Overview
- Pakistani outlets, which published their findings Saturday, detailed a coordinated network that used fake Iranian identities and accounts run from India and Afghanistan.
- Investigators traced narrative control to Indian-linked master accounts, naming Times of Iran News as a hub, while Afghanistan-based accounts boosted the posts to mimic Iranian public anger.
- The operation followed an Initiator–Proliferator–Amplifier playbook that began with ghost pages like INN Iran News and Iran TV and relied on recent account creation, username and location swaps, and regional app-store traces.
- Network mapping highlighted an early post on March 26 from @HosseinNejat1 tied to Afghanistan platforms and pointed to an individual operator, Ahsan Agha, also known as Haider Hashmi, allegedly managing several pages.
- Security and media sources say the aim was to paint Pakistan as anti-Iran with false claims about helping ship oil for the United States, a move they warn could undercut diplomacy and strain already tense border trade and security.