A CSIS report reveals Iran's sophisticated disinformation campaign on Bluesky, leveraging America's "forever wars" fatigue to spread narratives undermining U.S.-Israeli support against Iran. Analysis of over 9,000 posts shows that messages designed to exacerbate public divisions are the most effective, averaging 150 reposts and 470 likes. The study identifies 19 core accounts deeply embedded in 15 Bluesky communities, effectively spreading pro-Iranian content, and recommends proactive measures including AI-driven counter-messaging and platform labeling.
Every atomic assertion extracted from the underlying record, ranked by evidence strength.
Iran's disinformation machine appears to be targeting Western audiences to undermine support for the U.S.-Israeli conflict with the Iranian regime.
Messages designed to exacerbate public divisions are statistically significantly associated with a higher sharing volume, with an estimated 41 percent increase compared to other posts.
Russian and Chinese disinformation campaigns established the playbook that Iran has now adapted.
The U.S. government should use agentic artificial intelligence (AI) to systemically detect and dismantle propaganda networks.
The U.S. government, working with social media platforms, should craft a visual counter-messaging campaign to deflect AI fakes.
In this study's dataset, the Minab school strike narrative formed 6.8 percent of BERTopic's non-noise data.
Posts framed the evacuation and damage from nearby strikes at Gandhi Hospital in Tehran as a direct attack on a neonatal ward.
A Bluesky post questioned why the United Kingdom is eager to fight in "Israel's war" while showing an AI image of Trump stuck in Iran with Netanyahu looking on from above.
These posts use toxic and hateful stylized spellings to depict Israel, such as "Jizzrael," "zi0," "sionazi," and "IsraHell."
Posts in this cluster repeatedly describe Israel as a terrorist, apartheid, or genocidal state and use the destruction in Gaza following Hamas's October 2023 attack to support that narrative.
A one unit increase in positive sentiment score (VADER) is associated with an estimated 36.6 percent decrease in reposts.
Posts that are more negative in sentiment perform better on the platform.
A one unit increase in toxicity score is associated with an estimated 62.4 percent decrease in expected reposts.
Negative sentiment is estimated to support the spread of a post narrative compared to toxicity.
The second discursive pattern is built on human suffering and atrocity framing possibly intended to intensify anti-Israel sentiment.
Posts in Theme 3 are associated with an estimated 41 percent more reposts compared to a baseline of other themes.
Roughly 28% of Theme 3 posts included images, and 26% included video.
The third pattern challenges Israel's legitimacy through an explicitly ideological anti-Zionist frame.
This messaging likely sought to make continued support for the conflict feel costly, deceptive, and contrary to national interests.
The first discursive pattern depicts the conflict as the product of manipulative and self-interested U.S. leadership disconnected from the public.
This aligns with a narrative reflected in an open letter by Iran's president to the American public, which asks whose interests the war actually serves.
Recent polling finds that 61 percent of Americans disapprove of the conflict.
One example of this theme exploits the partisan divide by framing the conflict as a distraction measure.
Similar posts argue that the conflict serves as a distraction from the Epstein files and the people involved with the scandal.
Additional messaging suggests that the president started the conflict to "distract us from the real issues."
A separate effort personalizes Iran's disinformation campaign by targeting the U.S. president's family to inflame further partisan tensions.
Posts spread disinformation suggesting that Barron Trump bought oil futures shortly before the conflict.
These narratives frame the conflict as the product of corrupt leadership serving private or political interests and not the American people.
A second narrative emphasizes broader American institutional and elite dysfunction by targeting American institutions and corporations.
Foreign influence campaigns use major U.S. companies to deepen internal division and undermine confidence in the U.S. government.
A third narrative translates the conflict into direct economic and human costs for Western audiences.
The effect is to pair visible disruption at iconic U.S. companies and institutions with narrative amplification, reinforcing the perception that the conflict is producing disorder for the United States beyond the battlefield.
Theme 3 posts averaged 150 reposts, 470 likes, and 28 replies.
Iranian groups opportunistically claim responsibility for server outages.
Messaging focuses on disruption in the Strait of Hormuz, framing the war as an immediate burden for the American public.
The internal dataset shows posts targeting pocketbook issues meant to make the conflict feel immediate to Americans.
These include emphasizing rising gas and energy prices, food costs, inflation, and trade-offs between war spending and healthcare or SNAP funding.
On the human cost side, this pressure campaign has also involved large-scale disinformation efforts using AI-generated videos of U.S. flag-draped coffins, servicemembers suffering and regretting the war, and children pleading with parents not to fight.
The last framing extends beyond the United States, likely intending to widen divisions across Western allies.
The internal dataset included a distinct BERTopic cluster centered on Australian political hashtags, suggesting the presence of an Iranian-linked disinformation campaign in Australian social media circles.
Clemson research also identified a parallel network of IRGC-affiliated accounts posing as users from England, Scotland, and Ireland while pushing domestic political content tailored to those audiences, along with a Spanish-language cluster posing as users in the Americas, including accounts claiming to be in Texas, California, Venezuela, and Chile.
The internal dataset complements this finding with accounts posting in Spanish and Portuguese.
The campaign sought not only to deepen divisions within the United States but to weaken public support for the conflict across the broader Western coalition.
The core 19 accounts and their Iran-aligned narratives mainly circulate within standalone groups of users (network communities) and rarely bridge over into other communities.
Their embeddedness represents a challenge for social media platforms to identify them at scale.
Agentic AI could flag accounts for review by humans based on their community structure.
Figure 1 shows a repost network where everyday users are linked to the 19 core user accounts based on observed repost interactions.
The network structure indicates that the 19 core users are connected to a set of 15 distinct network communities on Bluesky with strong internal density and few ties to other users.
Some core accounts occupy more central network positions and receive higher repost exposure than others.
Post amplifications are concentrated in a small set of core accounts.
Core accounts 5 and 6 received the largest repost exposure (weighted_in = 5,489 and 5,301).
Core account 15 (2,470), core account 10 (2,268), and core account 1 (1,934) followed in repost exposure.
This concentration indicates that narrative circulation is not evenly distributed across all 19 core accounts.
A small number of accounts absorb a disproportionate share of repost activity and carry more distributional weight.
Core account 5 combines the highest exposure with the widest repost base (3,048 distinct reposting accounts).
Core account 10 has high exposure with a narrower repost base (587).
Page rank values reinforce the hierarchy of top accounts occupying more central network positions.
The edge betweenness is near zero for most top nodes, meaning leading accounts function less as bridges between communities and more as primary endpoints of amplification.
Amplification is highly segmented by community.
This includes Iranian groups targeting institutions such as tech companies, banks, and other high-visibility entities with cyberattacks.