Qatari Christmas is here by a single comment (32 to 31). Single AI-agent reading, September 2026, recoded 21 October 2026. ↩
115. Top-level comments, by the language the comment is written in, for languages with fifty or more comments. Language detected from the comment text with lingua, among English, French, Italian, German and Spanish, with Arabic by script; 223 comments of emoji or punctuation only are excluded. Italian is the only language in which support exceeds opposition. ↩
116. Second coding pass over the 2,560 top-level comments, independent of stance; a comment can carry several codes and 828 carry at least one. Accent: the advertisement’s own targets. Blue: hostility turned on Israel and Jews. Naming a sponsor is not counted as hostility and calling the advertisement racist is not counted as defending Muslims. Codes with fewer than twenty comments are left off. Single AI-agent reading, 18 September 2026. ↩
117. Pullpush (api.pullpush.io) and Arctic Shift (arctic-shift.photon-reddit.com) are public archives of Reddit posts and comments. Searches on 18 September 2026 for “Euro Summer Fest”, “Grand Theft Qatar”, “Qatar is Responsible”, “Qatari Christmas”, “Stop Qatar”, “GTQ6” and “islamophobic ads”; every thread was then retrieved in full from Arctic Shift with its comment tree. Comment counts exclude bots and deleted comments. Threads are cited by their Reddit id; redd.it/<id> resolves each one. ↩
118. r/AskALiberal, Israel and Palestine megathread, comment of 22 January 2026 (redd.it/1qh831q), linking youtu.be/lxC6lReMvDQ. ↩
119. r/NoStupidQuestions, 23 August 2026, “Why does both the left and right call each other Israeli and Jewish or each other’s propaganda as Israeli or Jewish?” (redd.it/1vw3521), 28 comments. Not counted among the fourteen threads, because the post is not about the advertising. ↩
120. Open-source routes, the Reddit threads and reader tips at left, produce a name and nothing more; the name is then searched in the platform’s own archive and stands or falls on what is recorded there. The disclosure fields in the second column are declared by the advertiser and not verified by the platform, which is why a name in one is a claim rather than a fact. The fourth attribution level is not reached anywhere here. ↩
121. They do not coincide: phases 1 and 2 are a single component, and phase 3 is two. Solid borders mark clusters joined by record links. The dashed edges between them are tradecraft links, which no disclosure field carries. The Kaufman cluster is outlined because its record links connect to nothing else in the operation. ↩
122. Lê Văn Tính and LT Media at the left, the sponsor pages and beneficiary names they paid through in the middle, and the campaigns those accounts placed advertising for at the right. ↩
123. Two registered corporations, the declared Google Ads and TikTok advertiser accounts beneath them, and Larissa Fernanda Pereira Padilha as the single Facebook beneficiary for the campaigns at the foot. ↩
124. One funder of record, one advertiser account, and the beneficiary string “i don’t no”, which is what carries the fourteen assets at the right. The four Belgian advertisers recorded against Make Lebanon Great Again are not drawn: they share a declared country with Kaufman and no record link. The registered-corporations column is empty, which is the difference between this cluster and the other two. ↩