A well-orchestrated disinformation campaign has been uncovered, featuring Indian and Afghan operators posing as Iranian accounts to aggressively target Pakistan on social media, particularly at a time when the country, along with other friendly countries was actively engaged in the efforts to de-escalate tension in the region.
The campaign spreads false claims that Pakistan has betrayed Iran by allowing Pakistani-flagged vessels to transport oil through the Strait of Hormuz to Iran’s enemies, despite Tehran’s trust in Islamabad as a Muslim nation.
The campaign was initiated by Afghan-based accounts. One of the earliest posts appeared on March 26, 2026, from the account @HosseinNejat1 which was created in November 2025 and listed as based in Central Asia. The account has undergone one username change and is connected via the Central Asia Android App. It was initially followed by Afghan users.
Similar fabricated posts repeating the identical narrative were issued by multiple Afghanistan-based accounts, including:
@Army_of_Afghani connected via the Afghanistan App Store; @fqyrzadh079, connected via the Afghanistan Android App; and @GlobNow34163, based in Afghanistan, and connected via the Afghanistan Android App.
Analysis of the network shows that several propaganda accounts – including Afghan Guardian (@WakhanIntel), Kabul Frontline (@FrontlineKabul), News File, Islamabad Post, Afghan Defense, Falcon Defence, The Scoop, and Heart of Asia – are managed by the same individual operating under the name Ahsan Agha, also known as Haider Hashmi (@sHaidarHashmi).
On the Indian side, the disinformation was amplified by accounts with clear Indian origins that were rebranded to appear Iranian or pro-Iranian. Notable examples include: @INNewx (INN Iran National News), @Timesofiraan (Times of Iran News), which shows multiple location changes from Bihar, India, and earlier usernames linked to Indian identities; @MojtabaKhamen (Mojtaba Khamenei Commentary), previously operated under the username RahulTi30553541 and the name Rahul Tiwari; @GlobalReportNow presented as a Western news agency; and @AyatollahArafi (Ayatollah Arefi Commentary), previously under the username Rob_JGR_FAN and the name Manoj K, connected via the South Asia Android App.
All the accounts exhibit similar suspicious patterns: recent creation or reactivation dates, frequent username changes, location shifts from India or Afghanistan, and connections through regional Android apps, while posting identical content designed to portray Pakistan as having betrayed Iran.