An investigative review of social media interactions during the initial phase of Operation Epic Fury indicates that a significant portion of the anti-Israel sentiment online might not have originated from American users.

The report highlights recurring themes propagated by foreign-based accounts, which included assertions that the operation was a “betrayal of MAGA,” “widely unpopular among Americans,” and executed “in favor of Israel.”

Research from Argyle Consulting Group, a private firm specializing in intelligence and data analysis, found that 60% of the most shared posts on X mentioning “Iran” during the operation’s first week came from accounts located outside the U.S. These accounts frequently masqueraded as American, according to the study.

“These are not just stray opinions,” stated Eran Vasker, the CEO and co-founder of Argyle Consulting Group, in an interview with Fox News Digital.

Vasker explained, “What we observe is dialogue that appears American — written in English and employing U.S. political terminology — but originates from abroad… making it nearly undetectable to the average user.” He further noted that these accounts imitate American political rhetoric and discussions.

A new analysis of social media activity during the opening days of Operation Epic Fury suggests that much of the online backlash and anti-Israel content may not have been driven by Americans at all. (Lori Van Buren/Times Union)

The analysis examined 100 highly X viral posts — each with more than 10,000 shares — between Feb. 28 and March 7. In total, posts containing the word “Iran” generated 98 million posts, 696.4 million interactions, and an estimated 1.5 trillion potential views, making it one of the largest online information events on record. 

Foreign accounts alone generated 155.6 million views, compared to 93.4 million from U.S.-based accounts, outpacing them by more than 60 million views in the sample.

Even more striking, every single foreign-based post in the dataset was negative toward the operation, while the only supportive content came from U.S.-based users, Argyle found. 

Among the most influential voices driving engagement, seven of the top 10 accounts were based outside the United States, including accounts linked to Russia, the United Arab Emirates, the United Kingdom and South Asia, Argyle found.  (Rashid Umar Abbasi for Fox News Digital)

JP Castellanos, Binary Defense director of threat intelligence and a former member of U.S. Central Command’s Active Cyber Defense Team, said much of the activity is focused on Israel and combines disruption with messaging. 

“About 42% of the attacks that we’re seeing or the claims that we’re seeing online are directed toward Israel,” Castellanos said.

He also pointed to doxing campaigns and AI-generated videos “trying to basically shape the information space.”

Much of the challenge, Castellanos said, is distinguishing real cyber incidents from inflated online claims by hacktivist groups seeking attention.

“A lot of times, these are just claims that they put online,” he said. 

Cyber threat analysts say that an online narrative campaign is unfolding alongside broader activity by pro-Iranian and aligned groups across the digital space. (Rashid Umar Abbasi for Fox News Digital)

Researchers said the scale, consistency and geographic spread of the messaging point to a coordinated effort rather than organic global debate.

Cyber threat analysts say that an online narrative campaign is unfolding alongside broader activity by pro-Iranian and aligned groups across the digital space.

One of the most prominent groups to emerge in the current conflict, Castellanos said, is Handala, an Iran-linked hacking operation that has claimed responsibility for attacks on both U.S. and Israeli targets. 

Among the most influential voices driving engagement, seven of the top 10 accounts were based outside the United States, including accounts linked to Russia, the United Arab Emirates, the United Kingdom and South Asia.

U.S. authorities and cybersecurity firms have linked Handala to Iran’s Ministry of Intelligence and Security, describing it as part of a broader effort combining cyberattacks with psychological and information operations.

The report identified recurring narratives pushed by foreign-based accounts, including claims that the operation was a “betrayal of MAGA,” “highly unpopular with the American people” and carried out “on behalf of Israel.” (Asra Q. Nomani/Fox News Digital)

The cybersecurity researchers told Fox News Digital Handala is part of a wider network of Iran-aligned and pro-Russian hacktivist groups that have mobilized since the start of the war, blending disruptive cyber activity with narrative-shaping campaigns online.

Fox News Digital reached out to X multiple times, providing a list of the accounts in question per their request, but has not yet received a response.