Fake accounts pose as candidates, reporters to push pro-Iran agenda

A propaganda effort possibly out of Iran has been using Facebook and Twitter to try and impersonate real Americans, including a handful of US congressional candidates, according to new research.

The English-language propaganda effort was partly focused on posing as Republican political candidates that ran for Congress last year, the cybersecurity firm FireEye said in a report on Tuesday. "These accounts appropriated the candidates' photographs and, in some cases, plagiarized tweets from the real individuals' accounts," the company said.

For example, one Republican candidate targeted was Marla Livengood who ran for Congress in California. A fake account on Twitter was created to mirror her official account only to then send out tweets containing pro-Iranian messages, as well as content critical of Saudi Arabia.

Another tactic involved creating accounts pretending to be activists and reporters, including one that claimed to be a correspondent for Newsday. The efforts managed to dupe at least a few US and Israeli media outlets into publishing their propaganda through guest columns, reader letters and blog posts.

"One persona, 'John Turner,' maintained a blog on The Times of Israel website from January 2017 to November 2018, and wrote articles for the US-based site Natural News Blogs from August 2015 to July 2018," FireEye said. "The letters and articles primarily addressed themes or promoted stances in line with Iranian political interests, similar to the activity conducted on social media."

The same fake accounts also managed to trick real-life people in the US and UK, including an activist, radio talk shot host, and a former US government official into recording interviews. The resulting content was then shared over the internet, and generally contained pro-Iranian messages.

Still, the reach of the propaganda appears to have been minimal on Facebook, which has shut down a total of 51 user accounts, 36 pages, seven groups and three Instagram accounts affliated with the misinformation campaign.

"About 21,000 accounts followed one or more of these Pages, about 1,900 accounts joined one or more of these Groups and around 2,600 people followed one or more of these Instagram accounts," Facebook's head of cybersecurity policy Nathaniel Gleicher wrote in a post on Tuesday.

Twitter, on the other hand, said it removed more than 2,800 inauthentic accounts linked to the propaganda campaign earlier this month. How many followers these accounts managed to attract wasn't made clear. But according to Twitter's head of site integrity Yoel Roth, "these accounts employed a range of false personas to target conversations about political and social issues in Iran and globally. Some engaged directly through public replies with politicians, journalists, and others."

FireEye suspects the propaganda campaign operated out of Iran partly because one of the fake accounts used was created back in 2010, and made two tweets in Persian that appear to be of personal nature. However, the cybersecurity firm refrained from linking the activities with the Iranian government. Overall, FireEye only assesses with "low confidence" that the campaign was tied to supporting Iranian political interests.

Still, it isn't the first time FireEye has found evidence linking a propaganda campaign back to Iran. Last year, the cybersecurity firm helped uncover how a non-profit media group called Liberty Front Press may have been spreading propaganda on Facebook on behalf of Iranian state media.

This article originally appeared on PCMag.com.