Bot Networks Hijack European News Comment Sections in Mass Disinformation Campaign
A landmark investigation by the Eurovision News Spotlight network has uncovered systematic, large-scale manipulation of comment sections on Instagram and Facebook accounts run by major European public media outlets. The joint investigation, published on July 9, 2026, analyzed over 17.5 million comments collected over 12 months and revealed bot networks, fake accounts, and coordinated campaigns designed to influence public opinion across multiple countries.
The investigation, involving ten European public service broadcasters including ORF (Austria), RTVE (Spain), RFI (France), LRT (Lithuania), Swissinfo (Switzerland), BR24 (Germany), France 24, ARD’s Tagesschau, ZDFheute (Germany), and RTBF (Belgium), found that one topic generated more coordinated inauthentic activity than any other: Iran.
Iran: A Digital Battleground
As protests against the Islamic Republic of Iran intensified from January 2026, at least three distinct coordinated networks were found operating simultaneously on the same platforms, sometimes beneath the same posts, according to the Eurovision News Spotlight investigation.
The largest coordinated community identified across the entire dataset supported the Iranian opposition and its figurehead Reza Pahlavi, an exiled opposition figure and eldest son of the former Shah of Iran. This network generated tens of thousands of comments using shared hashtags such as #KingRezaPahlavi, #FreeIran, #IranRevolution2026, and #DigitalBlackoutIran, often employing near-identical template text likely distributed through messaging apps.
A telling forensic detail emerged: a misspelled hashtag, #DigitalBlackoutlran (with a lowercase ‘l’ replacing the capital ‘I’), appeared identically across comment sections of ORF, ZDFheute, France 24, LRT, Tagesschau, and RTBF. ORF also found traces of this hashtag on Telegram, though its true origin remains unknown.
Alberto Fittarelli, an expert in cybersecurity and disinformation at the University of Toronto, told ORF that the pro-Pahlavi movement online is largely led by real people but also supported by “accounts that are clearly bots or automated, pushing high volumes of content in short spans of time,” as well as a “gray area that often consists of probably real accounts that are highly coordinated across different platforms.”
Pro-Regime Bot Network and Incitement to Violence
Running in parallel was a network supporting the Iranian government and opposing protesters. Network analysis revealed a cluster operating with near-perfect internal connectivity. More than 200 accounts posted the identical phrase on January 24, 2026 — with over 190 comments appearing within a single minute on Tagesschau’s Instagram page, as reported by Swissinfo.
Most alarmingly, on March 2, 2026 — days after the beginning of the U.S.-Israeli war on Iran — a coordinated bot network posted identical text on Tagesschau and ZDFheute Instagram pages calling on Muslims worldwide to take violent revenge against the West and Zionists. Of 414 comments on one ZDFheute post, 153 contained this identical call to violence. This coordinated incitement to violence represents the gravest category of activity identified in the investigation.
Beyond Iran: Antisemitism, Geopolitical Conflicts, and Financial Scams
The investigation found further evidence of coordinated manipulation beyond Iran-related content. On ORF’s Zeitimbild Instagram account, a bot network of more than 180 accounts began with criticism of Israel’s military actions in Gaza before escalating to antisemitic hate speech illegal under Austrian law, according to ORF’s reporting. By tracking the bots, ORF made contact with an influencer who had purchased comments from a Turkish agency, providing insight into the commercial infrastructure behind such operations.
France 24’s Facebook account was targeted by a geopolitical campaign linked to the Cambodia-Thailand border conflict of July 2025. Around 100 accounts used for this campaign were created on the same day, and approximately 1,000 of 7,000 comments were posted at intervals of under five seconds.
Several outlets also found financially motivated networks promoting money-making schemes, social media growth services, and the ‘richboyjames’ persona — a pattern consistent with commercial engagement-farming services that artificially boost content visibility.
A Window Into a Larger System
The investigation, originally published by RTBF, frames these coordinated comment campaigns as potential instruments of hybrid warfare — tools used beyond traditional battlefields to sow division, inflame tensions, and radicalize audiences. An extreme comment from one source can be made to appear as though it has the backing of thousands in a manufactured debate.
Notably, the investigation did not determine who was behind the various coordinated messages. The data collection period ended March 31, 2026, meaning the current status of these networks remains unknown. Comment moderation systems already blocked some offensive content, suggesting the identified trends may be conservative estimates.
What to Watch For
The findings raise urgent questions about platform accountability, the scale of manipulation on other social media platforms, and the role of messaging apps in coordinating such campaigns. As European public broadcasters continue to strengthen their defenses, the investigation serves as a stark reminder that comment sections are merely one visible corner of a much larger information warfare landscape.