Campaign Analysis
This campaign impersonates active-duty U.S. military personnel across two coordinated clusters, using AI-generated content to shape domestic U.S. narratives around the Iran conflict. The objective appears twofold: projecting U.S. military strength and morale in the Iran theater, while harvesting sympathetic engagement from both service members and military families through emotionally engineered content.
The two clusters appear to be operationally sequenced: the male-soldier cluster activates first, followed by the female-soldier cluster as the former winds down. This may indicate a testing-then-deployment pattern — the male-soldier cluster calibrating the pipeline before Iran-specific emotional messaging was introduced at scale.
| Metric | Count |
|---|---|
| Estimated accounts | 110 |
| Clusters identified | 2 |
| Total posts | 52,138 |
| Views | 3,860,667 |
| Likes | 401,940 |
| Comments | 42,522 |
| Following (all accounts) | 0 |
| Content type | AI-generated military video |
Shared Production Signatures
Two distinct production signatures link both clusters to a single automated pipeline:
A subset of accounts published videos with an identical off-template string: an Indonesian-language description of the Mount Semeru volcanic eruption, appended verbatim with U.S. Army hashtags. This is a sanitization failure — the content generation system drew from a template library that included non-English content, and a batch of posts was published before the error was caught. Only accounts sharing the same automated pipeline could produce the identical foreign-language string.
A separate subset of accounts — spanning both clusters — published the caption «Missing birthdays, hugs, and quiet nights… all for the ones I love» word-for-word. Unlike the Indonesian leak, this was not an error: it is a deliberate emotional hook, centrally issued and deployed across accounts with different personas and visual styles. Its appearance in both the male-soldier and female-soldier clusters confirms a shared content library and a single operator coordinating both.
This cluster — estimated at 77 accounts — operates through AI-generated video content depicting male soldiers in combat and base environments. Accounts claim active-duty identities, sometimes with historically impossible bios. Users in TikTok comment sections independently flagged visual inconsistencies — confirmed by dotNex's automated detection and manual inspection — while many other users engaged with the content as authentic, commenting on the soldiers' bravery and expressing support for the fabricated personas.
Core Message — Cross-Cluster Shared Caption
The caption below appears identically across both clusters, confirming a single production pipeline. The AI-generated visuals are convincing enough to attract genuine engagement — while containing artifacts that reveal their synthetic origin on closer inspection.
The same caption deployed across two separate AI-generated personas — a definitive indicator of centralized, automated content production from a shared template library.
Examples of Identified Account Profiles
Four representative accounts from the male-soldier cluster. All show zero or near-zero following counts — a structural signature of batch-created accounts with no organic social graph. @alvin.york5 is a primary AI artifact case: the bio falsely claims to be a "WWI hero, captured 132 German soldiers, Medal of Honor recipient" — a historical impossibility placing the claimed identity over a century in the past.
Across the male-soldier cluster, a recurring pattern of Chinese-language metadata surfaces in profile previews, audio field labels, and background audio — inconsistent with accounts presenting as U.S. patriotic content creators. These anomalies are consistent with proxy or device emulator misconfiguration: operators seeding accounts into Western recommendation algorithms rely on proxies or emulators to simulate local device environments. Configuration errors — mismatched locale settings, unstable proxy routing — can expose the true operating environment in platform-side metadata.
- In a video (since removed), Chinese-language speech is audible in the background — the same account subsequently posted exclusively U.S. Army content. Early-account patterns across the cluster include landscape footage recorded off a screen, sometimes with Chinese-language audio titles.
- @jake.ghost.miller links directly to a Chinese AI-character generation platform (linktr.ee/irene5080) — connecting this persona to Chinese AI content infrastructure.
This cluster — estimated at 33 accounts — deploys AI-generated video content depicting female U.S. military personnel across multiple service branches (Army, Navy, Air Force) in emotionally evocative scenarios. The content reuses the exact psychological-defeat visual template previously attributed to Iranian information operations during the Iran War: distressed female service members, engineered emotional appeal, identical compositions across multiple accounts — a template documented by Alethea and cited by the New York Times in March 2026 as a wartime disinformation fingerprint.
A second recurring overlay text — «I know you don't care about the troops in Iran but texting Hello makes my day» — is engineered to extract sympathetic engagement by invoking the Iran conflict and simulating loneliness, prompting users to reply. Account profiles use blank photos and minimal bios, a hallmark of batch-created accounts. Approximately 30% of accounts in this cluster show signs of commercial repurposing after sharing U.S. military-related videos — selling products in English and Spanish — suggesting infrastructure leased or reused across different operational contexts.
