Disinfo campaign busted: Indian-Afghan operators fake Iranian IDs to target Pakistan

Islamabad (Web Desk): A sophisticated online disinformation operation has been exposed, showing how individuals linked to India and Afghanistan allegedly posed as Iranian social media users to launch a coordinated narrative against Pakistan.

The activity emerged at a particularly delicate moment, when Islamabad, alongside friendly nations, was actively involved in diplomatic efforts aimed at reducing regional tensions.

The campaign pushed misleading allegations claiming that Pakistan had turned against Iran by allowing vessels flying its flag to carry oil through the Strait of Hormuz to states considered hostile to Tehran. The messaging appeared crafted to erode trust between the two countries by suggesting Islamabad had violated expectations of solidarity as a fellow Muslim nation.

Initial traces of the operation point to accounts originating from Afghanistan. One of the earliest instances was identified on March 26, 2026, from a handle known as @HosseinNejat1. Created in November 2025 and linked to Central Asian app infrastructure, the account had undergone a username change and initially attracted followers largely from Afghanistan, indicating a managed setup.

Soon after, multiple other Afghanistan-linked profiles began circulating the same narrative almost word-for-word. Among them were @Army_of_Afghani, connected through the Afghanistan App Store, @fqyrzadh079, associated with an Afghanistan-based Android platform, and @GlobNow34163, also operating from Afghanistan.

The uniformity in their posts suggested a deliberate and coordinated effort rather than organic activity.
Deeper examination revealed that a wider group of pages—such as Afghan Guardian, Kabul Frontline, News File, Islamabad Post, Afghan Defense, Falcon Defence, The Scoop, and Heart of Asia—appear to be controlled by a single individual. This operator is believed to use the name Ahsan Agha and is also known by the alias Haider Hashmi, who runs the account @sHaidarHashmi.

At the same time, the narrative was amplified by accounts traced back to India that had been repackaged to look Iranian or supportive of Iran. Examples include @INNewx, presented as Iran National News, and @Timesofiraan, which showed multiple location changes, including links to Bihar, India, along with earlier identities tied to Indian users. Another account, @MojtabaKhamen, previously operated under the name Rahul Tiwari with the username RahulTi30553541.

Similarly, @GlobalReportNow, posing as an international media outlet, and @AyatollahArafi, which earlier used the name Manoj K under the handle Rob_JGR_FAN and was connected through a South Asia Android application, also displayed signs of rebranding.

Across the network, consistent indicators of manipulation were observed, including recently created or reactivated profiles, repeated changes in usernames and stated locations, and technical links to regional Android platforms. Most notably, these accounts repeatedly shared identical content, all aimed at promoting the same claim that Pakistan had betrayed Iran.

The uncovering of this network highlights how digital platforms are increasingly being used to orchestrate influence campaigns, particularly during sensitive geopolitical moments, with the intent to distort facts and create divisions between countries.