Manufacturing The Great Replacement

For three years, a covert paid influence campaign has pushed more than half a billion exposures of far-right propaganda to 30 countries, mostly in Europe. Beginning in October 2023 and still advertising in October 2026, the operation targeted audiences across Europe, the Americas, Asia and the Middle East with racist, anti-Muslim, anti-migrant, anti-Qatar and anti-Iran messaging. The recorded total is 533 million exposures 1 , a composite of commercial-tracker impressions, platform reach and video views. 2 Projected for advertising the archives could not obtain, it reached 831 million. This figure is likely a massive undercount, and only accounts for advertising cost, as opposed to labour and commissioning costs.

Among the operations in Meta’s published reports on coordinated inauthentic behaviour (CIB) and adversarial threats from 2018 to 2025 that targeted EU member states, none has higher disclosed advertising spend than this operation’s first phase, which Meta puts at around $1.2 million. That is 69% of the total across the 13 EU-facing networks with a stated spend, 6.8 times the largest and 11 times what Meta stated for Doppelgänger. On Meta’s whole record phase one ranks sixth, or seventh if The BL network, for which Meta gave only a ceiling, spent more, and the five operations above it with exact figures are commercial advertising or public-relations firms working for political clients (Section 9.7). 4 Phases two and three appear nowhere in that record, and will likely make the campaign the most expensive CIB operation in Meta’s history. For phase one, Meta’s own figure is more than a thousand times the spend visible for the same pages in its public Ad Library, because almost none of the advertising was filed as political or social-issue content. Set against the audience figures published for other documented operations, this is one of the largest influence operations by known reach ever recorded (Section 9.7).

Advertising was placed through accounts and companies recorded in Vietnam, Brazil, Belgium, and through German-named TikTok advertiser strings, none with a disclosed connection to the countries targeted. When asked, the Vietnamese proxy LT Media and the Brazilian agency Agência Moll, gave the same account: the advertising assets were sold to a buyer they could or would not identify. Phases one and two form a single connected component in the disclosure records; the two phase-three clusters are joined to it, and to each other, by narrative and method rather than by any shared payer, advertiser or beneficiary (Section 14.2).

The evidence indicates with moderate to high confidence that the campaign originated in Israel, with other entities acting as contractors for various dimensions of the campaign. Campaign material passed on two occasions through former Gaza Humanitarian Foundation head Johnnie Moore and his public-relations firm JDA Worldwide. One Wikipedia editing session on 30 January 2024 included a fixed-line Israeli IP address interleaved with campaign accounts and known German proxy exits. That is consistent with a proxy failure exposing an operator’s own presence in Israel. Edit metadata in the videos on the operation’s Telegram channel puts their production on a Sunday-to-Thursday working week at UTC+3, on machines with Hebrew drive and folder names, and one machine’s clock moved back between 22 and 27 October 2024, the week Israel left daylight saving time. The same Telegram metadata also includes the same name as a prominent Israeli political creative campaigner with ties to people working in Israel’s influence industry, including Lior Chorev, who was implicated in a reportedly aborted anti-Qatar operation in October 2023. The narrative, anti-Qatar, anti-Muslim and anti-Iran, is consistent with Israel’s politics, and specifically campaigns reportedly contracted by the Israel’s Ministry of Diaspora Affairs through the Tel-Aviv firm STOIC.

1. Between October 2023 and October 2026 the operation recorded at least 533 million exposures of anti-Muslim, anti-migrant, racist and anti-Qatar advertising in 30 countries, mostly in Europe.

2. Meta puts the first phase alone at around $1.2 million. That is the highest advertising spend Meta has disclosed for any operation targeting EU member states: 69% of the total across the 13 such networks with a stated spend, 6.8 times the largest and 11 times what Meta stated for Doppelgänger. Phases two and three appear nowhere in Meta’s record (Section 9.6). At the commercial tracker’s rate, with YouTube views at $0.02 each, that advertising prices at $5.08 million, and at up to $8.22 million when projected for what the ad archives missed. Exposures are deliveries in mixed units (impressions, reach and video views), and one person can account for several (Sections 1.1, 9.4, 14.6).

3. The operation ran for 37 months in three phases and survived enforcement by Meta . Meta removed the phase-one network in mid-May 2024; advertising resumed under new identities in November 2024 and returned at scale in October 2025 (Sections 1.2, 8.4), highlighting the relative ease of bypassing platform moderation.

5. In Europe the campaign uses the structure of the “Great Replacement” conspiracy theory, with Qatar in the role antisemitic versions give to George Soros: a hidden power directing Muslim immigration to “Islamise” Europe. In Lebanon it ran anti-Hezbollah and anti-Iran material aimed at Shia audiences (Sections 4.1, 4.2).

6. Almost none of the advertising was filed as political or social-issue content, so Meta’s transparency rules for that category did not apply. For phase one, Meta’s own figure is more than a thousand times the spend visible for the same pages in its Ad Library. Google and TikTok publish no spend figures (Sections 8.3, 10.1).

7. France received the most placements, 991 of 2,748. The largest audiences were in the UK, with 154 million recorded exposures, and the United States, with 100 million. Phase two was aimed mainly at Hungary, and phase three at France, Germany, Italy, the UK and Lebanon (Sections 2.1, 2.2, 2.3). These figures are known exposures, the actual balance received by countries is likely to be different from the known figures.

8. The advertising ran alongside elections. Phase-one buying in France ran through the months before the June 2024 European Parliament election, and UK buying stopped on 17 May 2024, days before the general election was called. Phase-three buying in Germany ran through the Saxony-Anhalt state election of 6 September 2026 (Section 2.3). The campaign remains active in countries approaching major elections, including France and Italy in 2027. Its sustained promotion of anti-Muslim and anti-migrant narratives raises concerns attempts to shape the political environment ahead of these votes, beyond the formal election campaign period. The campaign targeted the UK in the months leading up to the July/August 2024 anti-Muslim riots that occurred after the Southport murders.

9. The operation also ran on Twitter/X, Telegram, Wikipedia and Change.org, and offline: billboards in Times Square and Lebanon, a video screened at CPAC 2024, and a staged protest by two former US pageant winners outside a Valentino store in Atlanta. A sockpuppet network of at least 24 accounts edited Wikipedia articles on Qatar, and a petition in the name of a fake human rights organisation gathered more than 7,500 signatures (Sections 5, 7.1).

10. Advertising was placed through accounts and companies recorded in Vietnam, Brazil and Belgium, and through German-named TikTok advertisers, none with a disclosed connection to the countries targeted. Payers and page identities changed repeatedly: the median identity advertised for 3 days. The two intermediaries who responded, LT Media in Vietnam and Agência Moll in Brazil, both said they sold the advertising assets to a buyer they could not or would not identify (Sections 6, 8.1, 8.2, 10.3).

11. The evidence indicates with moderate to high confidence that the campaign originated in Israel. Edit metadata in the Telegram channel’s videos puts their production on a Sunday-to-Thursday working week at UTC+3, on machines with Hebrew drive and folder names; one Wikipedia editing session exposed an Israeli fixed-line IP address among German proxy exits; and campaign material passed twice through Johnnie Moore and his firm JDA Worldwide. The client who commissioned the operation is not established (Section 7.3).

13. The operation repurposed material circulated by prominent far-right and anti-Muslim accounts. Editing metadata identifies the source clips used in 18 Telegram videos: twelve drew from RadioGenoa, while other source accounts included Tommy Robinson, Éric Zemmour and Europe Invasion. The operation retained or adapted captions and added its own branding and allegations that Qatar was orchestrating Europe’s “Islamisation” (Section 5.5).

14. The campaign combined AI-generated imagery and songs, video-game and music-festival parodies, and repurposed footage of migration and protests. Creatives referencing Ceuta and French student protests presented these events as evidence of a Qatar-directed project to “Islamise” Europe, while Christmas-song parodies depicted Muslims as displacing European cultural traditions (Section 4.1).

Key numbers (the tiers are defined in Section 14.6)

1. The campaign in numbers

Every figure below is a recorded composite total, including some estimates, unless it appears in the projected column.

The following table uses impressions, reach and views, which have slightly different meanings but are the best available engagement metric across platforms.

1.1 Scale and platforms

The operation placed at least 1,473 ads, 189 YouTube videos across 15 channels, 359 TikTok ads through 5 named advertiser accounts, and 105 videos on the No to the Iranian Occupation TikTok account. The nine campaign websites are recorded separately from the 2,126 items (Section 6.4). The campaign also placed display advertising on the open web, documented through Google’s Ads Transparency Center and, where possible, user discussions on . The available data does not allow the number of web ads to be counted. mostly carried the first phase, with occasional YouTube, TikTok and Twitter presence. TikTok and YouTube carried much of the third. YouTube delivered comparable reach from far fewer items: video advertising against a broad audience is cheap, and almost all of the videos were still online in September 2026. In October 2026 six of the 15 channels were terminated or emptied, and three were replaced under the same names within days.

Plotted by month, the operation runs in three phases. The first, from October 2023 to July 2024, peaks in February 2024 at 247 archived items in a single month, four months before the European Parliament vote. No paid placement is recorded for the three months, though neither the operation nor the record of it stops: the campaign’s own X account posted 65 times across August, September and October 2024; and its Telegram channel, t.me/MadeInQatar24, 52 times across the same months.

Paid placement returns at an apparently lower volume in November and December 2024 and then stops. No paid placement is recorded from January to September 2025; the No to the Iranian Occupation TikTok account began posting in August 2025, and the campaign’s own X accounts, @Qatarsis24 and @TheQatarPlot, the second renamed @IslamistWeb along the way, carry 118 recorded posts running to 5 February 2025. Measured on what can be observed, the operation ran in terms of regular posting without a break from October 2023 to February 2025. The third is the biggest in the archive, at 259.6 million across three platforms against phase one’s 40.7 million of archived reach, and runs from October 2025 to October 2026. Phase one carries a larger figure in the recorded tier, 267.1 million, but only because the commercial tracker covered 17 of its 26 pages and none at all in phase three: 83 per cent of phase one’s archived reach is replaced there by tracker impressions. The two tiers are not comparable across phases, which is why this comparison is drawn on the archive.

1.3 Campaign timelines

2. Geography and places targeted

The operation's geography shifted over the 37 months. Across the three phases the operation is recorded in around 30 countries on five continents. That figure combines two sources. The ad archive records a target country per item and covers 17 countries. Ad Clarity, the commercial tracker, was available for phase 1 and one phase-2 page only; it records impressions and spend per country, includes channels the ad archive misses, and covers 21 countries. Eight countries appear in both. Thirteen appear only in the tracker (Austria, Canada, Egypt, India, Israel, Lithuania, Malaysia, Romania, Singapore, South Africa, Spain, Thailand and the United Arab Emirates) and nine only in the ad archive (Belgium, Brazil, Croatia, Italy, Lebanon, Malta, Saudi Arabia, Sweden and Switzerland). Both platform archives and commercial trackers are limited in what they expose, so the picture is incomplete.

Exposures with a recorded target country total 520.2M, of which 76% fall to Europe. The United Kingdom accounts for 154.1M and the EU member states for 238.1M. The United States accounts for 99.7M, 98.7M of it in phase 1 and 1.0M from a single phase-3 placement.

2.2 Audience exposure

Italy ranks third by placements, with 356, and fourth by audience, with 76 million exposures. 49% of these come from 36 YouTube videos whose 37.5 million views are allocated to Italy by their targeting. No Italian placement appears in the phase-one archive, although that does not mean it was not targeted.

On archived reach alone France leads. The tracker, which covers channels the ad archive does not, records 127 million UK impressions on the pages it measured. Figure 7 combines the two without double counting, using tracker impressions for the pages the tracker covered and archived reach and YouTube views for the rest. The units are mixed, as Section 14.5 explains.

2.3 Geographical shifts

The operation's centre of gravity moved twice. Phase 1 was predominantly on Western Europe and the United States, with some reach in India. Phase 2 was a smaller buy aimed mainly at Hungary. By phase 3 the United States had fallen to a single placement.

The below table shows exposures per country across phases on the definition Figure 7 uses: tracker impressions where the tracker measured a page, archived reach and YouTube views elsewhere, TikTok reach split by country as recorded, and YouTube views allocated to the target country of each video. Phase 3 takes , YouTube and TikTok together. Units are mixed, as Sections 14.5 and 9.2 set out.

In phase 1 the UK took 128.2M of the 266.8M targeted exposures, 48%, and the United States 98.7M, 37%. France took 28.8M, 11%, although it had 570 of the phase's 921 placements, against 174 for the UK and 106 for the United States. The remaining 71 placements went to Croatia (16), Belgium and Sweden (14 each), Germany (11), Lebanon (7), Malta (4), the Philippines (3) and Saudi Arabia (2). Other countries, including India, account for 10.5M exposures. Italy took nothing.

Phase 3 delivered 248.6M targeted exposures to six markets. France took 90.1M, more than a third of the total, from 389 placements, and Italy 76.2M from 356. Germany took 33.7M from 379 and the UK 25.3M from 64. Lebanon took 208 placements but only 15.2M exposures, 6%. The United States fell from 98.7M to 1.0M, on a single placement. Germany rose from 0.6M to 33.7M and Italy from nothing to 76.2M. These are recorded figures, not a complete count, and do not account for potentially missed campaigns.

Elections and other political events

The operation’s first phase overlapped with a concentrated period of electoral campaigning in France and the United Kingdom. France voted in the European Parliament elections on 9 June 2024, followed by snap legislative elections on 30 June and 7 July; the UK held its general election on 4 July. The campaign therefore placed anti-Muslim and anti-migrant narratives before audiences in both countries during the run-up to major votes.

After the removal Meta dated to mid-May, the ad archive holds 30 items starting in June, 27 of them from the phase-one page Défendons la laïcité on 13 and 14 June and three on pages grouped into phase two, and 19 more on phase-two pages starting on 1 July, after which no further placement starts until 21 November. The investigation was published on 7 July and Meta disclosed the removal of the network in August.

The Southport attack on 29 July falls after the last placement began. The stepped line is cumulative archived reach on the right axis, 43M: 40.2M on phase-one pages and 3.2M on the phase-two pages that ran in June and July 2024; the horizontal rule is the tracker total for phase 1, which the ad archive does not itemise by date.

The campaign also ran ads around local elections in the UK in 2026. Shahid Butt was an independent candidate who ran for a seat on the Birmingham City Council representing the Sparkhill ward in the UK local elections held on May 7, 2026. He was not elected, finishing seventh in the ward with 453 votes. 17 His candidacy drew widespread national attention and controversy due to his past imprisonment for his role in an armed plot to bomb the British consulate, an Anglican church, and a Swiss-owned hotel. 18 The campaign, based on no evidence, suggested Qatar was behind his candidacy. 19

2.4 Monthly activity by country

The country mix changed month by month as well as phase by phase, in terms of number of ads tracked. France dominates the first burst and the smaller second one. The third is different: Lebanon carries the July 2026 peak, with Italy and Germany behind it and France reduced to a minor band. slightly When the operation returned, it was aimed at a different set of countries.

3. Campaign identities

The operation consisted of multiple campaigns. It ran through a roster of disposable identities: at least 64 pages, 15 YouTube channels and 5 TikTok advertiser accounts, with X accounts, Telegram channels and campaign websites attached to some of them. Section 14.3 explains how names, identities and items are counted, and why the 72 curated campaigns sit on 64 page identities; Section 8.1 describes the disposable-identity model as an evasion method. This section describes that model as it appears in the data: who the identities were, how the work was spread across them, and how they related to one another across platforms. Appendix A lists all identities..

identities are counted after merging the two spellings of Euro Summer Fest. Reach is the archived platform figure and carries the phase-one estimate caveat set out in Appendix A; the tracker’s impression figures for the 17 pages it covered are substantially higher (Section 1).

The names themselves fall into a few families. Forty-seven of the 64 identities carry English names, eight French and nine Arabic. Seventeen are named for Qatar (Shame on Qatar, The Qatar Plot, Qatarsis, Don’t fund Qatar, Made in Qatar, Stop Qatar, Qatar is Responsible, Qatar’s Behind This, Grand Theft Qatar, Cut Q, Keep Qatar out, rotten emir and others), and seventeen for Europe or the West (Save Europe, Europe First, The Plot Against Europe, Make the West Great again, Save The West, Stand Strong Europe, Invaderss, Dark Age, The End). The French pages spoke the language of laïcité and Lebanese solidarity: Défendons la laïcité, Sauvons le Liban, Ne Financez pas le Qatar, Le Projet, Qataracte. The Arabic pages addressed Lebanese and specifically Shia audiences: حرب ٢٠٠٦ تنذكر وما تنعاد, الشيعة ضد الحرب, لا للإحتلال الإيراني, لبنان حر, شكرا على تدمير الجنوب. A last group had names that were less explicit the contents: Le vestiaire du PSG, Euro Summer Fest, One Peace Global, It’s In Your Hands, You Have The Power, Harrods Secrets, Family Secrets..

4. Narratives and Content

Overall the campaign had two strands. The most harmful and overarching theme was promoting animosity towards migrants and Muslims through invoking fear of a ‘Great Replacement’, and claiming Qatar was orchestrating this. The second was framing Lebanon’s war and broader challenges as solely the result of Iran and Hezbollah. The below excerpts and screenshots are just examples, due the sheer volume of content produced.

4.1 Towards the Great Replacement

The opening material addressed the mother of Qatar’s Emir directly, calling on her to use her influence to free hostages held in Gaza. Qatar was not holding the hostages, and Sheikha Moza holds no political office. Interestingly, earlier material in the campaign had been directed at the president of the International Committee of the Red Cross (ICRC), indicating a strategy to experiment and pivot as needed. The campaign quickly pivoted to being an anti-Muslim, anti-migrant and xenophobic campaign.

Across the examples, Qatar is repeatedly positioned as the enabling force behind a wider civilizational threat: funding migration, imposing sharia law, and supporting actors presented as hostile to Europe. These claims intersect with explicitly anti-Muslim and anti-migrant frames, including the “Great Replacement,” the supposed erosion of Christian identity, migrant crime and disorder, and Islam as an inherent threat. The anti-Qatar messaging was embedded in broader narratives migration, Islam, demographic change, Christianity and regional geopolitics; it was never a standalone critique of Qatar, though Qatar functioned as a useful protagonist - often important in conspiracies. It is also worth noting that while Qatar is predominantly a Sunni Muslim country, many of the creatives in the campaign use footage from Shia public rituals as Latmiya (Lamentation) and Juloos (processions)—these are found commonly posted around anti-Muslim and otherwise xenophobic circles online, as the language barrier and cultural unfamiliarity facilitates insinuation of ominous overtones in a large number of Muslims gathered in public for religious expression.

Examples of campaign content

The Save Europe, Stop Qatar channel use slogans like “THIS IS AN INVASION” and “QATAR IS ISLAMISING EUROPE” with the repeated demand to “SAVE EUROPE | STOP QATAR.” By juxtaposing inflammatory protest placards with an image of collective prayer, it collapses the distinction between extremist rhetoric and Muslim religious practice, presenting both as evidence of a hostile takeover. The blood-dripping maroon graphics reinforce this association with violence, while the yellow warning text creates a sense of emergency. Qatar becomes the supposed organising force behind the threat, turning Muslim visibility in Europe into evidence of foreign interference. The imagery invites viewers to interpret diverse people and activities through a single conspiratorial narrative: Europe is under attack, Muslims are the instrument, and Qatar is responsible.

A video published by the Qatar is Responsible channel constructs a direct causal narrative linking Qatar to the alleged “Islamization of Europe.” It moves between footage labelled London, Paris and Berlin, asking “Do you know who is behind the Islamization of Europe?” before identifying Qatar as the alleged culprit. The video then broadens the claim geographically, moving from “They’re doing it in the UK” and “They’re doing it in France” to “And they’re doing it everywhere,” accompanied by footage of Muslims praying and gathering in public spaces. It culminates in the assertion “Qatar wants to impose Sharia law on you.” The sequence turns Muslim visibility across different European cities into purported evidence of a single coordinated process, with Qatar cast as the actor supposedly financing or enabling a continent-wide project of Islamisation.

Another video packaged the campaign’s message as a mock European summer festival, opening with “Qatar Productions Present: Euro Summer Fest — Now Live All Over Europe.” It then cuts between footage of large demonstrations and crowds, presenting scenes of political mobilisation as “all the greatest hits” and telling viewers to “Enjoy the live show.” The festival parody recasts disparate protests and public gatherings as parts of a single Europe-wide spectacle supposedly “produced” by Qatar. In doing so, the video advances the campaign’s wider claim that Qatar is not simply supporting particular causes or organisations, but is financing or orchestrating unrest and political disruption across Europe, using humour and familiar entertainment advertising conventions to package the allegation. It is also satirical, showing Islamic rituals overtaking traditional European practices, including the replacing of Danish traditional dances with Shia Islamic rituals.

One channel producing videos introducing viewers to ‘Islamic terms you must know’. One video uses a stark ultimatum narrative, presenting Europeans with the choice to “Convert, Die, or Live as a Second Class Citizen.” It then invokes Dar al-Harb, defining it as the Islamic concept of the “House of War” and claiming that it encompasses any territory not governed by Sharia law. The sequence strips a contested historical and jurisprudential concept of context and presents it as a straightforward description of how Muslims supposedly view contemporary Europe. In doing so, the video advances the campaign’s broader civilisational-threat narrative: Muslim presence is portrayed not simply as demographic or cultural change, but as an inherently expansionist project in which non-Muslims ultimately face conversion, death or subordination.

A series of videos extended the campaign into AI-generated Christmas songs, including one set to the melody of Wham!’s Last Christmas. The lyrics and captions repurposed a familiar festive song to push the campaign’s anti-Muslim and anti-Qatar narrative: “ Christmas because of Qatar,” “you won’t eat any pork, no drinks at the bar,” and “now Santa’s name is Abu Baqar,” culminating in “because we rule your streets and we’ll do what we want.” Accompanied by footage of Muslims in European streets, the videos turn Christmas into another vehicle for the Great Replacement narrative, depicting Muslims as a hostile population imposing cultural and religious rules on Europeans while presenting Qatar as the force enabling that transformation. The parody-song format packages xenophobic political messaging in something familiar, funny and easy to .

Another video made the Great Replacement framing explicit, opening with the warning “You are being replaced” and “Wake up!” over footage of Muslim crowds and public gatherings. The video then shifts from demographic alarmism to an allegation of deliberate sponsorship, presenting footage of police alongside the claim “Qatari money for anti-Christian policy.” The sequence ties together three elements of the campaign’s narrative: the idea that Europeans are being demographically “replaced,” the portrayal of Muslim presence as the source of that threat, and the claim that Qatar is financing or enabling the institutional policies responsible for it. As in the other videos, Qatar is cast as the hidden financier of a transformation of European society.

A single video developed the campaign’s “invasion” narrative through a historical analogy, moving from “the Turkish invasion of the Byzantine Empire” to contemporary footage of Muslims labelled “21st Century AD” and “The Silent Invasion.” By sequencing these images, the video presents present-day Muslim migration and presence in Europe as a continuation of historical territorial conquest. It culminates by attributing this supposed process to Qatar with the caption “Brought to you by Qatar.” The chronology is the point. Historical Muslim conquest, contemporary Muslim populations and Qatar are presented as stages of one continuing “invasion” of Europe.

Another set of French-language creatives adopted the visual language of public-opinion polling to legitimise anti–Muslim Brotherhood messaging. The graphics foreground purported survey results, including claims that 48% of Muslims in France want to “reduce the reasons for conflation,” one in two support banning the Muslim Brotherhood, and 47% favour strengthening national cohesion, alongside the injunction “It’s time to act” and the demand for “zero Muslim Brothers in France.” Muslim brotherhood imagery is prominently incorporated into one graphic, while mosques, Islamic symbols and prohibition signs recur across the series. By combining large numerical claims with the aesthetics of polling and civic messaging, the creatives give an appearance of empirical authority to a political argument that presents the Muslim Brotherhood as a threat to French social cohesion and calls for its exclusion from France, while also doing little to distinguish Islam from political Islam.

A mini series, called ‘Cities Stories’, produced content the islamisation of various European cities, including Malmo - Sweden, Bradford - England, and Paris - France.

Tying into current affairs:

The campaign was often opportunistic, drawing off current events for maximum virality. For example, it drew directly on Ceuta-related disinformation and anti-migrant narratives, using Spain’s North African enclave as a visual shorthand for the supposed “Islamisation of Europe.” One creative depicts migrants apparently crossing a fortified Spanish border alongside a Gulf figure, before transforming into a Grand Theft Auto-style “Mission Passed: Islamization of Europe” screen. This imagery was then folded into the wider “Grand Theft Qatar” branding, explicitly connecting migration at Europe’s southern border to Qatar and presenting it as part of a deliberate project to transform Europe. The ads repackaged the already politicised imagery of Ceuta into a conspiracy narrative in which migration, Islam and Qatar form a single coordinated threat. Other creatives showed visibly Arab men breaking wine bottles, and turning churches into mosques.

UAE and British Universities

Released after reports that the UAE had restricted funding for Emirati students at British universities, this campaign video uses the story to reinforce claims of Muslim Brotherhood infiltration. It juxtaposes a Financial Times headline with imagery of Brotherhood flags flying above buildings labelled Oxford, Cambridge, Imperial and LSE.

French Protests and Riots

Examples of campaign videos combining imagery of the French student protests with video-game and music-festival parodies. Videos were careful to include images of Palestinian flags. Qatar-branded overlays and slogans such as “Qatar is responsible” portray the disorder as orchestrated by Qatar and link it to the supposed “Islamisation” of Europe.

Shaikha Moza obsession

The campaign’s fixation on Shaikha Moza gives the campaign a recognisable female villain through whom it can demonise Qatar. It likely seeks to invert her public association with education, philanthropy and international engagement—roles institutionalised through Qatar Foundation and Education Above All—and replace it with associations of extremism, deception and violence. In the Gulf, even mentioning someone’s mother’s name can be perceived as sensitive, so this could also be constructed as an attack on Qatar’s Emir (Shaikha Moza’s son).

The imagery makes that inversion explicitly gendered. “The mother of the Muslim Brotherhood” turns motherhood into an accusation: she supposedly nurtures the threat. “Queen of death,” accompanied by severed heads, presents her as personally responsible for bloodshed. The Arabic “الشرموزة” fuses her name with a misogynistic sexual slur (sharmuta = prostitute and moza = banana). Together, these devices attack her through femininity, sexuality and maternal identity, making humiliation part of the political message.

The montage placing her face between masked figures adds another insinuation: that her public appearance conceals a sinister identity. Meanwhile, the French, English and Italian posters place essentially the same accusation against recognisable European landmarks, with fire and smoke pointing to European civilisational destruction. Repetition encourages audiences to associate her face automatically with menace, while sexualised ridicule gives a second route to contempt. The matching multilingual posters clearly demonstrate adaptation of a common message.

Lebanon took the fifth-largest of placements, after France, Germany, Italy and the United Kingdom, though it ranks sixth by recorded exposure. The messaging there was not European identity but sectarian division: anti-Hezbollah and anti-Iranian material, Arabic-language pages, and content on the 2006 war and southern Lebanon. In Europe the operation exploited religious and ethnic division; in Lebanon, sectarian division. Phase 1 and Phase 3 both targeted Lebanon. Make Lebanon Great Again, which ran from May 2025, may be a continuation of the same strand; Section 4.5 sets out the evidence, and its figures are kept out of the operation’s totals. 23

The Lebanon-facing materials in Phase 1 are characterised by intensely hostile anti-Hezbollah and anti-Iran messaging, portraying both as forces of foreign domination, destruction and sectarian control. Hezbollah’s weapons are associated with the destruction of Beirut and threats to civilian infrastructure, including Beirut airport, while the memory of the 2006 war is repeatedly invoked to warn against renewed conflict. Other creatives appear specifically tailored to Lebanese Shia audiences, attacking Wilayat al-Faqih , invoking Musa al-Sadr, and portraying Hezbollah and Amal as having subordinated Lebanese Shia interests to Tehran. This was particularly evident in the “Shia Against War” campaign, which sought to rally Shia opposition to Hezbollah and Amal and material associated with Lebanese politicians and political movements critical of Hezbollah and Iran. It also content relating to the Taharor political party, although Taharor publicly denied any affiliation with the campaign, suggesting that the operators were appropriating or amplifying sympathetic political actors rather than necessarily acting on their behalf. “Shia Against War” also attracted coverage from MEMRI, the US-based media monitoring and translation organisation founded by former Israeli military intelligence officer Yigal Carmon.

At its most aggressive, the campaign used grotesque and demonising caricatures of Iranian and Hezbollah religious leaders, depicting them as monsters or devils. Taken together, the materials frame Iran and its Lebanese allies not simply as political opponents but as an alien and malign force threatening Lebanese sovereignty, while attempting to cultivate and amplify anti-Hezbollah sentiment from within Lebanon’s Shia political sphere. Importantly, the role of Israel as a provocateur or belligerent is often omitted.

Some of the Lebanon narrative was directed at French audiences. For example, the “Sauvons le Liban” (“Save Lebanon”) materials use appeals to peace and national solidarity to frame Hezbollah and Iranian influence as the main threats to Lebanon’s survival. A cedar composed of bomb silhouettes turns the national emblem into a symbol of militarisation, while a caricature of a black-turbaned cleric apparently consuming the cedar portrays religious leadership as devouring the country. Alongside images of destruction and declarations that “we have had enough of war,” these visuals suggest that Hezbollah’s militarism and its alignment with Iran is the main source of Lebanon’s danger. French and Lebanese flags, a dove and statements attributed to public officials lend a respectable appearance to messaging that denigrates Hezbollah and its allies as destructive, predatory forces.

4.3 No to the Iranian Occupation after the takedown

Another channel was لا للاحتلال الإيراني ("No to the Iranian occupation). The brand did not end with Meta’s takedown, which Meta dated to mid-May 2024 and disclosed in August. Meta's August 2024 report listed its X handle among the LT Media network's assets; on 26 September 2024, a month later, the handle was re-registered one letter shorter as @LalihtilalalIR, with the same name, octopus-in-a-turban logo and header, and by 13 September 2026 it had 12,600 posts, 18 a day over the 717 days since re-registration, 10,500 followers, and paid verification since January 2026. 24 A YouTube channel under the same name opened on 13 January 2025 and reached 19 videos and 3.5 million views before it was removed, around the time a similar channel (Make Lebanon Great Again -MLGA) appeared in May 2025. 25 A TikTok account, @lalihtilalalir, has posted since 18 August 2025 and had 7,926 followers and 74,800 likes on 13 September 2026, with pinned videos at 1 million and 577,000 views; its 105 videos to 17 September 2026 carry 5.6 million views in all. 26 The content is Lebanon-focused only: Naim Qassem speeches with mocking captions, the army, Berri, "Greater Lebanon", the hashtags #لا_للاحتلال_الايراني and #No_to_Iranian_Occupation, real clips under the octopus watermark mixed with AI-rendered imagery. No Meta advertising is recorded for the brand after April 2024.

Recorded after the takedown, the brand has 3.5 million YouTube views, which price at $21,500 at the report's blended rate of $6.09 per thousand (section 9.4), $14,500 at the $4.11 rate, or $10,500 to $52,500 at the $0.003 to $0.015 per view ARIJ applies to Lebanese YouTube buying. X is not priced: it publishes no advertising data for the account. The TikTok account is in the operation’s totals in section 9: its 105 videos to 17 September 2026, 5.6 million views, are in the working archive and are priced there at the blended $6.09 CPM, $34,000, like every other non-YouTube exposure, since nothing in the record shows whether its views were bought.

The operation targeted Iran and Iranian influence from the outset. In Lebanon it used ironic messages such as “thank [Iran] for destroying the South”: the two YouTube channels carrying this material, ThanksIran and Wedontwantyoutobewithus, have 25 videos, all targeted at Lebanon, and 922,398 views. Seventeen videos use AI-generated imagery and sarcastic expressions of gratitude. The remaining eight combine protest footage with hashtag activism.

As part of a Thanks Iran campaign, the stills juxtapose a smiling family receiving an Iranian-branded gift with scenes of destruction. A young girl and a woman in a black headscarf smile as the family gathers around a green box tied with a red ribbon and marked with the Iranian emblem. These warm domestic scenes give way to a rubble-filled street and Arabic lettering formed from debris. The sequence frames Iran’s apparent generosity as a deceptive gift that brings devastation to Lebanese families.

4.5 Potential links to Make Lebanon Great Again

Make Lebanon Great Again (MLGA), a campaign circulating AI-generated videos of Lebanese officials in 2025, likely represents a continuation of the operation’s earlier Lebanon strand based on similar TTPs. ARIJ documented 28 videos with 8.1 million views and approximately 30 accounts amplifying its content. It also reported continuity with “No to the Iranian Occupation,” whose channels were removed around the time MLGA appeared. Our investigation and Meta’s had already identified that earlier brand’s X account as part of the LT Media/Moore/Phase 1 network in its August 2024 takedown report. That account was suspended on X and re-registered in September 2024: an account using a nearly identical handle appeared with the same name, octopus-in-a-turban logo and header (Section 4.3). ARIJ’s findings provide an indirect connection between MLGA and an established asset. 27 28 29

MLGA also continued the use of synthetic imagery to ridicule political figures, extending it to fabricated speech and video; one video was publicly denounced as fabricated by the Lebanese prime minister’s office. 35 Even the use of the logo in the corner of the creatives resembles the phase 1 campaign. Taken together, the reported brand continuity and advertising similarities warrant further investigation. However, no shared payer, administrator or domain has been identified between MLGA and the report’s three clusters. It is therefore treated as a potential continuation, with its exposure and spending figures excluded from the operation’s totals.

4.6 Potential links to Al Ghaliboun

On Meta, three of the six ads carry figures. The ad of 2 to 8 July 2026 delivered more than one million impressions for $2,000 to $2,500, the one seeding buy of the campaign; the one-hour ads of 6 July and 6 August delivered 10,000 to 15,000 and 4,000 to 5,000 impressions for under $100 each before Meta removed them. Delivery was Lebanon only, in the same governorate proportions as the MLGA page and the 2024 pages: Mount Lebanon 34 to 37 per cent, North 21 to 23, Beirut 13 to 19, Beqaa 12 to 13, South 5 to 10, Nabatieh 1 to 3. Impressions went 61 to 69 per cent to men, and the two youngest age brackets took half. Meta estimated the audience of each ad at more than one million accounts. The three ads launched on 12 September 2026 from the third page were live without figures when captured. 41

The phrase ‘Thanks Iran’ runs through the phase-3 Lebanon material, where it is used ironically (Section 4.4), and the slogan also ran, unironically, as a billboard campaign in Lebanon. The provenance of the “شكراً إيران” (“Thanks Iran”) billboard campaign remains unclear. The message itself was consistent with Hezbollah’s public position at the time. Hezbollah’s political, ideological and material relationship with Iran is longstanding, and in June 2026 the organization was itself publicly expressing gratitude to Tehran. On 9 June, Hezbollah thanked Iran following its attack on Israel, and on 15 June it expressed “profound gratitude” for Iran’s insistence that Lebanon be included in ceasefire arrangements. 42 Photographs from the same period show “Thanks Iran” billboards carrying images of Iranian leaders on the Rafic Hariri International Airport road. 43 In other words, the slogan closely reflected authentic Hezbollah messaging and was not obviously anomalous or implausible.

The subsequent influence operation examined in this report pushed the inversion further, using formulations such as “شكراً على تدمير الجنوب” (“Thanks for destroying the South”). The linguistic continuity is striking: rather than introducing an entirely new narrative, the later campaign appears to have appropriated an existing pro-Iran slogan and weaponized the word “thanks” against Iran and Hezbollah.

There are consequently several possible explanations for the original billboards. They may have been commissioned by Hezbollah or an affiliated organization; they may have been independently purchased by a wealthy supporter, association, municipality-linked actor or other genuinely pro-Iran entity; or, more speculatively, they could have been placed by an adversarial actor as a provocation. Under the latter scenario, an anti-Hezbollah actor could have deployed an exaggerated but entirely plausible pro-Iran message in order to generate controversy and provide material for a subsequent counter-campaign. Such tactics would amount to creating the stimulus and then amplifying the backlash to it. There is currently no evidence sufficient to establish that third explanation, however. Their significance to this investigation lies less in proving common sponsorship than in establishing the immediate narrative environment from which the subsequent mocking campaign emerged.

5. The cross-platform structure

Digital advertising was the largest part of the operation,and the 2024 investigation found it running at the same time on , Twitter/X, Telegram, TikTok and web display advertising. However, Wikipedia was edited to SEO-boost the reference sources beneath the story, and Change.org used to give the appearance of public demand.

The operation ran at least 13 branded X accounts: @TheQatarPlot, @Qatarsis24, @ShameOnQatar24, @MadeInQatar_EN, @DontfundQatar, @NeFinancezQatar, @Defense_laicite, @ItsIn_YourHands and @DirtDoha69163, the last tied to the dohadirt.com site, for the phase-one campaigns, and @TenzkrWmaTen3ad, @KowtnabeWe7dtna, @Shi3aDodelharb and the No to the Iranian Occupation account for the Lebanese strand; the last was suspended and re-registered in September 2024 under a near-identical handle (Section 4.3). The paid promotion came from a separate set of Premium accounts, some created for the purpose with apparently AI-generated profile pictures, others older accounts that had been scrubbed, renamed and reused. posts are unlisted and there is no account-linked ad transparency, so these could only be found by searching for replies that happened to mention the handle. The operation's own accounts also amplified established and emergent anti-Muslim accounts, including @EuropeInvasionn and the @RadioGenoa cluster, which provided much of the xenophobic video the campaign recaptioned as evidence against Qatar. After Meta’s enforcement many of the creatives were posted on X and Telegram instead, and for a time the operator dropped individual page identities and posted wherever it still had accounts.

The investigation has collected 118 posts from two of the branded accounts, @Qatarsis24 and @TheQatarPlot, which was later renamed @IslamistWeb. They run from 9 May 2024 to 5 February 2025 and record 2,272,677 views between them, with 18 posts showing no view count. All but one are IslamistWeb’s: its 117 posts drew 72,677 views in all, while the single Qatarsis post, on the Qatari entry to Eurovision, drew 2.2 million on its own, so the total is one post that reached an audience and an account that reached relatively few.

X activity resumed in phase three. Five posts carrying Stop Qatar material appeared between 10 and 26 October 2025 on five other accounts, @Chickwbadl, @Bbohutg, @lolaearmstrong1, @thys_moordk and @Barbara3351hcl, and recorded 299,400 views between them, 100,000 on the largest; one shows no count. X publishes nothing that would show whether they were . The Make Lebanon Great Again strand used X on a larger scale: ARIJ counted 1,010 posts with 49 million views between May 2025 and May 2026 (Section 4.5). Neither set is counted in the 2,126.

In January and February 2024, a network of at least 24 Wikipedia accounts and 11 exposed IP addresses ran an operation against Qatar on English Wikipedia, during the fourth month of the Gaza war and while Qatar was mediating over hostages. The operation overlapped directly with the advertising campaign. Accounts inserted the campaign domain, shameqatar.com, into citation tags on high-traffic articles, uploaded the Shame on Qatar logo into Al Thani biographies, used “shame Qatar” as an edit summary, and added links from the same constellation of Qatari-owned assets, including Paris Saint-Germain and Harrods, targeted by the boycott advertising. The edits were made using deliberate and coordinated vandalism countermeasure evasion tactics, such as sneaking operation content into an edit made prior to a non-operation edit-and-revert, or into a revert of an earlier edit by a collaborator.

The operation had two complementary arms. One inserted hostile material into articles concerning alleged Qatari terrorism financing, the ruling family, Qatar-Iran relations and Qatari funding of American universities. The other created a new article, Qatari soft power , and seeded links to it from dozens of pages concerning Qatari holdings and sponsorships. Together these created a network of pathways through Wikipedia that directed readers from prominent Qatari-linked assets towards material framing Qatar's investments as instruments of political influence. (see section 7.3 for more information on attribution)

A petition matching the campaign's messaging was posted under the name "John Anderson" of "Citizens for Human Lives", an organisation for which no evidence of existence was found before or outside this operation. It gathered over 7,500 signatures, was by minor celebrities and organisations, and was via paid META advertising. It was also cited in news coverage. No details or website were ever given. A dated letter from the same body, over the same signature, appeared on the campaign's page.

During our initial investigation, when we approached Change.org, they suspended the petition - presumably because they could not verify the authenticity of the petition’s creator.

5.5 Telegram and TikTok

Telegram channels created in the second wave gave the operation a host with no advertising rules or robust content moderation policies. These were ‘Made in Qatar’ and ‘Doha Dirt’. One channel began by mirroring a video series already used on and Twitter, then produced its own: short clips blaming Qatar for individual incidents of alleged criminality by people it identified as Muslim or immigrant, each closing on the card "Everything that happens in Europe does not happen by chance. Qatar is behind the rapid Islamization of Europe", followed by "You just have to CONNECT THE DOTS"

Made in Qatar alone contained around 80 video files. The editing files of 18 of the channel’s videos name the clips they were cut from. Each clip has the filename twittervid.com gives a video downloaded from an X post, which records the posting account. Twelve come from the anti-Muslim account @RadioGenoa, and the captions burned into the operation’s versions repeat or closely reword RadioGenoa’s own text. The caption on an assault in Spain repeats RadioGenoa’s post of 1 January 2024 word for word, dropping only the closing “Intolerable”; a Milan clip RadioGenoa posted the same day as “Dramatic testimony of an Italian girl chased in Milan by two Arab immigrants” is recaptioned in he...