Beyond using AI for updating reports, operators occasionally leveraged the model to design and craft operational texts. Specifically, they sought assistance in ensuring their fabrications used the precise accents, vocabulary, and institutional styles of various target countries. This activity represented a minor fraction of their total workload, likely because the operation involved at least one native Spanish speaker from Latin America, reducing the reliance on AI for language assistance.
For instance, a Russian-speaking operator once used the model to draft a letter in Russian designed to frame Ukraine’s honorary consul to Panama for corruption. The Spanish-speaking operator then had the model translate this letter into Spanish and compose a corresponding audio script. Subsequently, an account posing as a news outlet—complete with a forged Panama TVN Noticias logo—posted a photo of the letter on TikTok featuring a voiceover of the generated script. This TikTok account had only a single follower and ceased all posting immediately after planting the fabricated story.
TikTok post showing the letter whose text was generated by this operation, with a voiceover script likewise generated by the operation.
On another occasion, the Spanish-speaking operator in Russia gave the model a Russian-language script that claimed Noboa had insulted poor people in Ecuador, and asked the model to translate it into Ecuadorian Spanish. On a third, in March, the same user asked the model to proofread a draft Spanish-language contract between a company called “International Security Solutions FZE” and an individual in Ecuador, purporting to provide infrastructure services in Ukraine. The user’s questions focused on how to improve the language and layout, including asking which words should be in bold.
The user’s prompts about the contract finished once the wording was finalized. Open-source research, however, shows that a picture of the “contract” was subsequently circulated on social media. It was used to bolster the claim that Noboa’s government had worked with a front company to trick Ecuadorians into being recruited into the Ukrainian army. The fake spread widely enough to trigger a fact check in early April: the fact checkers concluded that the company “does not appear in the registry of Ecuador’s Superintendency of Companies, Securities, and Insurance”.
Impact
The impact of this operation requires particularly careful assessment. As noted above, one of the operators’ main approaches was to take credit for activity which had nothing to do with their operation. As such, their own claims of impact in their internal reporting cannot be taken at face value. Similarly, some of the fake stories that they claimed to have planted did not show up in open-source research, potentially because they were spread in non-public channels, already taken down, or not actually posted.
However, open-source evidence allowed us to corroborate some of the claims that they made. Some of the fakes that the operation claimed to have spread were subsequently reported by fact checkers and debunked by governments, suggesting that they had spread widely enough to merit a response. In other cases, we were able to identify content online that closely matched the content generated by this operation. Most notably, the operation’s claim to have tricked a Peruvian school into holding an event that portrayed Bandera was subsequently reported on in both Latin America and Europe, and appears to have led to comment from at least one Polish MEP.
Using the IO Breakout Scale, which rates IO on a scale of 1 (lowest) to 6 (highest), we would assess this operation as belonging in Category 5, with evidence that suggests that it led to public comment by politicians in a number of countries. This is the first Category 5 operation we’ve disrupted since we began our reporting.
Iran: Operation “Bogus Bylines”
Iran-origin operation seeding long-form articles under deceptive bylines in online news outlets.
🕵️ The Actor & Tactics
We have banned a cluster of ChatGPT accounts originating from Iran. Operating behind VPNs to hide their location, these actors prompted the AI in Persian and generated content in both Persian and English.
The operation relied on our models to:
- Refine long-form articles and editorial pitches.
- Generate social media comments focusing heavily on the US-Iran conflict and US politics.
- Polish internal reports, which used deceptive calculations to inflate their social media impact.
The campaign has been dubbed “Bogus Bylines” because the operators used seven distinct fake personas to pitch their content. The overall footprint mirrors a commercial, for-hire influence campaign, though the specific actor remains unidentified. Information has been shared with relevant authorities.
📊 Impact: High-Yield Articles, Low-Yield Socials
The impact of the operation varied drastically across its two main workstreams:
| Workstream | Reach & Engagement |
|---|---|
| Long-Form Articles | High. Nearly 100 articles were published or syndicated across roughly a dozen small-to-medium global outlets specializing in geopolitics and Middle Eastern affairs. |
| Social Media Comments | Negligigble. None of the generated comments gained substantial engagement, likes, shares, or replies. |
✍️ Planting Articles via AI Pitches
The operation’s most successful tactic involved using ChatGPT to review English drafts regarding US-Iran geopolitics. Operators asked the model to check drafts against the submission criteria of specific online outlets and suggest edits for compliance. Once finalized, the AI generated the email pitches used to target editors.
These pitches were distributed under seven fake Western journalist personas:
- Ervin B. Hoskins (Claimed American freelance writer)
- Noah Lamington (Claimed to be based in New Zealand)
- Sophia Gonzalez
- Michael Harrison (The operators had the AI write this bio. Notably, Meta disrupted an Iranian operation in March that used the exact same name)
- Ericka Feusier
- Jenny Williams
- Alice Johnson
🔍 Exposure via Social Media
To build credibility, the operators backstopped these personas with fake social media profiles. The “Michael Harrison” persona held accounts on Medium, X, and Facebook. Similarly, “Ervin B. Hoskins” maintained profiles across X, Facebook, Instagram, and Threads. While the Hoskins bio claimed he was an American writer, the platforms’ built-in transparency settings exposed the operation by locating the accounts directly in Iran.
🗂️ Case Study: The Ervin Hoskins Persona
Below is visual evidence exposing how the operators backstopped their fake personas, which ultimately led to their detection:
- Top: The fabricated Instagram bio for the “Ervin Hoskins” persona.
- Bottom Left: X (formerly Twitter) account transparency data, revealing activity tied to the West Asia Android app.
- Bottom Right: Instagram account transparency data, explicitly exposing the operator’s actual location in Iran.
Note: Meta permanently banned the Hoskins Instagram account in August.
🕵️ Open-Source Intelligence (OSINT) Findings
Using advanced open-source investigation techniques, we mapped out the full scope of the operation’s publishing footprint:
- Total Reach: Nearly 100 articles were successfully published under the campaign’s deceptive bylines.
- Target Outlets: The content spanned over a dozen different online publications globally. These sites typically focused on international affairs, geopolitics, and Middle Eastern events, often catering to antiwar or progressive audiences.
- Timeline: The earliest identified article was published in July 2025, with the latest appearing in October 2026.
- The Catalyst: The volume and frequency of these articles spiked drastically following the outbreak of the US-Iran conflict.
Timeline of articles, by author and theme, July 2025—September 2026. Note the density of publications on US-Iran relations from March 2026 onwards.
Sample headlines of articles published under the bylines linked to this operation between February and July 2026 in a range of online outlets.
By getting their work shared by the outlets’ own social media accounts, the Iranian operators effectively hijacked established audiences they otherwise could not reach.
This is just Part 2 of our investigation—stay tuned for Part 3, dropping in a few days.
