Projects:
The Qatar Plot

Use of OSINT to investigate and expose a massive covert influence operation exploiting and propagating xenophobia in the course of attacking the emirate of Qatar and pushing other geopolitical objectives.

The three-year-long three-phase operation used proxies and digital assets from the Vietnamese platform hacking/astroturfing service economy and the Brazilian verified ad account trade (along with proxies in Belgium and Germany) to push messaging across Facebook, Twitter/X, Telegram, Wikimedia, YouTube, and TikTok. It reached at least hundreds of millions in the UK, the EU, the US, and Lebanon; during globally significant hot conflicts, civil disorder events, and election seasons in those places. It burned through an estimated minimum spend of USD 5 million for advertising and other forms of inorganic boosting (the Phase 1 portion of which was confirmed by Meta to be USD ~1.2M on their platforms alone).

The operation also deployed AI-generated propaganda images and video, profile pictures, and video narration, and at least one "cheapfake". It created websites for certain campaigns, and name-dropped NGO-styled organisations that didn't exist in the real world, to lend its online and offline activities a veneer of legitimacy. Engagement also involved propagating xenophobic content from existing ecosystems in the course of linking them to and vilifying Qatar, as well as rapidly pivoting content themes to exploit ongoing crisis events and pop culture moments. Sampled user engagement with the artificially boosted xenophobic content included comments expressing anti-immigrant/-Muslim sentiment, as well as occasional antisemitic backlash.

The cyber-mercenaries used both classic and novel patterns/tactics of content fabrication and deployment to repeatedly outmanoeuvre platform coordinated inauthentic behaviour countermeasures and ad moderation policy. We caught them paying for ads in currencies including Vietnamese dong and Brazilian real; sponsoring ads using dedicated collections of "burner" assets, including hacked ones; using starter ads and inauthentic engagement networks to give operation content momentum/validation; and cycling them through collections. The operation even made its way onto billboards in Times Square NYC and and a video ad at the Conservative Political Action Conference 2024 — all while concealing links among differently-branded campaigns executed in coordination.

Together with Northwestern University Qatar's Dr Marc Owen Jones, I tracked this campaign for months using open-source intelligence techniques, finally exposing it (and the gaps in platform transparency/defences it exploited) first in early July 2024, and then near the end of October 2026. Our findings converge on a likely Israel-based showrunner for the operation, attempting to run it covertly by making use of a global network of proxies and collaborators.

2024/FEB - 2026/OCT

Latest (2026/OCT) report "Manufacturing the Great Replacement" and data can be viewed here.
Earlier (2024/JUL) report "The Qatar Plot" and data can be viewed here.

Find media coverage:

Articles/coverage about the investigation at Le Monde [FR+EN], Al Ajazeera, France 24 (AFP), Private Eye, Byline Times, Yahoo! News, Japan Times, Al-Monitor, Khaleej Times, Doha News, Digital Journal, NoonPost [AR], Diriliş Postası [TR], The Times of Israel, Ahraminfo [FR], and La Presse [FR].
Quoted about a related inauthentic account investigation at SVT verifierar.
Findings featured in an ARTE documentary about Vietnamese professional astroturfing "phone farms" of the kind employed by the operation (methods detailed here; maker-hosted version here).
Interviews and panel discussions with me, regarding the Southport-spinoff riots likely stoked by the UK campaigns of the operation, with Al Jazeera English, BBC Radio Ulster, ABC News Australia (with video clip), Times Radio, Anadolu Ajansı (with companion video), and Al Jazeera Arabic.

An opinion piece by Dr Jones, exploring the far-right connections and electoral implications of the operation's first phase, can be read here. My thread on Meta's acknowledgement of the operation's first phase on their platform can be read here.

I presented on phases of the investigation in a seminar at the Max Planck Institute for Human Development (details here), in a public lecture for the British Computer Society (details here), in a presentation for the EU DisinfoLab conference #Disinfo2026 (details here), and in a scholarly panel at the Middle East Council on Global Affairs (details here, transcript here).