Citizen Lab found that an online network pushed out deepfake videos during Israel’s airstrikes on Tehran’s Evin Prison. An investigation by TheMarker and Haaretz reveals the Persian-language online campaigns indirectly funded by Israel
In early 2023, Reza Pahlavi made his first official visit to Israel. He’s the son of the last shah of Iran, who was overthrown in the 1979 Islamic Revolution and was replaced by the ayatollah regime.
The visit by the Iranian crown prince, a title mentioned by his Israeli host, then-Intelligence Minister (and current Science Minister) Gila Gamliel, was covered by the Israeli media, including Haaretz’s reporting. Reporters echoed the official line: The visit was proof that there is no animosity between the Israeli and Iranian peoples, but only between the Israeli government and the regime in Tehran.
While Pahlavi enjoys some popularity among the Iranian expat community, it’s far from clear that Iranians want him as a leader. The son of a former dictator who enjoyed Israeli and American patronage, he carries the political baggage of his father, whose rule was known not only for its openness to Western culture but also for corruption, political repression and the torture of regime opponents.
Unlike his father, Reza carries messages of peace, democracy and human rights. When asked at a press conference alongside Gamliel how the Iranian people would shake off the ayatollahs’ rule, he repeated in fluent English the message he has been delivering for decades.
“From Lech Walesa’s Poland to Mandela’s South Africa … many successful campaigns have been based on nonviolent civil resistance as a method for delivering change; in other words, without outside interference,” he said.
Then he paused, raised a finger and qualified his statement. “But the key element is that none of these movements could have succeeded without some element of international support,” he said, justifying his visit to Israel.
When asked about the responses he was getting to his visit to Israel, Iran’s archenemy, he said reactions had been largely positive. He also referred reporters to his social media accounts.
“Don’t take my word for it, search on social media … on Twitter, Instagram, any platform,” he said. “If you do the research yourself, you don’t need to ask me the question. The answer is right before your eyes.”
Pahlavi’s answer is particularly noteworthy in light of the findings by Haaretz and TheMarker, Haaretz’s business newspaper. It turns out that a large-scale digital influence campaign in Persian was underway, operated out of Israel and funded by a private entity that receives government support.
The campaign promotes Pahlavi’s public image and amplifies calls for restoring the monarchy. The campaign relies on “avatars,” fake online personas posing as Iranian citizens on social media. They were first discovered by social media researchers in Israel and abroad.
According to the sources who spoke with TheMarker and Haaretz, since the outbreak of the war in Gaza and after Pahlavi’s visit, an online operation began operating as part of an even broader Israeli campaign to influence the social media discourse, which also includes campaigns in English and German.
According to five sources with direct knowledge of the project, native Persian speakers were recruited for the operation. Three of the sources confirmed the connection between the project and this specific campaign, and said they witnessed the network advancing pro-Pahlavi messaging.
According to the sources, the campaign included fake accounts on platforms such as X and Instagram and used artificial intelligence tools to help disseminate key narratives, craft its messages and generate content. According to two of the sources, there were also efforts to amplify the posts of Pahlavi’s ally in Israel, Gamliel, a minister from Prime Minister Benjamin Netanyahu’s Likud party.
Given that the operation was indirectly funded by taxpayer money and designed to serve Israel’s geopolitical interests, some of the people involved were uncomfortable with the pressure to use the campaign to promote the minister, two sources said.
Parts of this network and its accounts were already exposed by Haaretz. Sources linked the campaign to the network of pro-Pahlavi accounts first detected by independent social media researchers Nitsan Yasur and Gil Feldman, and first reported by Haaretz’s Bar Peleg. At the time, the effort was described as an apparent foreign-influence operation. The target audience was unclear due to posts that seemed to promote the minister.
But the sources stressed that the campaign only looked foreign – its origins were in Israel. According to the investigation by TheMarker and Haaretz, the operation involved the commissioning of services from external suppliers, private actors free to sell their services to clients beyond the Israeli state.
And these aren’t the only accounts active in this space as part of an organized campaign. TheMarker and Haaretz launched their investigation into Israeli Persian-language campaigns after they were approached by researchers at the University of Toronto’s Citizen Lab, which studies digital threats, among them spyware and disinformation.
Alongside the network found by the Israeli reporters, Citizen Lab has discovered another pro-Israel, Persian-language influence campaign, being revealed Friday in a report published in tandem with the investigation by TheMarker and Haaretz.
This campaign included dozens of fake accounts pushing out AI-generated content, which Citizen Lab researchers assess is very likely operated by the Israeli government or by a contractor acting on its behalf. Their report’s conclusions are based on what the institute found to be signs of synchronization between the online campaign’s content and Israeli military actions during the 12-day war with Iran. This includes signs that the operators had prior knowledge of Israel’s attack on Iran’s infamous Evin Prison and even seemed to have prepared content in advance.
King for a day
The younger Pahlavi left for U.S. military pilot training after high school, but in early 1979 his family was forced to flee Tehran by the anti-shah popular uprising. Reza was just over 20 when his father died in exile in Cairo, and monarchist supporters crowned him successor.
For 45 years he has criticized the ayatollahs’ regime from abroad. Israel at some point established a relationship with him, presumably as part of efforts to encourage regime change. Gamliel is Israel’s point person with Pahlavi and facilitated the meeting between him and Netanyahu.
Raz Zimmt of the Tel Aviv-based Institute for National Security Studies warns that while most Iranians want change and are frustrated by the Islamist rule they live under, they’re dreaming about leading a normal life, not the restoration of the monarchy. He believes that Pahlavi isn’t the top choice for Iranians, if only because “he hasn’t set foot in Iran since the late 1970s.”
While Pahlavi has a following among some Iranian exiles, Zimmt questions the value of Israel’s open alignment with him. “I can understand why he’s convenient for Gamliel and the Israeli government … but I think it’s a mistake,” Zimmt says. “Ultimately, it reinforces Ayatollah Khamenei’s narrative that Israel and the U.S. want to turn Iran back into a monarchy and client state.”
When asked if Israel’s embrace may be politically driven, more public relations than real diplomacy, Zimmt says he “completely agrees. … Even if you’re going to create such a relationship [with Pahlavi], it’s strange to do so openly.”
While Pahlavi declares that he’s not running for any position, in recent years a social media campaign has been calling for the monarchy’s restoration, with Reza on the throne. According to the sources, part of this effort is based on a network of fake accounts originating in Israel.
A social media researcher into the network that was previously exposed by Haaretz identified hundreds of suspected fake users on X promoting Pahlavi, sharing his messages and using hashtags like #KingRezaPahlavi. These were found alongside posts promoting Gamliel. Not all of the suspected avatars, of which there almost a thousand, were said to be part of the same campaign, but a much wider network was exposed.
In fact, the X post that exposed the network included an AI-generated video titled “Next Year in Free Tehran” that meshed local politics with geopolitical interests and had massive exposure, most of which was likely inorganic. The video shows Netanyahu, his wife, Gamliel, her partner, Pahlavi and his wife walking through Tehran’s streets.
The video received many more views than most of the minister’s X posts, and these and other attempts to amplify it helped Israeli researchers locate a network of users exclusively promoting Iranian content. This included Gamliel’s frequent X posts about regime change in Iran and posts that publicized her ties to Pahlavi.
Many of these accounts were opened in 2022, at the height of the so-called hijab protests in Iran. A group of over 100 allied accounts, also part of the campaign, were opened simultaneously just in June this year during the 12-day air war with Iran. This doesn’t appear to be the only campaign operating on this issue from Israel.
Prison break
Citizen Lab is largely known for its work on spyware and human and civil rights abuses arising from surveillance technologies. But the lab also focuses on other threats to the digital arena and has published a number of investigations into disinformation and social media campaigns, including a pro-Iranian influence operation. Now the lab has revealed a pro-Israel operation active in Persian.
The institute’s findings, which were shared with TheMarker and Haaretz and were independently verified in recent weeks, expose a network of over 50 accounts that researchers determine with high confidence are not authentic users, based on multiple indicators.
These accounts are different from those identified by Israeli researchers that directly promoted Gamliel. Citizen Lab was able to identify the fake users by deploying various methodologies and tools; some found that many of the users’ profile photos were AI-generated.
All the accounts Citizen Lab identifies as part of the network were opened in 2023 but were inactive until kicking into action on X one after the other or even together early this year, further suggesting that they were part of an inauthentic coordinated campaign. The accounts’ activities intensified when the war with Iran broke out.
The network included fake X accounts pretending to be real users, but was also found to be connected to the X page @TelAviv_Tehran, an outlet of sorts. Fake users linked to the campaign amplified the page’s content, including AI videos produced exclusively by it.
Among the videos generated was a clip of Iranian Supreme Leader Ali Khamenei as Hitler, based on the famous scene from the film “Downfall” where the Nazi leader vents at his generals. The AI-generated video of Khamenei throwing a tantrum was distributed by both the @Tel Aviv_Tehran page and another account from the network, and only by them.
The most striking case linking the network of accounts to Israel is an online campaign that coincided with a real-world campaign: the Israeli strike on infamous Evin Prison, which houses Iranian dissidents.
This campaign is at the heart of Citizen Lab’s new report, dubbed “Prison Break.”
The Israeli strike occurred at around 11:15 A.M. on June 23 and lasted about an hour. At 11:52 A.M., before the first reports in the Iranian media on the attack, the network’s accounts began reporting “explosions in the prison area.” The X posts were designed to create the impression that the accounts belonged to Iranians living in the area.
בחזרה לעתיד …
— גילה גמליאל – Gila Gamliel (@GilaGamliel) June 30, 2025
بازگشت به آینده … pic.twitter.com/6tGB7z939U
A few minutes after noon, while the bombing of the prison was still underway and the Iranian media began reporting on the incident, another account linked to the network published a video supposedly of an explosion at the prison, suggesting that this was the source of the noises purportedly heard earlier. One after another, the various accounts identified as part of the network began pushing the video.
This video, as later revealed in a New York Times investigation, wasn’t authentic footage from the scene of the bombing. But this finding came after media outlets around the world had shared it. The @Tel Aviv_Tehran page also pushed out the clip, which researchers say was created with AI.
Citizen Lab researchers attribute the campaign to Israel or an actor working for it. They base this claim on the timeline of events, namely the fact that accounts in the network were among the first to report on the strike and managed to create and distribute fake footage during the attack or immediately after it.
“The profiles’ activity appears to have been synchronized, at least in part, with the military campaign that the Israeli Defence Forces conducted against Iranian targets in June,” Citizen Lab wrote. “We believe that while it is technically possible, it is highly unlikely that any third party without advance knowledge of the IDF’s plans would have been able to prepare this content and post it in such a short window of time.”
‘Death to Khamenei’ at 8 P.M.
After the strike, the accounts that pushed out the video and others from the network began encouraging Iranians to go to the prison to “free family members.” Citizen Lab concluded that the campaign aimed to create unrest that could help destabilize the regime. Other posts of this nature were also found in the other network discovered by the Israelis.
Even before the strike on the prison, messages and videos were posted on X in that spirit after the war broke out. “Tehran is defenseless,” one user wrote, while another suggested that people in the city should storm banks and withdraw their money. According to reports in the first days of the war, a pro-Israel hacker group attacked an Iranian bank linked to the Revolutionary Guards.
The campaign also tried to piggyback on an authentic protest by Iranians calling for people to go to their balconies at 8 P.M. and shout “Death to Khamenei” and “Death to the dictator.” Accounts in the pro-Israel network joined together to amplify the message, which enjoyed real support regardless of the inauthentic campaign. For example, accounts distributed fake videos of popular calls that were really being made, while adopting hashtags identified with the real protest.
سلام ایران🤝
— تلآویو تهران (@TelAviv_Tehran) June 23, 2025
آزادی آزادی آزادی!!!✌️
نماد سرکوب منفجر شد🫡#اوین#MIGA #MIGAwithPahlavi pic.twitter.com/F34fkrZeXR
It’s not all AI. One video found by Citizen Lab was probably edited by a person. This and the other videos achieved much greater success than those published during the attack on the prison, with some reaching over 20,000 views and one over 60,000, much as was the case with the Gamliel video that led to the discovery of the other network.
The researchers determined that the pro-Israel campaign also included a fake news report and a deepfake video of an Iranian singer performing a protest song. For example, the network distributed a screenshot of a fake BBC Persian story about senior Iranian officials fleeing the country; BBC Persian confirmed that it had never published the story.
Analysis of various accounts identified by Citizen Lab reveals that the network is also linked to several Telegram channels that also encouraged protests in Iran, including by using real problems at the center of real Iranian protest movements.
Nearly 10 different Telegram groups that worked to encourage protests and were linked to the campaign’s X accounts were also found. These included groups that dealt with issues like Iran’s water crisis, failed infrastructure management and corruption. One avatar from the campaign posed as an Iranian woman on X and even ran an Instagram page and Telegram group for women where real Iranian women were invited to “share your story in a safe space.”
This practice isn’t very different from what pro-Iranian actors use against Israel. Contentious issues in Israel, like some religious people’s hostility toward the LGBTQ community, or criticism of Netanyahu or of the cost of living, have been central to Iranian disinformation in Israel in recent years.
According to an indictment filed against a young Israeli whom Iran recruited during the war through social media, he was required to provide his operators with photos of damage from Iranian missile strikes and was paid for his efforts. This is the other side of the coin in the influence war between Israel and Iran.
“While it is common for autocracies to deploy such tools and tactics both domestically and internationally, democratic governments should refrain from adopting the same methods,” said Alberto Fittarelli, who led the research by Citizen Lab. “Attributing influence operations to their actors and sponsors requires technical indicators that can rarely be seen in the open. More often than not, social media platforms are the gatekeepers of that data.”
Some of the fake accounts exposed by Citizen Lab betray traces of their participation in the second campaign that emerged from Israel, according to sources knowledgeable about Israel’s Persian-language campaigns. Here and there, the fake users also use the hashtag #KingRezaPahlavi, share photos and speeches of the shah’s son, and call for the restoration of the Pahlavi monarchy.