Operation Epstein Fury: How a 91,000-Post Disinformation Wave Weaponized the Epstein Files Against the Iran War

Iran's formal state media published 18 war-related claims documented as false by NewsGuard in the first week after the February 28 strikes — compared to just 5 in the preceding two weeks. ^[3] Mehr News Agency reported that four Iranian ballistic missiles struck the USS Abraham Lincoln; U.S. Central Command denied it, stating the Lincoln was not hit and the missiles did not come close. Tasnim News Agency, citing an IRGC spokesperson, claimed 650 U.S. troops killed or wounded in the first two days; CENTCOM's confirmed total was 6 U.S. service members killed. ^[3]

Tasnim and Press TV are not independent media outlets. Tasnim is a U.S. Treasury OFAC-designated instrument of the IRGC, sanctioned under the Specially Designated Nationals list on September 15, 2023. Treasury's designation names Tasnim's founders, Majid Gholizadeh and Hamidreza Moghadam Far, as IRGC commanders who "continue to serve as Tasnim executives and exert control over Tasnim on behalf of the IRGC." ^[23] These are legally designated state propaganda instruments, not news organizations operating under journalistic standards.

NewsGuard separately documented that fabricated visuals circulating on X accumulated more than 21.9 million views in the first days of the war. ^[24] Euronews and NewsGuard both tracked a related pattern through early March: old or unrelated footage relabeled as real-time battlefield victories. ^[3][11] The volume of fabricated and recycled content was large enough to outrun the fact-checking infrastructure built to catch it.

Clemson University's Media Forensics Hub published its March 11 report — "From Texas to Tehran" — disclosing a network of at least 62 IRGC-affiliated accounts operating in English and Spanish, posing as users from Texas, California, Venezuela, and Chile, and separately as users from Scotland, England, and Ireland. ^[4] Secondary reporting on the same study (Fox News, Euronews) confirms the network's accounts dated as far back as December 2023 and posted 59,403 original posts on X before pivoting, en masse, to war propaganda in late February 2026.

Clemson's Darren Linvill described the accounts as "trolls, in the 2016 Russian sense of the word, trying to appear to be real people, in order to integrate into very specific communities and influence those communities online." ^[4] This "dormant persona" tactic — build local credibility for months or years, then pivot en masse at a moment of geopolitical crisis — mirrors a pattern Clemson and other researchers had documented in earlier Iran-linked networks, discussed further in Section 5.

Iran's IRGC Deputy Head of Public Relations Ali Mohammad Naeini publicly acknowledged before this conflict that Iran's propaganda architecture was insufficient. He cited failures in the PS752 Ukrainian plane downing (2020) and the Mahsa Amini morality-police controversy (2022) as cases where "we did not have a proper media operation," warning: "If we do not conduct timely and effective media operations, we will face problems." ^[19] The March 2026 operation reflects that infrastructure attempting to perform the function Naeini had called for. The 62-account, 59,403-post network is independently documented by a named academic research team, not inferred from anonymous claims.

The most widely circulated fabricated artifact was a two-minute AI-generated Lego animation titled "Narrative of Victory," produced by Iran's Revayat-e Fath Institute and aired on Iranian state television on March 11, opening with plastic figures of Trump, Netanyahu, and Satan reading a folder marked "Jeffrey Epstein File" before Trump launches a missile at an Iranian classroom. ^[8] The video also depicted an Iranian drone striking the Burj al-Arab in Dubai and Iranian drones hitting the U.S. Embassy in Riyadh — a signal aimed beyond domestic Iranian audiences, implicitly threatening Gulf-state political calculus about the conflict. ^[21]

A parallel track ran through fake news accounts on X. The "HDX News" and "GPX News" accounts — both holding paid X Blue verification badges — posted a fabricated video depicting Trump and Epstein together, captioned: "This video is not fake. These pedophile perverts started a war so that this wouldn't be talked about." HDX News accumulated 6.8 million views before X suspended the account following a Washington Post inquiry; GPX News accumulated additional views on the same synthetic content. ^[2]

Gizmodo's analysis identified the central strategic puzzle: authentic Trump-Epstein material already exists in the public record, making AI fabrication operationally unnecessary for factual persuasion. This implies the goal was not convincing skeptics but intensifying the emotional certainty of already-primed audiences. ^[20] The synthesized footage also depicted Sean "Diddy" Combs, Bill Gates, and Elon Musk, invoking a broader "elite network" conspiracy cluster; nine of the fifteen network accounts examined held paid X Blue verification. ^[2][20] A separate viral false claim — that Trump named the operation "Epic Fury" so that "Trump ep" would autocomplete away from "Trump Epstein" — accumulated over 1.7 million views despite being demonstrably false and debunked by multiple outlets. ^[9] The fabrication wasn't built to persuade skeptics — it was built to intensify belief among people already primed to hold it.

Cyabra's investigation into the 2026 campaign found TikTok accounted for 72% of the 145 million total views the operation generated in under two weeks — roughly 105 million views on that platform alone — with X, Facebook, and Instagram making up the remainder. ^[16] Cyabra found a traceable coordination signature: identical videos across platforms, synchronized posting windows, and fixed hashtag clusters pointing to centralized production rather than organic spread.

This dormant-persona/mass-activation tactic is not new for Iran-linked networks. A separate Cyabra investigation, published after the earlier Israel-Iran war in June 2025, documented roughly 1,300 fake profiles that had spent months posing as Scottish-independence and Brexit-focused UK accounts before going completely silent for 16 days when a strike knocked out Iran's power grid on June 13, 2025 — a network that had accumulated 224 million views over its lifetime and accounted for an estimated 26% of accounts engaged in Scottish-independence discussion on X. ^[17][18] Cyabra CEO Dan Brahmy said the 2025 blackout "exposed the entire operation." ^[17] The tactic — build dormant credibility, activate en masse at a moment of crisis — is established from the 2025 war; what changed in 2026 is the scale and the specific Epstein-shaped narrative it was pointed at.

X's own response to the 2026 flood was limited. On March 3, X Head of Product Nikita Bier announced a new AI content policy — a 90-day suspension from Creator Revenue Sharing for undisclosed AI-generated war videos, permanent on a second violation — that applied only to monetized accounts. Bier said the platform had traced one cluster to "a guy in Pakistan managing 31 accounts posting AI war videos — all hacked and usernames changed on Feb 27 to 'Iran War Monitor.'" His assessment: in nearly all cases, people posting fake content were "looking to game monetization," not push a specific political line. ^[10]

A Zeteo/Data for Progress poll published March 10 found that a majority of likely American voters — 52% to 40% — believe Trump launched the Iran war at least in part to cover up his Epstein connections, with 8% unsure. ^[5] The poll was conducted March 6–8, 2026, sampling 1,272 likely voters on a national web panel. The partisan breakdown: Democrats 81–14 agreeing; Republicans 25% agreeing; and voters under 45 at 66%–26%.

The under-45 figure is the most notable. It shows the Epstein-Iran narrative reaching near-consensus among younger voters regardless of party — plausibly consistent with TikTok's outsized share of the disinformation campaign's total views documented in Section 5, though the poll itself does not establish that causal link. ^[5][16]

The 25% of Republicans agreeing with the narrative is a structural problem for democratic accountability: members of the party controlling the presidency expressing belief that their own president launched a war as a personal cover-up. A quarter of a president's own base, and a majority of the country overall, doubting the stated premise of an active war is itself a measurable outcome of the disinformation campaign — independent of whether the underlying accusation is true.

Iran's disinformation acceleration after February 28 reflects a structural strain on the regime's information apparatus following Khamenei's death, which removed the figure whose authority had coordinated the regime's media response. What followed was a more decentralized activation of pre-positioned assets: Iran's formal media machine, the Revayat-e Fath propaganda unit, and the covert persona networks described in Sections 3 and 5, running largely in parallel.

The geopolitical backdrop: Iran, China, and Russia signed a trilateral strategic pact on January 29, 2026 — 30 days before the strikes — covering nuclear, economic, and defense coordination and referencing more coordinated intelligence sharing, per Middle East Monitor's reporting on the pact. ^[22] Whether that cooperation extended to coordinated information warfare has not been confirmed in open sources. What is documented is cyber-domain alignment: the pro-Russian hacktivist group NoName057(16) and Iranian hacktivists began a joint distributed-denial-of-service campaign around March 2, targeting Israeli defense and municipal networks including defense contractor Elbit Systems. ^[13]

Counter-operations exist on the other side of this information environment. The Citizen Lab's PRISONBREAK investigation, published in October 2025, documented an Israeli government-linked network of 50+ AI-enabled X accounts coordinating pro-regime-change narratives, created between 2023 and December 2023 and largely dormant until activity intensified in January 2025, peaking during the June 2025 Israel-Iran war. Documented tactics included urging Iranians toward bank runs with AI-generated ATM-line videos and fabricated BBC Persian screenshots suggesting senior officials were fleeing the country. ^[6] Whether PRISONBREAK-style accounts remained active specifically during the 2026 war is not independently confirmed here, but the tactics establish that Israeli-linked counter-influence operations against Iran are a documented, ongoing category. A separate Al Jazeera investigation (January 2026) documented an unrelated Israeli-linked network amplifying the "#FreeThePersianPeople" hashtag and Reza Pahlavi as an alternative to Iran's government, finding 94% of the posts analyzed were retweets rather than original content. ^[14]

Citizen Lab researchers assessed "an unidentified agency of the Israeli government, or a sub-contractor working under its close supervision" is the likely operator of PRISONBREAK, while noting they "cannot conclusively attribute this to a particular entity." ^[6] Lawfare has separately documented Iran's broader use of generative AI in cyber operations and influence campaigns, noting Iranian-sponsored deepfakes disrupted news broadcasts in the UAE, UK, and Canada in December 2023. ^[12] The information environment around this war includes real, documented influence operations pointed in both directions — which is itself a reason for reflexive skepticism of any single viral claim, including some of the specific figures corrected in this piece.

The Iranian regime had reasons to want this narrative to spread: domestic legitimation of a war it did not choose on favorable terms, international positioning with anti-Western and anti-Israel audiences, and a possible war-shortening effect from eroding American political will. The poll in Section 6 is the clearest available evidence that the third objective is producing some measurable result, though the poll cannot isolate how much of that effect is attributable to this specific campaign versus organic skepticism of the war.

A frequently underanalyzed harm is the damage to the Epstein accountability process itself. By attaching AI-fabricated content and an unsupported causal claim to the Epstein story, the operation makes the underlying, real Epstein investigation harder to discuss in public discourse without it being associated with IRGC propaganda and bot networks — as Gizmodo's reporting on the mismatch between real available evidence and AI fabrication suggests. ^[20]

Platform infrastructure built for case-by-case content review was mismatched to an automated content flood. A comparable platform failure emerged during the earlier 2025 Israel-Iran war, when Meta's Oversight Board found Meta had failed to act on six separate user reports of a single AI-fabricated video depicting destruction in Haifa, before the Board intervened and overturned Meta's inaction. ^[15] Whether the same review gap persisted for the 2026 flood has not been independently documented in this piece, but nothing in the record suggests Meta's review process meaningfully changed in the interim.

Brandon Amacher, director of Utah Valley University's Emerging Tech Policy Lab, has described the resulting environment as one in which people "don't know what we can trust and what we can't trust" anymore, extending even to what they see with their own eyes. ^[25] The scale is real and documented: Cyabra measured 145 million total views for the 2026 campaign in under two weeks; BBC Verify measured 100+ million combined views for the top three AI-generated false videos of the war; NewsGuard measured 21.9 million views for fabricated visuals on X alone. ^[16][7][24] Individual fact-checks cannot match that reach — not because fact-checkers aren't trying, but because AI has permanently altered the production economics of disinformation relative to correction.