Three-minute read
For Iran’s clerical establishment, unrest abroad is rarely just news. It is material.
When demonstrations erupt in a Western capital, state media move quickly to enlarge them into evidence of political decay, police brutality or the bankruptcy of democratic government. The contrast with Tehran’s treatment of protests at home—where demonstrators are routinely described as rioters, foreign agents or terrorists—is striking enough. But years of investigations into Iranian information operations reveal something more consequential: the regime has repeatedly tried not merely to report divisions abroad, but to enter them disguised as someone else.
The distinction matters as France faces unrest today.
Iranian state media have devoted sustained coverage to the French protests, portraying police conduct as proof of European hypocrisy on human rights. Tasnim called the reaction in Strasbourg a “shameless wall of silence” and argued that violence against protesters revealed the real meaning of Europe’s democratic claims.
Enter the Protest, Wearing Someone Else’s Face
On November 5, 2020, Facebook exposed and removed an Iran-origin network comprising 12 Facebook accounts, two Pages and 307 Instagram accounts linked to individuals associated with EITRC, a Tehran-based IT company.
On October 21, 2019, Meta removed an Iran-origin network that operated a page called BLMNews, masquerading as a news outlet and posting about Black Lives Matter, race relations and African-American culture alongside criticism of U.S. and Israeli policy toward Iran. Another enormous network linked by Meta to the Islamic Republic of Iran Broadcasting Corporation targeted audiences from Africa and Europe to the United States and Britain through hundreds of deceptive pages and accounts.
An Iran-based influence operation used fabricated Western journalists, #AI-assisted editing and deceptive pitches to place geopolitical articles in legitimate online publications, according to an @OpenAI investigation that highlights a more sophisticated model of information…
— NCRI-FAC (@iran_policy) October 10, 2026
The method is less about persuading foreigners to love Tehran than about locating an existing fracture and pressing on it.
Sometimes the impersonation is remarkably patient.
Researchers examining the Iranian operation known as Storm-2035 found accounts posing as young people from Northern Ireland. “Eoin O’Reilly,” “Conor Byrne,” “Fiona Doyle” and “Niamh McDonagh” claimed to live in Belfast, presented themselves as converts to Islam and supporters of Irish reunification, and immersed themselves in Irish political conversations.
They reposted genuine Sinn Féin figures, invoked Bobby Sands, promoted Irish unity and used Irish cultural references. Yet ISD, building on research by OpenAI and Clemson University, tied the accounts to an operation affiliated with the IRGC. Collectively, the four accounts posted more than 5,400 times. Behind their Irish personas they also praised Qasem Soleimani and Ali Khamenei and pushed messaging aligned with Tehran’s foreign policy.
That is exploitation in its purest form: authentic history, authentic grievances, fabricated participants.
Ruhollah Mo'men Nasab, parliamentary special advisor on the so-called "internet users projection bill" and former commander of the cyber army reveals how #Tehran has been using @Twitter for #propaganda.
#Iran #InternetFreedom pic.twitter.com/kHzjtlEFvR— NCRI-FAC (@iran_policy) March 29, 2022
When the Mask Went Offline
A related operation targeting Britain became conspicuous almost by accident.
More than 1,300 suspicious accounts presented themselves as Scottish independence supporters, posting anti-Westminster and pro-independence material. Then Iran’s internet infrastructure went dark during the June 2025 war.
The supposed Scots went dark with it.
Cyabra found that accounts comprising roughly 26 percent of the profiles it examined in the relevant Scottish-independence conversation fell silent during the Iranian blackout and reappeared after connectivity returned—some temporarily switching to overtly pro-Iranian and anti-Israel messaging. The network generated thousands of posts and potentially hundreds of millions of impressions.
Later transparency data strengthened the attribution: accounts claiming Scottish identities showed connections through Iranian infrastructure while masking traffic through European VPNs. Britain’s Foreign Affairs Committee subsequently cited the episode in its investigation of foreign information manipulation, noting the synchronized disappearance during Iran’s blackout and their later pro-Khamenei messaging.
The Irish operation displayed the same instinct. ISD found that accounts posing as Belfast residents used hashtag hijacking and engagement with authentic Irish activists to make themselves appear organically embedded in local politics. Two later reinvented themselves again—as Scottish independence supporters based in Edinburgh.
Nationality, ideology and political cause were costumes.
#Iran Cyber Army: A Force of Disinformation for a Cursed Cause https://t.co/S3LusEN4HB
— NCRI-FAC (@iran_policy) April 1, 2022
The Useful Crisis
That history provides the proper context for Tehran’s enthusiasm whenever streets fill elsewhere.
At home, spontaneous discontent is attributed to outsiders. Abroad, spontaneous discontent becomes evidence that hostile governments are collapsing under the weight of their own contradictions. And where opportunity permits, documented Iranian operations have stepped across the line from commentary to impersonation—creating fake foreign citizens and placing them inside authentic political arguments.
The regime does not need to create a grievance to exploit one.
It only needs a fracture already present, an audience already angry, and a convincing enough mask to enter the conversation unnoticed.