MOSSAD, MAGA, AND THE MISSING THREAD IN FALSE FLAG CLAIMS. Why Was Mossad Absent In NCRI’s False Flag Disinfo Report? Exposing the blind spot in foreign influence analysis and its implications for U.S. discourse.

The Missing Thread: Mossad and the False Flag Discourse

In the wake of escalating global crises, from mass shootings to state-sponsored cyberattacks, a recurring theme dominates online commentary: the accusation of "false flag" operations. These claims, often framed within MAGA-aligned or nationalist online spaces, suggest that governments orchestrate or permit traumatic events to justify further control. A recent report titled False Flags and Fake MAGA by the Network Contagion Research Institute (NCRI) dives deep into this discourse, attributing its propagation to foreign adversaries such as Russia and Iran. Yet amid the detailed network analysis and data forensics, one striking omission stands out: Mossad, Israel's elite intelligence agency, is entirely absent from the report's narrative.

This silence is peculiar given Mossad's well-documented global reach and its publicly celebrated intelligence capabilities. Israeli officials have repeatedly claimed near-total penetration of Iran's security infrastructure. And yet, Mossad failed to foresee the October 7 Hamas assault on southern Israel—a multi-pronged attack involving drones, ground forces, and large-scale infiltration. For an agency boasting real-time surveillance, cyber infiltration, and HUMINT dominance, this failure is not merely tactical; it's deeply suspicious.

The Irony of Total Penetration and Zero Warning

Israel's intelligence services, including Mossad and Shin Bet, have historically presented themselves as nearly omniscient. In public and private discourse, Israeli authorities have hinted at 100% visibility into Iran's nuclear programs, Hezbollah's movements, and Hamas operations. Mossad's previous successes—abductions, assassinations, and the smuggling of Iranian nuclear archives—lend weight to this portrayal.

So how is it that a well-telegraphed assault, involving hundreds of militants and months of planning, was able to unfold without prior detection? Either Mossad's capabilities have been severely overestimated, or foreknowledge was politically inconvenient. The latter possibility leads into murky waters: the concept that the October 7 attack may have been a tolerated provocation, a sacrificial trigger to justify retribution and military escalation in Gaza.

False Flags and the Scope of Selective Analysis

The NCRI report presents a technically sophisticated breakdown of Russian and Iranian-linked propaganda pipelines. It identifies influence loops, inauthentic bot activity, and MAGA-aligned influencers who mimic patriotic language while injecting pro-Kremlin and pro-Tehran narratives. But the report's scope is curiously narrow. Figure 3 of the report itself includes "Mossad" as a central term in the keyword cluster surrounding false flag discussions—indicating that this term is prevalent in the discourse. And yet, nowhere in the body of the report is this presence acknowledged or analyzed.

This suggests either an editorial decision to exclude Israeli influence or a deeper cultural blind spot in Western intelligence assessments. Unlike Iran or Russia, whose actions are openly condemned and dissected, Israel often receives a kind of narrative immunity in U.S. policy and media circles. This asymmetry distorts the very thing the report seeks to defend: public trust and informational integrity.

Penetration of U.S. Politics and the MAGA Sphere

Beyond foreign wars and intelligence lapses, Israel maintains a highly influential presence in U.S. domestic politics. The Trump administration featured individuals with longstanding ties to Israeli interests: Jared Kushner, whose family foundation contributed to Israeli settlements; David Friedman, the ambassador to Israel; and major donors like Sheldon Adelson. These relationships were not clandestine—they were celebrated as strategic partnerships.

But strategic for whom?

The same circles that popularized "America First" rhetoric saw a parallel rise in pro-Israel policymaking, including the Abraham Accords and the relocation of the U.S. Embassy to Jerusalem. It is here that the notion of "Fake MAGA" becomes paradoxical. According to the NCRI report, MAGA was infiltrated and subverted by pro-Kremlin and pro-Iranian actors. But how does one reconcile that with MAGA's historically strong pro-Israel stance—and the visible role Israeli-aligned actors played in shaping it?

The Taboo of Criticizing Israel in Disinformation Research

Why does Mossad escape scrutiny in a document that exhaustively names every other state actor in the disinformation landscape? The answer may lie in the unspoken taboo that continues to plague Western analysis: criticism of Israeli intelligence is often equated with antisemitism, regardless of merit or evidence. This is a dangerous conflation. An intelligence agency, no matter how effective or allied, is not above critical assessment—especially when its failures or manipulations may influence the perception of truth in the West.

The NCRI report misses an opportunity to offer a fuller picture of foreign influence. By excluding Mossad and Israel from its analysis, despite data indicators and keyword relevance, it implicitly upholds a double standard. It cautions against Russian and Iranian disinformation, while remaining silent on the possibility that Israeli-linked narratives could similarly shape or fracture MAGA-aligned spaces.

An Incomplete Threat Model

The phenomenon of false flag discourse is real, and so are the foreign influence campaigns that exploit it. The NCRI report contributes valuable data to this conversation. But its omission of Mossad and Israeli strategic narratives leaves a gaping hole in its otherwise detailed framework. In an era of hybrid warfare and informational deception, selective analysis is not just a weakness—it is a vulnerability.

If America is to defend its political discourse from foreign manipulation, all players—including allies—must be brought into the light. Otherwise, the architecture of truth will remain riddled with blind spots, and the public's trust will erode further under the weight of partial revelations.

caring is sharing

NCRI Report

False Flags and Fake MAGA How Foreign and Inauthentic Networks Use Fake Speech to Destabilize the Right from Within Amid the escalating war with Iran, pro‑Kremlin and Iranian state‑linked propaganda nodes flooded American social media while masquerading as MAGA loyalists. Their coordinated playbook delegitimized nearly every headline as a false narrative, amplified Tehran’s lines, and accused Donald Trump of complicity and moral corruption. All these actions were in service of undermining American conservative unity during a time of international instability. These coordinated efforts exploited what NCRI identifies as a false flag reflex - a conditioned response that turns major atrocities into a trigger for trending conspiracy claims.

Our analysis indicates that recent high-profile crises, including Uvalde, Crocus City Hall, October 7, the Trump shooting, and other domestic attacks, triggered an immediate surge in online “false flag” discourse, emerging within minutes of initial reports and aimed at recasting the events as evidence of hidden conspiratorial plots, thereby obscuring the true motives and perpetrators. In the days following these crises, Kremlin-affiliated propagandists and Iranian state-linked media were able to rapidly inject narratives that were taken up by MAGA-impostor influencers, who then injected them into MAGA-branded spaces, often within minutes of breaking news. During one such activation window, 650,000 posts citing “false flag” narratives drew nearly four million interactions, powered by a pipeline of Kremlin-affiliated propagandists, spam-bot networks, and domestic influencers such as Nick Fuentes, Jake Shields, and Jackson Hinkle.

These figures, who have long been associated with right-wing cultural commentary, first used their platforms to propagate Kremlin-seeded narratives. These influential accounts then turned on Trump himself in a coordinated assault following a public break between Elon Musk and the President: they first turned inward to smear Donald Trump with accusations of pedophilia and Epstein ties, deploying the same bot-driven infrastructure that had amplified false flag narratives days earlier; then in the lead-up to the war with Iran, this network pivoted outward and amplified false Iranian claims that the International Atomic Energy Agency (IAEA) was operating under Israeli control, echoing Tehran’s strategic messaging. This constitutes a systematic effort to impersonate MAGA-adjacent audiences, fracture right-leaning coalitions, and repurpose nationalist symbols in service of foreign subversion.

We refer to this network of influencers as Fake MAGA. “Fake MAGA” accounts co-opt MAGA and “America First” branding to attract the same target audiences, yet our research has traced this activity to coordinated bot farms. These operations emerge swiftly, often within 48 hours of high-profile crises, and consistently use scripted tactics. Though these accounts often appear to echo or profess MAGA values at surface level, they frequently disseminate narratives aligned with adversarial foreign propaganda. Such a network operates as a constant amplification system driven by foreign seeding accounts, inauthentic engagement farms, and U.S. influencers. All of them are ready to elevate destabilizing false flag narratives within moments of a crisis. 1 Key Findings

● Hostile Information Architecture: The NCRI-identified network operates as a hostile influence system structured to degrade U.S. public trust, distort crisis perception, and redirect right-wing audiences toward foreign adversary objectives through coordinated disinformation and narrative warfare.

● Engineered Malicious Narratives: From May 22 to June 10, 2025, more than 650,000 English-language posts cited “false flag” narratives related to high profile attacks, generating nearly four million interactions. Activity spiked in lockstep with violent incidents on U.S. soil.

● Foreign Narrative Seeders: A triad of foreign-linked amplifiers–@DravenNoctis (Kremlin-tied U.S. veteran persona), @AdameMedia (UK-based Telegram pusher), and @Megatron_ron (Macedonian Russia Supporter)–seeded crisis narratives immediately following each event.

 ● Bot-Like Influence Loops: Network analysis flagged 24% of participants in “false flag” narratives as inauthentic, including clusters of bot accounts created on April 26 and October 28, 2022, suggesting long-term prepositioning for influence operations.

● The Asset-Adjacency Model: The influence network fuses coordinated foreign assets with a tier of marginal, non-credible domestic actors. Figures such as Fuentes, Shields, and Hinkle are not strategic agents, but engagement-dependent personalities operating at the periphery of MAGA discourse. As they lack institutional affiliation or consistent ideology, they subsist on narrative opportunism and algorithmic volatility. Their alignment with state-seeded propaganda arises from relevance-hunger, social isolation, and the incentives of digital attention economies. Both foreign and domestic players in this network are propped up by the same infrastructure of inauthentic engagement.

● Psychological Resonance: NCRI’s national survey finds that among Republicans, increased warmth toward Iran was one of the strongest predictors of moral license to justify violence against Donald Trump. These attitudes mirror emerging pro-Iran, anti-Trump messaging in “Fake MAGA” spaces and suggest that exposure to foreign-influenced networks may be coloring not just discourse, but psychological thresholds for endorsing political violence.

● Assessment: NCRI assesses that the coordinated influencer ecosystem promoting false flag narratives and attacks on Donald Trump is executed by inauthentic, MAGA-branded accounts and aligns with the tactical patterns of Kremlin-backed information operations: Exploitation of domestic schisms, impersonation of trusted voices, and weaponization of divisive narratives in order to destabilize political coalitions and erode institutional trust. 2 These findings suggest that what appears to be grassroots disillusionment may in fact reflect foreign-directed efforts to fracture American identity from within, raising broader concerns: How many other so-called “woke right” or MAGA-adjacent impostors now operate in parallel to pose as patriotic voices while serving as covert amplifiers for foreign objectives?

Narrative Seeding and Foreign Entry Points False flag allegations occupy a privileged corner of Russian hybrid warfare doctrine: a ready-made, easily adaptable alibi that flips blame, muddies attribution, and buys time for diplomatic misdirection. Over the past decade, the trope has evolved from a pre-invasion pretext (Crimea 2014; Ukraine 2022) into a standing tool of atrocity denialism. Figure 1. Google Trends index for the query “false flag,” from May 31, 2020 to June 3, 2025. As depicted in Figure 1, nearly every mass casualty event or political shock since 2021–Uvalde, Crocus City Hall, October 7, the Trump assassination attempt, and the May/June antisemitic attacks–trigger discrete search spikes, evidencing a reflexive “false flag” instinct that propaganda networks can reliably exploit. This pattern repeated on May 22, 2025 after a targeted shooting of foreign embassy employees in Washington, D.C. Minutes after wire reports confirmed the attack, a familiar chorus declared the incident “a deep-state stunt to gain sympathy.” Ten days later, as a Molotov cocktail was thrown at protestors advocating for the release of Israeli hostages in Gaza, the same voices resurfaced with identical sound bites, matching hashtags, and recycled memes. Pakistani state-adjacent pages, Russian military bloggers, and U.S.-based “Groypers” marched in lockstep, suggesting convergent incentives at minimum, and at worst, a shared operational backend. NCRI analyzed all posts on X made between May 1 and June 10, 2025 that contained the phrase “false flag”. These constituted more than 675,000 posts and collectively drew nearly four million interactions. Activity spiked in two sharp bursts: on May 24, following the D.C. embassy shooting, and on June 3, after the Boulder firebombing (Figure 2). These two peaks alone accounted for over 80% of total engagement (calculated as “Likes”, “Replies”, “Retweets”, and 3 “Quote Tweets” summed) during this period, confirming that high-salience domestic attacks now reliably trigger reflexive cascades of malicious “false flag” narratives. Figure 2.

Number of daily X posts containing the term “false flag,” from May 1 to June 10, 2025. To isolate narrative origins and trace ideological fingerprints, NCRI mapped the keyword lattice surrounding “false flag” posts (Figure 3). The resulting network placed Israel at the semantic center, surrounded by terms like Mossad, Zionist, Palestine, and Jews. This vocabulary was a near-verbatim match to the language pushed after Hamas’s October 7 assault, indicating that the same pre-loaded narrative architecture was reactivated here. These findings suggest a playbook redeployed to exploit new violence and reframe emergent narratives through a foreign lens. Figure 3.

Keyword co-occurrence network for “false flag” discourse on X, from May 1 to June 10, 2025. To identify key narrative drivers, NCRI analyzed the X accounts generating the most audience engagement across all posts containing the term “false flag”, then isolated to only those referring to domestic attacks. The leading amplifiers (Table 1) split into two dominant clusters: (1) foreign-linked actors including @DravenNoctis and @AdameMedia, and (2) U.S.-based influencers with MAGA branding, such as @NickJFuentes, @jacksonhinklle, and @jakeshieldsajj, who gave the campaign domestic legitimacy. Despite differing origin points, these five accounts 4 converged in timing, tone, and target, suggesting coordinated amplification across aligned ecosystems. Table 1. Top seven amplifiers 1 , by total engagement, of content on X claiming domestic attacks were a “false flag”, posted between May 1 and June 10, 2025.

At the center of the cluster of foreign-linked actors were three high-velocity amplifier accounts: @DravenNoctis is a self-described U.S. veteran and frequent contributor to Russian state media. As depicted in Figure 4, Noctis pairs U.S. economic grievance content with overt Kremlin messaging. He ridicules (with cyrilic captions) Western costs of living on TikTok (Figure 4, left) while framing America as a “slave system” designed to keep citizens poor. An article in EurAsia Daily, part of a broader campaign laundering Russian narratives through a “disillusioned American veteran” persona, shows Noctis garbed in military uniform and urging Ukrainian soldiers to defect to Russia (Figure 4, right). 1Using the term false flag doesn’t necessarily make someone an extremist; context, coordination, and intent determine this.

This report focuses on the actors, subsequently described, who use it in an inflammatory context. 5 Rank Handle Potential Reach Engagement 1 @DravenNoctis 2.4 M 332.5 k 2 @AdameMedia 5.9 M 280 k 3 @jacksonhinklle 11.9 M 120.5 k 5 @MirabelTweets1 747 k 72 k 6 @jakeshieldsajj 3.4 M 66.2 k 7 @ItsJuliansRum 1.1 M 59.7 k 8 @NickJFuentes 561 k 58.4 k Figure 4. @DravenNoctis content streams: TikTok (left), Facebook comment (center), and Russian state media (right). @AdameMedia was, before October 2023, a fringe UK-based vlogger with a small following and no clear geopolitical agenda. His content focused on anti-establishment themes, Westminster corruption, meme stocks, and online culture wars, posting sporadically to an audience of about 11,000. He had never mentioned Gaza and referenced Palestine only twice, both times in the context of UK domestic politics. The engagement inflection point for @AdameMedia would only occur after October 7, 2023 (Figure 5).

Previously inactive on Gaza and geopolitics, the account pivoted sharply after October 7, amplifying pro-Kremlin content and adopting anti-Western crisis narratives. Posting volume surged 150%, and follower count ballooned from 11K to 300K. On June 11, 2024, the account went viral for no discernable reason after three unrelated posts: a TikTok meme, a captioned Instagram screenshot, and recycled war criticism, with each tweet surpassing 3M views. The content offered no news value or novelty, and NCRI assesses that this spike was not organic. Account location log data shows post origination from the account @AdameMedia from multiple distant regions (Figure 6), including South Asia, East Africa, and the Balkans, often within the same 24-hour window. While commercial IP rotation or proxy use can produce global IP variance, the concentrated dispersal shown—paired with sudden virality, high posting volume, and synchronized narrative entry—suggests more than passive masking. It is consistent with 6 deliberate multi-region signal operations, potentially involving staged asset management or contracted amplification. Figure 5. @AdameMedia activation profile - Post–October 7, the account shifted sharply in volume and geopolitical messaging (Top). On June 11, it achieved >9M combined views across three low-salience posts (Bottom). 7 Figure 6. Geolocation data show global dispersal, consistent with potential multiple management and synthetic signal operations. [edited to accurately reflect source: talkwalker account location log data] @Megatron_ron, the last of the three key pro-Kremlin “false flag” influence feeds, is a pro-Russian “breaking news” account based in Skopje that has over 511K followers on X.

At 12:40 AM on May 22, 2025, @Megatron_ron posted a “BREAKING” video labeling the embassy shooting a false flag (Figure 7, left). Within 35 minutes, @DravenNoctis quote-tweeted this video with a scripted escalation (Figure 7, right). Combined views exceeded 4.7M within hours, illustrating how foreign seeding and domestic amplification work in tandem to hijack crisis narratives. @AdameMedia amplified the narrative hours later and repeatedly throughout the day with widespread engagement (Figure 8). 8 Figure 7. @Megatron_ron (left) initiates false flag framing; @DravenNoctis (right) amplifies. Figure 8. @AdameMedia amplifies the false flag narrative. 9 Fake MAGA, Fake Speech

The viral spread of “false flag” narratives was not confined to foreign propaganda nodes. It was rapidly adopted by a cohort of marginal actors on the fringe of the MAGA movement–figures like Nick Fuentes, Jake Shields, and Jackson Hinkle–who reframe state-directed content into culture war engagement. Hinkle, who was previously assessed by NCRI to be aligned with Kremlin interests, differs only in proximity, not in kind. Like the others, he operates as a narrative scavenger via a steady diet of outrage, algorithmic reward, and secondhand narratives. Figure 9. @NickJFuentes, @jakeshieldsajj, and @jacksonhinklle amplify the false flag narrative in the hours after the May 21, 2025 attack.

As depicted in Figure 9, Fuentes’ May 21 post (“False flag, right on schedule”) clocked 2.4M views, becoming one of the most engaged tweets in the entire dataset; however, the real story lay in the replies. Anomalous engagement patterns emerged almost immediately: replies were saturated with emoji-wall spam, identical quote-tweets, and bot-like praise loops – the hallmarks of South Asian spam-farm activity. A forensic sweep of 1,000+ accounts posting “false flag” revealed that 24% were inauthentic. Figure 10. Cyabara analysis of accounts using the term “false flag”, determining that nearly a quarter of these were inauthentic profiles. 10 Figure 11. Fuentes’s May 21, 2025 post with a wave of near-identical “💯” replies from low-engagement accounts, illustrating botlike amplification. These “Emoji-Wall Rings” featuring repetitive comment chains with little semantic variance are hallmarks of low-quality, high-yield botted engagement. To probe whether the viral “false flag” discourse was being artificially inflated, NCRI analyzed account creation dates for users replying to six high-influence false flag tweets. We uncovered two sharp spikes in account registrations: April 26 and October 28, 2022. Figure 12.

Unique account creations per day (2022) among users replying to six high-influence “false flag” tweets. These tweets were made by @Megatron_ron, @DravenNoctis, @AdameMedia, @NickJFuentes and @MirabelTweets1. Spikes occur on Apr 26 and Oct 28, 2022. 11 To further explore potential inauthenticity in accounts participating in “false flag” replies, we also conducted a reply-network analysis on commenters responding to six primary amplifiers of false flag narratives: @DravenNoctis, @AdameMedia, @Megatron_ron, @NickJFuentes, @jakeshieldsajj, and @jacksonhinklle. NCRI extracted account creation dates across the entire reply ecosystem and uncovered the same two spikes on April 26 and October 28, 2022. These spikes aligned with two major moments in the Musk-Twitter acquisition pipeline - Twitter’s announcement of accepting of Musk’s buyout offer, and the formal completion of the acquisition. Figure 13. Spikes in account creation on April 26 and October 28, 2022 (Top) align with Musk’s Twitter milestones and Fuentes’ RT broadcast calling for a “Groyper Twitter” (Bottom).

These anomalous clusters appear to be staged waves of synthetic accounts, later reactivated to amplify false flag narratives and pro-Kremlin propaganda. As NCRI has reported previously, the April 26 and October 28, 2022 account creation spikes also coincide with a coordinated influence blitz by Nick Fuentes and Kremlin-linked media. In late April, just days after Elon Musk announced plans to buy Twitter, Fuentes appeared on Russia’s state-backed network RT, promoting the acquisition as a liberation event for banned extremists. Fuentes explicitly branded the moment as the launch of “Groyper Twitter,” signaling a call to action for white nationalist followers to flood back onto the platform.

Our analysis shows that a sizable proportion of accounts were created en masse within 48 hours of this moment. These are not typical users because they disproportionately populate the reply networks of later false flag narratives and display known bot-like patterns. The same 12 pattern recurred on October 28, as Musk formally took control of Twitter. While Musk’s acquisition triggered a real wave of user enthusiasm, the data indicate that Fuentes’ Kremlin-backed push also seeded a parallel wave of inauthentic accounts engineered to mimic pro-MAGA sentiment while advancing extremist and foreign agendas. 2 MAGA Freeloaders: How Inauthentic Networks Betrayed Trump from Within Accusing Trump of Pedophilia: After mimicking MAGA to gain trust, inauthentic networks turned their hostilities inward, flipping suddenly, aligning with foreign adversaries, and targeting the very figurehead of the movement: Donald Trump. Following Elon Musk’s public split with Trump, Kremlin-aligned influencers and their inauthentic reply brigades launched a smear campaign accusing Trump of pedophilia and Epstein ties (Figure 14). @AdameMedia amplified a video clip of a Trump accuser and Jackson Hinkle posted Epstein photos. All accounts had just days earlier been pushing “false flag” claims in MAGA-aligned language. 2 These account creation spikes on April 26 and October 28, 2022 appear to be specific to accounts involved with the influence campaigns mentioned above. To establish this, we performed a similar analysis of creation dates for accounts replying to pop culture tweets; see Appendix 2.

In that analysis, a single large spike did indeed coincide with an inauthentic amplification campaign surrounding a Kim Kardashian product launch; however, that spike occurred at a completely different date: May 2025. This analysis further validates the “account creation date spike” method as a means of detecting inauthentic activity, and it also shows that the April 26 and October 28, 2022 account creation spikes are not observed in the context of content that is apolitical.

13 Figure 14. Coordinated pivot: the same influencers who pushed the “false flag” narrative @DravenNoctis, @jakeshieldsajj, @NickJFuentes, @AdameMedia, and @jacksonhinklle revive Epstein-file accusations to smear Donald Trump, framing him as compromised and rapidly shifting to character assassination.

14 Boosting Iran: On the morning of June 12, 2025, a coordinated Iranian media campaign, originating from Press TV–an IRGC media front–published 6 documents purporting to contain emails between Merav Zadoni-Odiz, Israel's permanent representative to the IAEA, and Washington University St. Louis lecturer Elai Rettig.

Press TV first claimed the leaked papers “show that IAEA chief Rafael Grossi has been completely coordinated with Israel and has been carrying out Israel’s orders.” @Megatron_ron repeated the line nearly verbatim, grammatical slip and all (“has been fully coordinated”; Figure 15, top row). NCRI reviewed the leaked emails and determined they reflect routine logistical coordination between Merav Zadoni-Odiz and Elai Rettig regarding a November 17, 2020 academic webinar titled “Nuclear Energy in the Middle East.” The exchange focused on scheduling, structure, and panel topics—standard practice for IAEA-affiliated outreach. The emails did not indicate espionage, covert coordination, or IAEA subservience to Israeli interests. The tone was neutral and offered no clear insight into the nature of IAEA-Israel relations. Furthermore, the emails pointed more towards active engagement with Iran than with Israel. Finally, as Merav notes, Israel’s relationship with the IAEA has no bearing on Israel’s official nuclear policy. As tensions continued to escalate in the Middle East, @Megatron_ron and @DravenNoctis amplified Tehran propaganda originating in a June 12, 2025 post by Press TV, alleging Zionist control of the IAEA. Initial posts from Press TV and IRGC-linked profiles were echoed within minutes by the same influencers who had attacked Trump days earlier (Figure 15, bottom row).

Commentary by Nick Fuentes appeared on Iranian state media following Israel’s preemptive strike on Iran on June 13, 2025 (Figure 16). A video segment from Fuentes’s Rumble show, America First with Nicholas J. Fuentes, was dubbed and broadcasted on the Islamic Republic of Iran News Network (IRINN) the same day as the initiating strike. In the clip, Fuentes claimed he had long warned that supporting Donald Trump in 2024 would lead to a betrayal of America First principles, including entering a war with Iran.

15 Figure 15. Press TV’s June 12, 2025 post accused IAEA chief Rafael Grossi of “acting on Israel’s orders” is echoed by “Qasim Suleimani Army” @Suleimani_313 and by @Megatron_ron, as well as boosted by @DravenNoctis.

16 Figure 16. Nick Fuentes video segment discussing the Israeli strike on Iran, featured on the Islamic Republic of Iran News Network on June 13, 2025. Fake MAGA, Real Risk: Among Republicans, Iran Sympathies Track Violent Animosity Toward Trump In response to pro-Iran and anti-Trump rhetoric emerging in MAGA-aligned channels, NCRI surveyed 864 U.S. adults (via Qualtrics + Amazon Prime) to test whether warmth toward Iran predicted support for political violence. Participants rated their favorability toward Iran on a 0–10 “feeling thermometer” (in increments of 0.1) and indicated whether killing Donald Trump could ever be justified (Figure 17).

Among Republicans, warmth toward Iran emerged as one of the strongest predictors of justification for Trump’s murder (r = 0.28, p < 0.001). Those with warm views toward Iran were more than twice as likely to endorse the killing (38.3%) compared to those with cold views (15.7%). The finding suggests that pro-Iran narratives circulating in Fake MAGA spaces may be shaping permissive attitudes toward lethal violence.

17 Figure 17. Among Republican respondents (n = 312), those expressing high warmth toward Iran were more than twice as likely to justify the killing of Donald Trump compared to those expressing low warmth (Top; 38.3% vs. 17.1%). Warmth toward Iran, measured via a standard 0–10 feeling thermometer, was among the strongest predictors of violent endorsement (Bottom; r = 0.23, p < 0.001). These results reflect attitudinal patterns that mirror pro-Iran, anti-Trump rhetoric circulating in Fake MAGA-aligned channels.

18 Conclusion: Fake Speech, Fake MAGA, Real Consequences NCRI’s investigation reveals a reusable architecture of influence: a pipeline that blends foreign propaganda nodes, synthetic amplification, and opportunistic domestic actors to impersonate and fracture MAGA-aligned discourse from within. What appears as grassroots outrage is often a staged cascade: beginning with foreign-linked accounts injecting crisis narratives, then rapidly picked up by a layer of ideologically unmoored influencers whose engagement relies on algorithmic volatility rather than real constituencies.

The result is Fake MAGA: a reactive, low-fidelity simulation of nationalist sentiment that can be re-skinned for any agenda, whether blaming “deep state” actors for mass violence, turning on Trump with Epstein conspiracies, or laundering Iranian intelligence leaks. This pipeline is no longer event-dependent; it is modular, ever-online, and ready to exploit the next domestic flashpoint. The mechanism is now clear: Foreign-linked seeders (principally @DravenNoctis, @AdameMedia, and @Megatron_ron) inject crisis narratives within minutes of breaking news. Their content is then mass-republished by clusters of inauthentic accounts, many of which exhibit coordinated creation dates (notably the April 16 and October 28, 2022 spikes) that align with earlier influence drives around Elon Musk’s Twitter takeover. Domestic personalities with large but unstable followings (Nick Fuentes, Jake Shields, and Jackson Hinkle) supply a veneer of grassroots legitimacy, completing an “asset-adjacency” model in which fringe U.S. influencers ride the same engagement farms that propel Kremlin messaging.

The network’s goals extend beyond crisis exploitation. After leveraging the “false flag” frame to pose as MAGA loyalists, the same actors pivoted to accuse Donald Trump of pedophilia and to disseminate Iranian state leaks portraying the IAEA as an Israeli proxy. Such turn-on-a-dime shifts confirm a broader strategy: impersonate trusted right-wing voices, fracture their coalitions from within, and recycle nationalist symbols for foreign ends. Psychological data further reinforce this threat architecture. NCRI’s national survey found that among Republicans, warmth toward Iran was one of the strongest predictors of moral license to justify violence against Donald Trump. These findings reflect a broader dynamic: the Fake MAGA pipeline not only distorts information, but appears to shift attitudes at the level of affect and moral reasoning. What enters the system as imported propaganda can exit as internalized animus, legitimizing extreme positions in unexpected segments of the electorate. As fringe actors echo foreign narratives, they may be reshaping not just discourse but also disposition, subtly lowering the threshold for violence in an already volatile political climate.

NCRI therefore assesses that the observed campaigns are not isolated bursts, but part of an enduring architecture of coordinated inauthentic behavior. As long as foreign seed accounts, bot-laden amplification rings, and engagement-hungry fringe influencers remain intertwined, every future domestic shock will provide a fresh launchpad for destabilizing narratives.

19 In an environment of decentralized threats, lone actors, flash mobs, and stochastic violence, the cost of corrupted speech isn't abstract. It scrambles law enforcement priorities. It misleads the public. It sabotages institutional response at precisely the moments that demand clarity.

20 Appendix 1: South Asian Spam Farm Examples of identifiers that indicate if an account showing bot-like activity appears to be affiliated with known South Asian networks. These accounts typically rely on high-frequency, low-quality output–such as Emoji-Wall Rings–and tend to follow accounts of political and social interest to South Asian nations like Pakistan.

21 Appendix 2: Account Creation Date Analysis To ensure that the observed spikes in account creation dates weren’t simply a reflection of X’s general account creation date patterns, we ran an identical account creation date test on a neutral control dataset of replies to pop culture tweets. The control had a single large spike in account creation dates – corresponding primarily to botted replies to @KimKardashian’s May 2025 product launch – but notably had zero significant account creation date spikes in 2022. This contrast reinforces the point: the April/October 2022 cohorts of accounts orbiting the false‑flag narrative represent coordinated instrumentation, not organic chatter.