Subscribe now

Folarin Balogun received a straight red card in the United States’ match against Bosnia and Herzegovina on July 1 after referees reviewed slow-motion footage and determined he committed a “serious foul.” The penalty carried a one-game suspension for Balogun, meaning he would not be allowed to play for the U.S. team’s round-of-16 match against Belgium on July 6.

Four days later, on July 5, tournament officials overturned the suspension and confirmed Balogun would be eligible to play against Belgium. Subsequent news reports revealed that the highly unusual decision came after President Donald Trump personally intervened in the matter, asking FIFA president Gianni Infantino to have officials reconsider Balogun’s suspension.

The ruling was met with outcry across the international soccer community, even after Belgium eliminated the United States with a 4-1 victory, resurfacing longstanding concerns over the FIFA president’s extraordinary efforts to satiate Trump ahead of the 2026 World Cup and FIFA officials’ history of corruption. Some have even called for outside investigations into Infantino’s role in reversing the suspension.

Alternative Platform Activity After Balogun’s Reversed Suspension

Open Measures sought to assess how FIFA’s decision to reverse Balogun’s suspension impacted online discussion of the 2026 World Cup and FIFA officials on platforms we monitor ahead of the final match on July 19. While the FIFA World Cup draws a global audience of fans who speak a variety of languages, we limited our analysis to English-language posts, which we surfaced using the following search query:

(FIFA OR “World Cup”) AND (corrupt* OR rigg* OR brib* OR fix* OR scandal* OR fraud* OR “match-fixing” OR “predetermined”)

Our query surfaced posts on nearly every platform we monitor, but the highest numbers of results appeared on Bluesky, Fediverse platforms, Disqus, 4chan, and Telegram. Together, users on those five platforms shared more than 38,000 posts doubting the integrity of FIFA and the World Cup since the tournament began on June 11.

Using our platform’s Timeline tool, we visualized those 38,000 posts since June 11 by daily volume across all five platforms mentioned above. Viewed over time, we were able to observe an activity surge across platforms that followed news reports of Trump’s involvement in the decision to overturn Balogun’s suspension.

Shifting Online Narratives Ahead of 2026 World Cup Final

We used Research Assistant to summarize prominent narratives across the posts we identified between July 8 – two days after the US match against Belgium – and July 15, the date of our analysis. As the discussion about Balogun’s reinstatement controversy subsided, we saw users on platforms we analyzed extend their claims of match-rigging and corruption onto subsequent matches.

As the World Cup moved on, the users we reviewed expressed their beliefs that FIFA was rigging matches to favor Argentina, citing specific video assistant referee decisions, favorable draws, and on-field penalty rulings. Multiple posts referenced the 2015 indictment of FIFA officials on corruption charges.

On the platforms we reviewed, some users also commented that online accusations of match-rigging in the World Cup seemed more pervasive in 2026 than they had in years prior.

What We’re Watching

The World Cup, of course.

FIFA’s unusual decision to reverse the suspension of a United States player after Trump asked the organization’s president to intervene breathed life into longstanding skepticism about the integrity of the World Cup and of FIFA’s leadership. Open Measures will continue to monitor for similar narratives as they evolve across platforms.

Subscribe now

As Open Measures’ chief of staff, I regularly speak with research analysts and threat monitoring teams who use our platform to ask them about their experiences, how it compares to other tools they’ve used, and if there are things we can do to make their work easier. In nearly all of these conversations, professionals share their frustrations that the research tools they rely on lack comprehensive coverage of the sources they need to monitor.

For years, digital threat detection tools were designed to watch for activity on major platforms and flag harmful content when it surfaced at high volumes. But this approach has been rendered obsolete by evolutions in the online landscape, as threat actors have spread out across many niche communities and alternative platforms.

Despite contrary claims, the influence of these relatively fringe spaces has not diminished in recent years; in many ways, their impacts are as pronounced as ever. Even as mainstream platforms have seen a sizable uptick in toxic content after curbing their enforcement programs, alternative platforms continue to serve as vital launchpads for violent extremism, online abuse, cybercriminal activity, disinformation campaigns, and harmful narratives.

But the inherent limits of many tools prevent analysts from seeing the entire ecosystem. Many teams have told us that they’ve tried to address these coverage gaps by using multiple tools at once: a process they describe as time-consuming, imperfect, and emotionally taxing. This piecemeal approach drastically slows their response time, results in them missing important signals, and contributes to analyst burnout.

Teams that broaden their monitoring to include alternative platforms are also forced to contend with reviewing the massive amounts of data they can introduce into their analysis. This concern has become especially pertinent in recent years, as a growing number of threat actors adopt artificial intelligence tools to intensify the impacts of their activities.

Some online monitoring platforms have tried to address these challenges by offering AI-driven features capable of compressing millions of data points into short reports for analysts to review. While the summaries these tools generate can appear comprehensive, few are fully transparent in how they produce their findings or the limitations they possess, making it difficult for analysts to fully trust their outputs.

Most AI-driven analysis tools available today bake in assumptions or make decisions on behalf of the analysts using them that can’t be altered, and the reports they generate often obscure coverage gaps and lack citations for the data points used to form their conclusions. The fixed presets in black-box tools often miss low-volume signals that precede escalations and low-profile threat actors, and they can prove to be wildly inconsistent in their flagging, interpretation, and classification of potential threats – ultimately hurting analysts more than they help them.

Large language models (LLMs) and similar technologies can offer significant time-savings to analysts and threat detection teams, especially those who use tools that include data for alternative platforms and niche communities. But for those tools to be useful, they must be customizable and show the hidden scratchwork behind the reports they generate. Even the best software cannot provide a substitute for human oversight and expert decision-making.

At Open Measures, we recently introduced an LLM-powered tool (Research Assistant) into our platform that seeks to address these gaps with a “human-in-the-lead” design philosophy, where users maintain control over how it gathers data and receive outputs that are clearly explained and auditable. Instead of trying to replicate our users’ expertise and intuition, we’ve aimed to create a tool that empowers it.

The analysts and safety teams I speak with keep asking for the same things: a fuller field of vision across today’s threat landscape and transparent tools that can help them process all that extra data. As the digital ecosystem expands and places additional strain on monitoring efforts, it’s critical that we take those requests to heart and trust that the professionals know best.

Subscribe now

Patriot Front and Active Clubs

Patriot Front is a white nationalist hate group founded in 2017 by Thomas Rousseau, a longtime far-right activist and former member of the now-defunct white supremacist group Vanguard America, alongside other defectors and supporters. Rousseau launched Patriot Front weeks after the deadly “Unite the Right“ rally in Charlottesville, Virginia, amid a flood of critical news coverage and disputes among “alt-right“ leaders about the racist movement’s future.

Rousseau intended for Patriot Front to solve what he considered to be an optics problem for white nationalism. In lieu of overt extremist aesthetics and violent tactics, Patriot Front’s public image is carefully curated, and the bulk of its efforts are dedicated to crafting and disseminating propaganda through flyering campaigns, flash demonstrations, and stylized social media content. To obscure its extreme beliefs, the group employs vague patriotic themes and co-opts mainstream conservative talking points; likewise, its members wear polo shirts and khakis and carry American flags to soften their public image.

Leaked internal documents recently revealed that Patriot Front counted more than 500 people on its membership roster this year and indicated that the membership had roughly doubled in size year-on-year since its formation. The documents also showed that Patriot Front had expanded its previously reported efforts to integrate with white supremacist “active clubs” in order to increase recruitment.

Active clubs are white nationalist groups that frame racist activism as a fitness-oriented “lifestyle” men can adopt to improve themselves while bonding with others. The groups are decentralized and leaderless, adhering to a “white nationalism 3.0“ model popularized by neo-Nazi Robert Rundo in 2020, though individual clubs frequently network with one another through social media and in-person events. As the number of active clubs has grown in recent years, proponents have also launched similarly styled “youth clubs,” which target teenage boys, and expanded the model internationally.

Hundreds of Patriot Front Members Stage Surprise Independence Day Rally in DC

This year, hundreds of uniformed Patriot Front members flocked to the nation’s capital to participate in an unannounced demonstration on the morning of July 4. The group paraded through Capitol Hill, displaying an assortment of American flags and chanting one of Patriot Front’s slogans: “Reclaim America.”

After the march, Rousseau delivered a brief speech in which he explained that the protest was meant to counterprogram the “shallow displays” planned for the nation’s semiquincentennial anniversary, which he claimed were intended to “conceal” the supposed “ethnic replacement” being perpetuated against white Americans. Rousseau said that Patriot Front hoped to spark a racial “revolution” against the “enemies of our people,” whom he specified to include “Jewish cabals,” “Mexican cartels,” “African criminals,” and “homosexual peddlers of vice and exploitation.”

Patriot Front’s protest generated headlines across national news media and reinvigorated longstanding debates about the group. For years, prominent right-wing media figures have baselessly claimed that Patriot Front is a fake organization created by antifascist activists and federal law enforcement to harm the reputations of conservatives who support President Donald Trump.

Over the days that followed their demonstration, Patriot Front and its online allies celebrated the online attention and news media interest they had garnered for their organization. Rousseau appeared on several podcasts after the event to boast about its success and call on his fellow white nationalists to take similar actions.

Active Clubs Share Footage of Patriot Front’s Rally Across Telegram Channels

Following Patriot Front’s rally on July 4, we used our platform to search for posts that mentioned the demonstration across more than 140 Telegram channels directly associated or closely affiliated with active clubs and youth clubs to see how they responded to the rally in the 24-hour period after it occurred.

Upon closer review of the posts we identified, we noticed that 14 different channels affiliated with active clubs had reshared the same post from a Patriot Front-affiliated channel, sometimes in rapid succession. This pattern suggests that a number of active club Telegram channels may be centrally controlled – and provides hints as to which active clubs may be linked to Patriot Front.

The majority of the posts we identified in active club and youth club channels were reshares of the same post from “Patriot Front Sightings”, a Telegram channel dedicated to highlighting the group’s offline activities. (While the channel is clearly supportive of Patriot Front, the account’s bio states that its posts “may contain sentiments not endorsed by the organization.”)

On the morning of July 4, Patriot Front Sightings shared a six-second video clip showing Patriot Front members arriving in Washington, D.C., ahead of their planned demonstration. About an hour and a half later, we saw the post begin to circulate among active club and youth club channels in short bursts.

Within the span of two minutes, the Patriot Front Sightings post was shared by two Telegram channels affiliated with active clubs in Texas and West Virginia, and a channel representing youth clubs across the US (“United Youth”). All times shown have been converted to Central Standard Time:

• 9:28 AM: United Youth (National)

• 9:28 AM: Lone Star Active Club (Texas)

• 9:30 AM: Appalachia Active Club (West Virginia)

Later that afternoon, the post was reshared by another trio of channels affiliated with an active club and youth club based in Kansas City, Missouri:

• 4:32 PM: Heartland Youth Club

• 4:44 PM: Heartland Active Club

• 4:44 PM: Heartland AC Public Chat

Half an hour later, the post was shared by five channels affiliated with active clubs in Florida in a single minute:

• 5:17 PM: Florida Active Clubs

• 5:17 PM: Florida Panhandle Active Club

• 5:17 PM: North Florida Active Club

• 5:17 PM: Central Florida Active Club

• 5:17 PM: SW FLORIDA Active Club

What We’re Watching

Open Measures will continue to track the growing number of active clubs and youth clubs using social media to spread propaganda and recruit prospective members. The rapid succession of identical posts about Patriot Front may indicate that the hundreds of social media accounts we track for such groups are working together more closely than their ostensibly decentralized structure might imply.

Further investigation is needed to confidently affirm the likelihood that channels affiliated with active clubs and youth clubs are run by a smaller number of individuals than they purport to represent, and whether their distribution of Patriot Front propaganda could indicate ties between those channel owners’ and the organization.

TLDR

Background

The unauthorized buying, selling, and trading of compromised or fraudulent online accounts – known as “account trafficking” – is a persistent concern for platform trust and safety teams and cybersecurity professionals, who have seen illegitimately acquired or created accounts used to fuel a broad range of cybercriminal activities and digital security threats.

Sellers of trafficked accounts typically acquire them through illicit methods, like hacking or phishing, or create them using fake information, sometimes using stolen identities or forged documents. Trafficked accounts are often marketed in bulk quantities in niche communities tied to other forms of cybercrime, and are offered at various prices depending on their attributes (such as age, credentials, and verification status).

Beyond dark-web marketplaces and niche forum boards, trafficked accounts are also marketed to prospective buyers on the encrypted messaging app Telegram. Despite the company’s recent efforts to crack down on illicit activity on its platform, our research has repeatedly found that Telegram remains a top choice for cybercriminal networks selling stolen web data, advertising questionable software, promoting scams, and other nefarious activities.

Our Approach

Open Measures sought to better understand how account traffickers have used Telegram to promote the illicit sale of accounts on U.S.-based tech platforms, using our platform to analyze posts advertising buyable accounts that appeared in our datasets.

To identify Telegram posts tied to likely account trafficking networks, Open Measures built search queries designed to surface posts in our platform that named at least one major U.S.-based tech company or platform across seven industry sectors (1) and included language indicating the sale of accounts for those services (2).

Our searches targeted posts that named one of the companies listed below and contained the abbreviations “WTS” or “WTB” (shorthand for “want to sell” and “want to buy”) or included both a variation on the word “account” and a dollar sign indicating a sale price. We limited our search to posts shared between July 1, 2025, and July 1, 2026, capturing a yearlong period in our analysis.

The companies included in our search queries were as follows, grouped by sector:

• Payment Processing: Venmo, Cash App, Zelle, Authorize.net, Chime, Square, Stripe, PayPal

• E-commerce: Amazon, Ebay, Etsy, Walmart, Target, Wayfair, Poshmark, Depop, OfferUp, TikTok Shop, Instagram Shops, Newegg, BigCommerce, WooCommerce, Squarespace Commerce, Magento (Adobe)

• Social Media: Facebook, Instagram, Twitter/X, LinkedIn, Snapchat, TikTok, YouTube, Twitch, Discord, Reddit, Quora, Threads, Nextdoor, Tumblr, Pinterest, Bluesky

• Artificial Intelligence: Claude, Gemini, ChatGPT, Copilot, Grok, Perplexity AI

• Gaming: Steam, Epic Games, PlayStation, Google Play, App Store, Xbox, Nintendo, Roblox, Minecraft

• Dating: Tinder, Bumble, Hinge, Match.com, OkCupid, eHarmony, Badoo, Grindr, Scruff, AdultFriendFinder

• App Development: Google Play, Apple App Store (with explicit mention of “developer” or “dev”)

Messages in Telegram groups can be set to automatically delete after a preset period of time, and many of the groups where account trafficking posts appeared seemed to be employing the feature – likely to minimize group members’ digital trails and evade retroactive detection from Telegram moderators. Because Open Measures archives posts in these groups before they delete, we were able to review and analyze account trafficking posts over time, allowing for analysis that would otherwise be difficult or impossible to conduct.

What Account Trafficking Looks Like on Telegram

The posts in our datasets engaged in likely account trafficking were typically found in Telegram groups and channels that were self-styled as “over the counter” – frequently abbreviated as “OTC” – cryptocurrency trading groups, where users arrange peer-to-peer transfers of digital assets outside of public exchanges. But upon closer inspection, the “OTC” groups where posts appeared actually functioned as classified boards for black-market and grey-market goods and services.

Users soliciting accounts often used a rough template for their posts, including “WTS” or “WTB” to indicate whether they were looking to buy or sell accounts, listing desired or available accounts on desired platforms, and itemizing preferred methods of payment. Some posts included prices, while others invited prospective buyers to contact them privately.

“Verified” and “Aged” Accounts

Posts from sellers often touted that the accounts they had available were “verified” or “aged”, making them more valuable to potential buyers seeking to exploit them for illicit or illegitimate purposes. Many of the posts advertising e-commerce and payment processor accounts claimed they were “KYC” (“know your customer”) certified, indicating that they had passed legally required identity verification steps.

Many of the posts we identified from users looking to purchase accounts from others stated that they were interested in purchasing them in bulk, with some offering premium rates for accounts that were aged or had higher numbers of followers.

Some of the posts we identified advertised other illicit goods and services alongside likely trafficked accounts, including fraudulent identification and business documents, inauthentic boosting services for social media accounts, and more.

Likely Account Traffickers Shared Millions of Listings in Telegram Posts Last Year

Open Measures’ analysis identified more than 5 million Telegram posts in our datasets that advertised or solicited purchasable accounts for at least one of the dozens of U.S.-based tech companies and platforms included in our search queries. Many of the posts we surfaced advertised several at once.

Our datasets include archives for thousands of Telegram groups and channels, including many that appear to engage in cybercriminal activities, but they do not reflect the totality of Telegram – a massively popular app with billions of users around the globe. Resultantly, the groups and channels they contain provide only a glimpse at the broader ecosystem of account trafficking activity that may be affecting dozens of U.S.-based companies across a variety of tech sectors.

Of the 5,071,864 posts our search queries identified:

• About 83.2% named a payment processing platform (4,221,436 posts)

• About 32.7% named a social media platform (1,656,215 posts)

• About 26.7% named an e-commerce platform (1,354,015 posts)

• About 8.5% named an artificial intelligence platform (429,720 posts)

• About 5.7% named a gaming platform (289,286 posts)

• About 5.6% named a dating platform (282,118 posts)

• About 5% named a web development platform (252,522 posts)

Many of the posts we surfaced with our search queries included lists of accounts for multiple platforms. As such, some posts were counted for multiple sectors.

Using our platform’s Timeline tool to visualize the number of Telegram posts that matched our search queries over time revealed a sudden spike in daily volume in early September 2025. Over the two months prior, we surfaced only hundreds of posts per day from our datasets that matched our queries. From early September onward, the volume sharply increased to tens of thousands of posts per day, largely driven by a handful of accounts that showed signs of automated activity.

We also saw a sharp drop-off in the daily number of posts in late October 2025. The reason for that sudden drop is also unclear, and this dip was not seen more broadly against the whole of our Telegram archives. But within a week of that crash, the daily volume of account trafficking posts rebounded. Since then, the daily volume of posts has remained relatively steady, seeing periods of rise and fall.

Sector-Specific Spikes of Likely Account Trafficking Activity on Telegram in 2025 and 2026

When breaking out the Timeline chart for each of the sectors included in our search queries, we saw that the volume of posts mentioning companies in each industry surged at different times. In December 2025, for example, we saw a sharp increase in the number of posts advertising or soliciting accounts for artificial intelligence, social media, dating, and gaming platforms.

Telegram’s Account Trafficking Ecosystem Appears Driven By Bot Activity

Open Measures found that likely account traffickers appeared to be using Telegram’s bot integration features to scale and facilitate their illicit activities at volumes and frequencies that would be impossible for a human user to replicate. When reviewing posts matching our search queries, we encountered thousands of identical listings for buyable accounts that had been distributed across Telegram channels and groups at intense scales and speeds.

We used our platform’s Activity tool to count how many unique posts matching our search queries were shared by each account. We found that the 15 accounts responsible for the highest number of posts matching our queries shared a combined total of 935,648 posts, making up about 18.5% of all the posts our queries identified.

On closer inspection, we saw that most of the top 15 accounts we identified showed tell-tale signs of automation, sharing hundreds – and sometimes even thousands – of identical posts per day. They uploaded content at all hours for weeks on end, with no apparent breaks for rest. And some saw sudden drop-offs in activity, indicating they may have been abandoned by their creators or taken down by Telegram moderators.

Researchers also observed that total daily activity across the top 15 accounts first ramped up in September 2025: the same period we saw overall activity surge in our datasets. On Sept. 20, 2025 – the day with the highest number of posts matching our query that we recorded – the top 15 accounts we identified contributed about 31.5% of all the posts we identified in our analysis period. This indicates that automated accounts contributed significantly to the total number of posts we identified in our analysis.

Likely Account Trafficking Activity Was Highly Concentrated in Specific Telegram Channels

When we used the Activity tool to filter the results of our search query by the channels and groups where posts appeared, we found that the 15 channels that saw the highest number of messages matching our search query were responsible for the majority of the activity we identified. More than 55% of all the posts our searches identified appeared in one of those 15 channels.

After re-charting these results against all posts that matched our search queries in our analysis period, we also saw that the top 15 channels’ activity closely followed the larger trends reflected in our datasets.

These findings indicate that automated accounts and hyper-active groups and channels played an outsized role in driving likely account trafficking we observed in our datasets, highlighting how traffickers can exploit Telegram’s unique features to further their illicit dealings on the platform.

Our Take

Cybercriminals have centered operations on Telegram for years, drawn to the platform’s unique features, privacy protections, and ease of use. Our findings paint an alarming picture of likely account trafficking on Telegram, a niche economy whose participants use the platform’s automation tools to advance their own likely illicit activities.

Without further investigation, it is difficult to say whether the posts we identified were legitimately offering the accounts they listed for sale. But if even a fraction of the posts we identified represent authentic exchanges of compromised or fake accounts, they present a serious risk for the dozens of companies and platforms they mention.

Recent political developments around the world, like age-limited restrictions on social media platforms, could drive this underground market further – creating additional incentives for cybercriminals to acquire and sell inauthentic accounts through illicit means.

4chan’s “Adult Requests” imageboard was one of the internet’s largest and fastest-growing venues for the nonconsensual trading and solicitation of sexually explicit images generated with AI tools — commonly known as “deepfakes.”

Then, on May 21, 4chan abruptly shut Adult Requests down. At the time of writing, the imageboard has been removed from the site’s index, and its URL returns an error page reading: “File not found.”

We’ve seen Adult Requests go dark before, only to return within days. But this time feels different: more than a month has now passed with no apparent sign it’s coming back.

The closure appears to have largely gone unnoticed by users on 4chan’s other boards, though a handful have voiced confusion over its disappearance and the absence of any explanation.

Earlier this year, Open Measures published an investigation into Adult Requests that exposed the scale and intensity of abuse occurring on the board. It sparked a broader wave of scrutiny — among researchers, policy analysts, and journalists — into its role in the wider ecosystem of nonconsensual intimate imagery (NCII) online.

We’re glad our report helped drive a broader reckoning with this corner of the internet, and we’ll keep watching for where its former inhabitants migrate next.

Subscribe now

As we enter the dog days of summer, here’s a look back at the research we published in June.

But first…

4chan Quietly Pulled ‘Adult Requests’ Last Month. There’s Still No Sign It’s Coming Back.

By Jared Holt

4chan’s “Adult Requests” imageboard was one of the internet’s largest and fastest-growing venues for the nonconsensual trading and solicitation of sexually explicit images generated with AI tools — commonly known as “deepfakes.”

Then, on May 21, 4chan abruptly shut Adult Requests down. At the time of writing, the imageboard has been removed from the site’s index, and its URL returns an error page reading: “File not found.”

We’ve seen Adult Requests go dark before, only to return within days. But this time feels different: more than a month has now passed with no apparent sign it’s coming back.

The closure appears to have largely gone unnoticed by users on 4chan’s other boards, though a handful have voiced confusion over its disappearance and the absence of any explanation.

Earlier this year, Open Measures published an investigation into Adult Requests that exposed the scale and intensity of abuse occurring on the board. It sparked a broader wave of scrutiny — among researchers, policy analysts, and journalists — into its role in the wider ecosystem of nonconsensual intimate imagery (NCII) online.

We're glad our report helped drive a broader reckoning with this corner of the internet, and we'll keep watching for where its former inhabitants migrate next.

What We’re Reading:

• An Influential Time (SPLC)

• Fake Dating Profiles, Real Foreign Influence (NewsGuard)

• Big Trouble on Small Forums: Largely Unknown Small Sites Driving Extremist Violence (GPAHE)

• Dear Media is the vaccine skeptical trojan horse targeting millennial women (Number Two Pencil)

• It Is Trivially Easy to Use Reddit to Manipulate AI Search, Research Suggests (404 Media)

Before you go…

• Check out recent articles in The Atlantic and Hate Comes to Main Street featuring insights from Open Measures researchers.

• Revisit our flash report about the right-wing media “antifa” narratives that set the stage for DOJ prosecutors to charge 15 anti-ICE protesters in Minnesota.

• But perhaps most importantly…

A recent article published in The Atlantic detailed how MAGA media figures have changed their tune around the botched renovation of the Lincoln Memorial Reflecting Pool, presenting those rapidly changing talking points as phases in a 13-step political spin cycle regularly seen in pro-Trump punditry.

Subscribe now

The piece featured insights from Open Measures senior researcher Jared Holt, supported by findings produced with our platform’s new Research Assistant. Holt used the Research Assistant to quickly generate a summary of evolving narratives about the Reflecting Pool across 2,500+ posts in our datasets and talked to The Atlantic to provide additional context and commentary about those findings:

These recurrent steps extend beyond Trump into the broader MAGA coalition. Recently, Jared Holt, a senior researcher at Open Measures, an organization that tracks online extremism, used a generative-AI research tool to spot patterns in posts about the Reflecting Pool by right-wing accounts on a selection of right-wing social-media platforms such as Truth Social. The tool broke down more than 2,500 posts into three buckets:

Phase 1: Triumph and Restoration

Phase 2: Defending the Project

Phase 3: Sabotage and Culture War

“For the MAGA faithful, Trump’s renovation of the Reflecting Pool was supposed to be a shining example of his efforts to restore America from its decaying state,” Holt told me. “When it became clear the renovation had been a disaster, MAGA influencers shifted their talking points to instead portray the situation as being emblematic of their critics’ depravity and derangement.” The pattern, Holt noted, is similar to how the MAGA media system responded to the ICE killings in Minnesota earlier this year, or how it has tried to spin the war in Iran. “The primary function of this media ecosystem is to hype up and pacify Trump’s base. And these days, as public support for the administration craters, it’s doing a lot more of the latter.”

Check out the full article, here:

The Atlantic

Subscribe now

Background

Libs of TikTok is a popular far-right social media account widely recognized for its role in helping to repopularize anti-LGBTQ+ hate and conspiracy theories within the conservative movement, including “groomer” narratives that falsely portray LGBTQ+ people as predatory sex abusers who target children. Since the account was started on Twitter in 2021 by Chaya Raichik, a former real estate agent, Libs of TikTok has amassed millions of followers across multiple platforms and leveraged its audience to inflict real-world harms against LGBTQ+ people and their allies.

The account’s posts routinely encourage ridicule and outrage against individuals and institutions it claims are complicit in “grooming” children for sex abuse or demonstrate the supposedly sinister dispositions of LGBTQ+ people. Among other targets, Raichik has frequently attacked public schools and their their staff, claiming they promote radical ideologies and sexual degeneracy to their students, and posted content containing the contact information for targeted faculty members. Schools and teachers featured in Libs of TikTok posts have faced bomb threats and severe harassment, causing major disruptions and safety risks.

As Raichik’s account grew in popularity with online right-wing audiences, so did her role in guiding the Republican Party’s escalating attacks on LGBTQ+ rights and public education, extending her influence far beyond the confines of any particular social media platform. Raichik and her Libs of TikTok account have directly and indirectly guided the focus of GOP policymakers, right-wing media outlets, conservative activist groups, and far-right extremists – providing them a constant roster of potential villains and hateful narratives to justify antagonizing them. President Donald Trump courted Raichik during his 2024 campaign, and officials in his second administration have consulted her on education policy and public messaging.

In addition to anti-LGBTQ+ rhetoric, the account has also targeted a host of people and organizations in posts promoting anti-immigrant sentiments and hostility toward diversity, equity, and inclusion (“DEI”) policies. And beyond educators and LGBTQ+ people, the account’s posts have elicited threats against private businesses, healthcare providers, and nonprofit organizations.

Libs of TikTok is best-known as an X (formerly Twitter) account, but its digital footprint expands across an array of mainstream and alternative social media platforms, where its self-identified “team” of unspecified individuals (likely including paid employees) distribute their posts to millions of followers.

After Years of Inactivity, Libs of TikTok Suddenly Ascends on Truth Social

Earlier this year, our researchers noticed that Libs of TikTok’s profile on Truth Social, an alternative microblogging site launched by Trump in 2022, had become one of the platform’s most-influential accounts. As our researchers observed Libs of TikTok ramping up its attacks against schools during Pride Month, we sought to examine its influence on Truth Social and how users there have responded to its posts.

Raichik created a Libs of TikTok account on Truth Social in February 2022, coinciding with the site’s public launch. In her first post on the site, she expressed enthusiasm for Trump’s new social media platform: “I can’t wait!! This is really exciting!”

But despite that initial enthusiasm, the Libs of TikTok account has been relatively inactive on the platform for most of its existence. Using our platform’s Timeline tool, we saw that the account has exhibited on-and-off activity since its creation, sometimes going months without posting.

That changed on Dec. 23, 2025. Libs of TikTok returned to Truth Social after a 300-day period of inactivity and began ramping up its daily activity to previously unseen levels. At the time of writing, more than two-thirds of all observed Libs of TikTok posts were shared in 2026. Since rejoining Truth Social, the account has averaged 29 posts per day on the dates it uploaded content. (Libs of TikTok’s account is “usually offline” on Saturdays.)

Libs of TikTok’s Truth Social posts are often word-for-word copies of posts that originally appeared on its better-known X account. Notably, Libs of TikTok does not mirror every popular post made on X onto Truth Social; we were unable to surmise how the account might determine which of its posts to omit.

Libs of TikTok posts have consistently seen high engagement on the platform since the account ramped up its activity late last year. Of the 3,986 posts it shared in 2026 at the time of writing, more than 40% were reshared 500 or more times by Truth Social users. Less than 20% of the posts it shared before 2026 saw such engagement – indicating that Libs of TikTok’s reach on Truth Social has significantly grown since its return.

We performed another search to identify all Truth Social posts in our datasets that were made this year and received 500 or more reshares, then used our Activity tool to group the results by account. At the time of writing, Libs of TikTok had shared 1,578 posts that received 500 or more reshares in 2026 – more than double the number of high-engagement posts the official White House account shared on the platform over the same period.

The only account that shared more posts achieving such traction was the one used by Trump, who owns the site and serves as its primary draw.

Libs of TikTok Routes Truth Social Users’ Focus Toward LGBTQ+ People and Public Educators During Pride Month

We used our platform’s Discover tool to identify every post that Libs of TikTok shared on its Truth Social account between June 1 and June 14 – the first two weeks of Pride Month – and reviewed them to count how many expressed hostility toward others surrounding issues related to LGBTQ+ identity, gender identity, and public education.

Of the 392 posts Libs of TikTok shared on Truth Social during that period, about one-third (131 posts) featured hostile language about the LGBTQ+ community and its allies. Most posts identified in this category highlighted individuals and entities that shared pro-LGBTQ+ messages for Pride Month, often targeting state and local government officials and entities.

About a quarter of the account’s anti-LGBTQ+ posts during the first two weeks of Pride Month expressed outrage at the public education system, which Raichik has long claimed is complicit in “grooming” children for LGBTQ+ people to sexually abuse. Nearly all posts targeting educators named specific schools and faculty members, and several provided contact information that Libs of TikTok followers could use to reach them.

Libs of TikTok’s anti-LGBTQ+ posts targeting public educators were reshared by Truth Social users more frequently than those that targeted individuals and entities unrelated to schools, on average. The 34 anti-LGBTQ+ posts targeting public educators in the period analyzed received an average of about 393 reshares each, while the 97 posts targeting other subjects saw an average of about 336 reshares each.

An additional 14 posts targeted education-related subjects over issues unrelated to LGBTQ+ identity or gender-identity, including posts that attacked schools for allegedly engaging in discrimination against white people, targeted educators who allegedly shared violent rhetoric on social media, and faulted schools for accommodating Muslim students. In total, more than one-in-ten (about 12%) Libs of TikTok posts on Truth Social in the period we analyzed targeted public educators in some way.

As Seen On Other Platforms, Libs of TikTok Posts Elicit Violent Rhetoric Against Their Subjects on Truth Social

Open Measures saw that Libs of TikTok’s anti-LGBTQ+ posts consistently elicited hostile and violent rhetoric from Truth Social users – not unlike the responses it has regularly provoked on mainstream social media platforms – and in turn inspired some users to target the same individuals and entities Libs of TikTok mentioned in their own posts.

Over the first two weeks of Pride Month, Truth Social users reshared the 131 anti-LGBTQ+ posts we identified on Libs of TikTok’s profile a total of 45,965 times and replied to those posts a total of 12,404 times.

Of the posts targeting public educators, the most-reshared was a June 5 post that attacked a female school board director in Bellingham, Washington, who owned a sex shop that planned to host educational sessions for children during Pride Month. Libs of TikTok’s post included the name and photo of the school board director, a picture of her store, a copy of a flyer advertising the classes, and a screenshot of a post it previously shared on X that targeted a high school in the district she oversees and included the school’s phone number.

Truth Social users who replied to that post called for the school board director’s arrest, encouraged one another to report the woman to federal authorities, fantasized about violence against her and her business, and alluded to harassing her further. “She has an address,” one user replied. “We need to put these pedophiles to death,” another wrote. Several users posted that they had called the school; one said they were searching for a phone number for the sex shop.

The Libs of TikTok post targeting a public educator that elicited the highest number of replies in our analysis period was a June 8 post attacking a math teacher and coach at a high school in Fort Worth, Texas, who shared a video discussing her students’ reactions to learning she was in a same-sex relationship. The post named the teacher, included a clip of the video she shared, and listed the email address of the principal at the school she worked for.

In replies to that post, Truth Social users baselessly claimed the teacher was a pedophile, called for her to be fired from her position, and expressed violent fantasies. “LEGALIZE EUTHANASIA,” one reply stated. Another user wrote: “If this EVIL BITCH had done this to my child she wouldn’t be sitting their bragging online because she would be 6 FEET UNDER WITH NOT 1 STRAND OF HAIR ON HER COLD EMBALMED NAPPY HEAD.”

We found that Libs of TikTok’s posts about public educators regularly elicited responses like these from Truth Social users.

After Libs of TikTok posted about a school soccer coach who is a transgender woman, a Truth Social user responded that it was “curb check time.” When it attacked an Oregon school district that displayed a LGBTQ+ Pride flag outside its headquarters, a user called for “public hanging” of education officials. Notably, Libs of TikTok posts that included school and faculty members’ emails and phone numbers regularly elicited replies from users who reported contacting them to voice their disapproval.

In a 2024 interview, Raichik said she does not condone threats against schools featured in her account’s posts and questioned whether people who had sent bomb threats those institutions received were actually her followers.

“We don’t know who’s calling in the threats,” Raichik said in that interview. “I mean, look, bomb threats are bad. I’ve said that a thousand times. People that call in bomb threats should be arrested and investigated. You can’t call in bomb threats. But I just don’t know what – what does it have to do with me?”

What We’re Watching

Libs of TikTok’s posts have consistently elicited threats and harassment against LGBTQ+ people and public educators since its launch in 2022, and the account’s increased activity on alternative platforms expands the potential scale of the backlash it can spark against its targets.

The account’s overnight dominance on Truth Social is particularly notable, since the platform serves as the Trump Administration’s semi-official communications platform. As the account’s owner, Raichik, deepens her ties to the Trump Administration and other Republican Party leaders, posts shared by her Truth Social account could have even greater impacts on pro-Trump officials’ policymaking and rhetoric.

Open Measures’ platform is designed to enable threat-monitoring investigations across dozens of alternative platforms that often go unmonitored. As such, we will continue to monitor and report on harmful activity that occurs on those sites.

What is Telegram?

Telegram is a privacy-oriented, cloud-based messaging app launched in 2013 by Russian-born brothers Pavel and Nikolai Durov. The Durovs developed Telegram amid escalating pressure from the Russian government over their refusals to censor content on VK, seeking to create a secure communications platform that was impervious to government surveillance and speech restrictions.1 While Russian state actors have used Telegram to disseminate their own messaging, Russian officials have limited access to the app in their country, ultimately banning it outright in April 2026.2

The app’s design allows for greater degrees of privacy than other platforms. Telegram allows users to create accounts with anonymous phone numbers, offers limited encryption methods to protect private communications, and spreads its infrastructure across data centers and servers owned by an array of shell companies in multiple jurisdictions – making it more difficult for countries to subpoena user data. In addition to direct communication between individual users, it also facilitates groups and channels, which function similarly to chat rooms and microblogging profiles on other social media sites.3

Since its launch, Telegram has become one of the most widely used apps of its kind, attracting billions of users worldwide.4 Some of its earliest non-Russian users were based in nations with heavy censorship laws and included pro-democracy activists organizing under repressive governments. But Telegram’s privacy features and reluctance to moderate content have also attracted nefarious actors, including repressive regimes, terrorist groups, violent extremist movements, and cybercriminals.5

In 2024, French authorities arrested Pavel Durov and alleged that Telegram’s inaction against illegal content and failure to cooperate with legal investigations amounted to complicity in a host of severe crimes occurring on the platform.6 (Russia also launched its own criminal investigation into Durov for “abetting terrorist activities” in February 2026.)7 After his arrest, Durov announced that Telegram would make greater efforts to comply with valid legal requests and take proactive action against illicit user activity – a significant departure from its longtime “hands-off” philosophy.8

Shortcomings of Policy Changes and Takedowns Meant to Address Cybercriminal Activity

In his first public post after his 2024 arrest, Durov said the criminal charges brought against him were “misguided,” but acknowledged that criminal abuse was occurring on Telegram and said the company was taking down “millions of posts and channels every day” while continuing to work through the “growing pains” of illicit activity on its platform.9 In the weeks after Durov’s arrest, Telegram introduced new reporting mechanisms for users to flag illegal activity and updated its privacy policy, stating that it would disclose users’ phone numbers and IP addresses when it received valid court orders.10 The company also stepped up its enforcement actions against illicit content.11

But cybersecurity professionals have found that Telegram’s policy changes and takedowns have not meaningfully deterred or addressed cybercriminal activities taking place on its platform; some reports suggest the issue may have actually worsened since the crackdowns began.12 Users engaged in cybercriminal activities have reportedly rejoined the platform with new accounts and adopted new tactics for evading enforcement actions in lieu of migrating to other platforms.13

Telegram remains uniquely appealing to would-be cybercriminals today, offering unmatched features that allow for users to start and scale-up their operations with ease and speed. Unlike dark web forums, which can require special software or privileged access, the platform is simple to join. It also allows users to deploy administrative bots in their groups and channels that can facilitate financial transactions, aggregate messages, and interact with members on their behalf. Additionally, its message-forwarding mechanic allows for channel creators and group members to distribute messages far and fast, and for previously-forwarded messages to continue circulating even if a network’s “hub” is taken down.14

Methodology

Open Measures’ datasets include archives for thousands of Telegram groups and channels, including many that appear to engage in cybercriminal activities. Our researchers sought to examine how the channels we collect data for have adapted to Telegrams’s policy changes and takedowns targeting illicit user activity.

To identify a range of potentially relevant posts, we created a broad search query that included cybercrime-related keywords drawn from our prior research and published reports that name known threat actors, marketplaces, and criminal services:

“fullz” OR “fulls” OR “combolist” OR “stealer logs” OR “CVV” OR “CVVs” OR “credential stuffing” OR “LummaC2” OR “Lumma” OR “RedLine” OR “Redline Stealer” OR “Raccoon Stealer” OR “stealer” OR “ransomware affiliate” OR “affiliate program” OR “malware” OR “exploit” OR “payload” OR “dropper” OR “romance scam” OR “investment scam” OR “ghost-tapping” OR “NFC relay” OR “romance scam” OR “investment scam” OR “ghost-tapping” OR “NFC relay” OR “deepfake” OR “face swap” OR “voice clone” OR “BidenCash” OR “Omega Cloud” OR “Observer Cloud” OR “Moon Cloud”

Researchers used built-in tools on the Open Measures platform to analyze the posts that matched our search query and identify trends.

Analysis

Our researchers performed three separate searches with our Timeline tool to visualize the number of Telegram posts in our datasets matching our search query in 2024, 2025, and 2026.

Among channels we collected, daily activity levels remained consistent throughout 2024 – including the months after Durov’s arrest in August – and much of 2025, though we saw a dramatic increase beginning in October 2025. That surge was followed by another series of spikes between November 2025 and January 2026, with elevated activity sustained thereafter.

As illustrated by Telegram’s own data (included below), the platform has steadily increased its overall moderation efforts since May 2024, with average daily account takedowns in 2026 approximately four times the daily average in May 2024. These efforts have been accompanied by periodic enforcement spikes through early 2025 and into early 2026 (with a sustained decline in moderation and no major spikes after Feb. 20, 2026).

Telegram’s self-reported moderation data mirrors our own findings: as the volume of posts matching our query in late 2025 and early 2026 increased, so did Telegram’s reported takedowns. Likewise, Telegram’s declining moderation in mid-February 2026 onward also aligns with the declining volume of query-matching posts our researchers observed.

Though Durov’s arrest in France served as a catalyst for Telegram’s increased moderation, the platform has sustained its efforts in response to increased suspected illicit activity for several years. Though the recent decrease in both posts matching our query and Telegram’s account takedowns might suggest the platform has attempted to address its cybercrime problem, the average volume of posts matching our query remains higher today than in years prior, suggesting cybercriminals are finding ways to adapt to Telegram’s policy changes and increased takedowns.

Trends By Search Period

Activity matching our search queries was led by different sets of groups and channels included in our datasets in 2024, 2025, and 2026. Notably, the names of the dominant groups and channels we observed hosting cybercriminal activities in each period were often misleading, presumably as a strategy to avoid moderation and attract unsuspecting users. Our researchers also observed that groups and channels most active in 2024 and 2025 seemed to use names with similar themes; in 2026, the groups and channels whose posts matched our queries changed, as did their naming conventions.

2024: Cybercrime-themed Spam in Politically-styled Telegram Groups

Throughout 2024, many of the most active groups and channels in our datasets that we observed engaging in likely cybercriminal activities (e.g., spammed advertisements for fraudulent documents and stolen user credentials) were styled after US political themes, most notably “ThePatriotPartyofOH,” “FreeWestVirginia,” and “PatriotPartyOregon.” Volume during this period was moderate, with “ThePatriotPartyofOH” leading with more than 3,000 hits.

2025: Increased Activity and Proliferation of Politically-styled Groups

Throughout 2025, our researchers saw the volume of posts in our datasets matching their search query significantly increase. The previously identified “FreeWestVirginia” channel shared approximately 16,000 posts matching our query (a roughly 30-fold increase from the period before). We also saw approximately triple the number of positive hits in posts shared by the “ThePatriotPartyofOH” channel.

The most active groups in this period that explicitly advertised cybercriminal services included additional channels and groups with “Patriot Party” names or political themes (e.g., “PatriotPartyNewHampshire,” “FreeSouthDakota”). As we observed in the 2024 search period, many posts we identified in other channels were apparent advertisements for cybercriminal services.

2026: Increased Activity, Proliferation of Financially-styled Groups

In 2026, despite Telegram’s reported takedowns of millions of accounts in late 2025, the volume of posts in our datasets matching our query was still dramatically higher than prior years. Researchers identified roughly four times as many posts matching their search query that were shared in 2026 than were shared 2025.

Rather than groups and channels with American political themes, the groups we identified as advertising cybercriminal services were often named after finance and OTC (“over-the-counter”) investing terms, like “otc_investorhub” and “chat_nft.” We also identified a cluster of similar groups styled around employment in Ukraine, like “truework_stkyiv.” The channel that shared the highest number of posts matching our query, “ChekerCCsLive,” was named in reference to “checking” if a stolen credit card or “CC” number is still “live” and usable.

Fraud Services and Scam Recruitment Posts

Our researchers observed that posts in “OTC” channels frequently featured advertisements for apparent financial fraud and money laundering services. Posts shared in the “WTSotc” channel, which shared hundreds of thousands of posts matching our search query prior to its removal, often followed one of several distinct spam formats. The posts we reviewed included offers to provide fraudulent documents, account logins, and money laundering services, and attempts to solicit peer-to-peer crypto transactions with other users.

In Ukrainian-employment-themed groups we identified, such as “truework_stkyiv,” our researchers encountered an array of posts advertising remote work opportunities using language consistent with online “pig-butchering” schemes and romance scams.15

Persistence of ‘Patriot Party’ Channels

While most cybercriminal channels and groups from earlier periods appeared to have been taken down or ceased their activity in recent years, many of the politically-named groups we identified – namely “PatriotPartyRI,” “FreeSouthDakota,” “PatriotPartyNewHampshire,” “PatriotPartyOregon,” and “FreeWestVirginia” – had survived Telegram’s increased moderation efforts and remained active at the time of writing.

Based on activity patterns in our datasets and manual verification, only the “ThePatriotPartyofOH” and “FreeNorthDakota” had been taken down (likely around October 2024 and May 2025, respectively). Other than “otc_investorhub,” all the active groups we identified in 2026 remained active as well.

Conclusion

While Telegram has demonstrated significant efforts to crackdown on cybercrime, it remains a fixture of the cybercriminal economy as illicit actors continue to adapt to its policies to avoid moderation. Despite a slight decline in recent months, the volume of posts on Telegram likely related to cybercriminal activities remains much higher than it was just two years ago.

Telegram’s moderation efforts appear to have done little to reduce overall cybercriminal on the platform – and as our research suggests, the problem is likely to persist as a result of the platform’s infrastructure, which remains unchanged.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.

Open Measures found that alternative platform users promoted conspiracy theories attacking a host of pharmaceutical companies that develop vaccines last month after reports that global health authorities were responding to a deadly Ebola virus outbreak in the Democratic Republic of the Congo. With the help of our new Research Assistant, researchers identified harmful narratives targeting several companies.

Subscribe now

Context

The World Health Organization (WHO) declared on May 17 that the spread of Bundibugyo virus, which can cause Ebola in humans, in the Democratic Republic of the Congo was a “public health emergency of international concern” and advised global health authorities to take precautionary measures to limit its spread. In response, medical scientists have expedited research into possible vaccines for the disease.

Amid international alarm over the outbreak, misinformation and conspiracy theories about Ebola have run rampant on social media, following close on the heels of such claims surrounding a hantavirus outbreak aboard a Dutch cruise ship weeks earlier. Some of these narratives have taken direct aim at major pharmaceutical companies, including one actively working to develop an Ebola vaccine.

Our Approach

Open Measures sought to better understand how communities on the platforms we monitor have refashioned grievances against pharmaceutical companies into new narratives and conspiracy theories surrounding the recent Ebola outbreak. The pharmaceutical companies included in our search queries included Moderna, Pfizer, AstraZeneca, Merck, and GSK. We also searched for mentions of “big pharma” in posts discussing Ebola.

Our researchers used Open Measures’ new Research Assistant to generate a report summarizing claims made about major pharmaceutical companies related to Ebola across 24 platforms in our datasets in a month-long period spanning May 4 to June 3, 2026. An excerpt of the report produced by Research Assistant can be viewed below.

Informed by that report, researchers proceeded to use the analysis tools built into our platform to corroborate its findings and explore the themes it identified in greater detail. By using Research Assistant to identify prominent narratives in our datasets in the early stages of their analysis, our researchers saved hours that would otherwise be spent manually reviewing search query results to identify potential leads for their research.

‘Every. Single. Time’: Conspiracy Theorists Fault Pharmaceutical Companies Amid Ebola Outbreak

Open Measures found that hostile narratives about pharmaceutical companies surged across several platforms after the WHO declared the Ebola outbreak in the Democratic Republic of the Congo was a public health emergency and again following reports the Coalition for Epidemic Preparedness Innovations (CEPI) awarded millions of dollars to scientists developing potential vaccines against the disease.

Using our platform’s Discover tool, researchers reviewed more than 650 posts mentioning pharmaceutical companies in relation to Ebola to understand how different companies were being targeted.

Moderna

More than 75% of the posts we identified took specific aim at Moderna, an American pharmaceutical company that specializes in the development of mRNA vaccines. Earlier this year, the CEPI awarded $26.7 million to scientists working with the company to develop vaccines against several deadly filoviruses, including Ebola, and last week gave millions more to fast-track those efforts in light of the recent outbreak.

Health-focus conspiracy theorists have antagonized the CEPI for years, often fixating on its support for COVID-19 vaccine research and the substantial financial backing it receives from the charitable foundation of Microsoft co-founder Bill Gates.

Across multiple platforms, our researchers saw users highlighting reports about the CEPI’s funding of Moderna to insinuate that the Ebola crisis in the Democratic Republic of the Congo was orchestrated to generate profits for pharmaceutical companies and advance supposed sinister agendas of global elites.

A Telegram post shared May 27 pointed to the CEPI’s “perfectly timed investment” as evidence that the WHO’s advisories around Ebola were “propaganda to sell toxic vaccines.” Another Telegram post, shared on May 24, derided Moderna as one of many “pandemic profiteers” that haven’t been “held accountable.”

“Forecasting future pandemics, expanding emergency powers, and rapidly deploying vaccines has become a lucrative global industry,” a May 25 Telegram post mentioning Moderna read.

Other posts that mentioned Moderna made reference to a supposed “playbook” that health officials used to push vaccines on the public, as seen in this Truth Social post shared on May 18:

The same playbook always repeats: Develop “vaccine” → Fearmonger new outbreak → Declare emergency → Gain power & control → push “vaccine” as [the] only solution.

A Gab post shared on May 19 also alluded to this supposed scheme: “The same playbook always repeats. Every. Single. Time.” Another Gab user posted on June 2 that the response to Ebola was following “the same script” used to hype fears about previous outbreaks.

Pfizer

Our researchers also saw users targeting Pfizer, an American pharmaceutical and biotech company that is not among the groups expediting development of an Ebola vaccine. Several posts we reviewed promoted narratives that insinuated the Ebola outbreak was the fault of Pfizer’s COVID-19 vaccine.

A Gab post shared on May 25 declared that the Ebola outbreak was a “Pfizer Adverse Event.” In a May 30 comment shared on a Breitbart News article via the Disqus platform, another user wrote that the “Pfizer Ebola outbreak” was “sponsored by the CIA, NED, and USAID” – referencing three US federal agencies often attacked in “deep state” conspiracy theories. A comment posted to Rumble on May 12 declared that Ebola fears amounted to “fear porn brought to you by Bill Gates and Pfizer.”

Other Companies

Health-focused conspiracy theories about the Ebola outbreak also targeted other pharmaceutical companies, though our researchers identified significantly fewer of those posts than those that targeted Moderna and Pfizer. One such post was a comment shared on a Breitbart News article via Disqus, where a user wrote they would “rather catch Ebola than have anything produced by AstraZeneca jabbed into my body.”

‘Murder by injection’: Anti-Vaccine Users Encourage Refusal of Potential Ebola Vaccines

When reviewing posts mentioning pharmaceutical companies, our researchers also saw users prematurely declaring their refusal of any potential Ebola vaccines and encouraging others to decline them, should they eventually be available.

Wayne Allyn Root, a conservative radio host and longtime Trump ally, shared a Truth Social post on June 1 mocking anyone who might eventually receive an Ebola vaccine:

Good luck to all those dumb-as-a- doorknob sheeple who take it. If it’s anything like Covid vaxx, I’ll never be able to say, “I told you so.” Because it will kill or cripple you.

Similar warnings appeared in other posts. On May 20, a Truth Social user warned: “Be prepared. This is going to be Murder by injection.” Five days later, on May 25, a 4chan user posted: “REMEMBER TO NOT TAKE ANY MRNA VACCINE FOR EBOLA.”

Across platforms, our researchers saw users sharing posts categorically rejecting global concerns about Ebola. From a Gab post declaring Ebola was a “nazi fascist communist satanic ploy” to a BitChute video questioning whether the outbreak would be “what strips US citizens of their Constitutional Rights,” health-focused conspiracy theorists portrayed the deadly outbreak as a ruse meant to advance the interests of sinister liberal elites.

What We’re Watching

Conspiracy theories about medicine can influence believers to make unwise decisions related to healthcare, like forgoing preventative treatments, experimenting with unproven alternative medicines, and skipping routine check-ups. The spread of anti-medicine narratives can also complicate responses to global health emergencies and elicit threats against the individuals and entities leading those efforts, as seen during the COVID-19 pandemic.

Open Measures will continue to monitor developing narratives around the Ebola outbreak as they appear on alternative platforms, where our researchers have repeatedly seen high-impact narratives first appear before achieving wider online spread.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.

Last month, we debuted our platform’s new Research Assistant tool and published an in-depth white paper on new and developing threats related to AI “jailbreaking.”

You also may have spotted our researcher team in news reports, appearing quoted in The Washington Post, USA Today, KPBS, IT Brew, Raw America, and more.

Hantavirus Conspiracy Theories Spread by MAGA Influencers Appeared Earlier On Alternative Platforms

Shortly after the initial alerts about a possible hantavirus outbreak in early May, social media users on an array of alternative social platforms spread baseless conspiracy theories that health officials might leverage the virus to disrupt 2026 US midterm elections – and three days later, high-profile conservative social media personalities amplified them on various mainstream platforms.

New Product: Research Assistant

We were excited to release Research Assistant, an AI-powered workflow for processing large datasets, identifying key patterns, and generating actionable reports – all in one window. With this new interface, researchers can navigate our datasets seamlessly, transparently, and without sacrificing accuracy or human judgment. Building on existing workflows, Research Assistant helps researchers move from topic or question to finished report in minutes or hours rather than weeks.

Pro-Trump Communities Spent Years Claiming Elections Were ‘Rigged.’ Now They Support Gerrymandering.

Over the last year, President Donald Trump has pressured Republican state lawmakers to voluntarily redraw their maps in order to help Republicans defend their narrow majority in the US House of Representatives. Meanwhile, Republican politicians and their social media influencer supporters have attempted to drum up support for partisan gerrymandering efforts online – in communities that historically claimed US elections were being rigged against Trump and his political allies.

The 2026 AI Threat Landscape Report

The rise of AI has created a new frontier of cyberthreats for organizations and individuals. Many threats are becoming increasingly common, accessible, and sophisticated, with new exploits being developed in organized online forums daily. In our white paper, we did a year-long analysis of the platforms, communities, and tools driving these threats in 2026, offering strategies on how to defend against them before they affect your organization.

Subscribe now

TLDR

• The World Health Organization alerted global health officials to a hantavirus outbreak aboard a cruise ship in early May, encouraging precautionary measures to limit the spread of the disease.

• Shortly following alerts about the outbreak, social media users across an array of alternative social platforms amplified baseless conspiracy theories alleging that health officials were stirring fear over hantavirus to disrupt 2026 US midterm elections.

• Three days after these theories began to spread on alternative platforms, multiple high-profile conservative social media personalities amplified them to mainstream audiences.

Background

The World Health Organization issued alerts earlier this month stating that it was monitoring a hantavirus outbreak after three passengers died of respiratory illness aboard a Dutch cruise ship that departed from Argentina in April. Global health authorities assessed that hantavirus posed a low risk to the global population but advised nations to take precautionary measures to prevent its spread.1

As news spread about the outbreak, users across an array of social media sites spread speculative conspiracy theories and hyperbolic claims about hantavirus that echoed false narratives popularized during the COVID-19 pandemic.2 Many of these high-engagement conspiracy theories implicitly and explicitly alleged that hantavirus was a “plandemic” – a term popularized by a debunked video series that claimed the COVID-19 pandemic was orchestrated by global elites with sinister motives.3

Among the theories our researchers identified were claims that global health officials’ caution about hantavirus signaled the beginning of a plot to disrupt 2026 US midterm elections in ways that would harm Republican candidates. These theories were amplified on social media and various podcasts by a host of high-profile conservative personalities, including Benny Johnson and Tim Pool.4

Our Approach

Open Measures sought to understand where narratives linking May’s hantavirus outbreak to the 2026 US midterm elections originated and where they gained steam before later being amplified by high-profile figures.

Our researchers used our platform to identify posts that mentioned both terms associated with hantavirus and terms associated with midterm elections across alternative platforms we monitor including Telegram, Truth Social, Scored, and 4chan. We also searched Disqus, a networked platform used by websites and blogs to coordinate user comments. To surface potentially relevant posts, our researchers used the following search query:

(”hantavirus” OR “andes virus” OR “sin nombre virus” OR “hantaan virus” OR “seoul virus” OR “puumala virus” OR “ebola” OR “evd”) AND (“plandemic” OR election* OR voting OR midterm*)

We used our platform’s Discover feature to review the query results chronologically, to identify relevant narratives’ earliest appearances on alternative platforms. All searches were limited to April 30 and May 7, the one-week period prior to the day that high-profile conservative figures began amplifying narratives linking hantavirus to midterm elections.

Conspiracy Theorists Dub Hantavirus the ‘Midterm Virus’

Across an array of alternative platforms dominated by right-wing communities, Open Measures observed users beginning to circulate claims that global health authorities hoped to use hantavirus fears to disrupt 2026 US midterm elections almost immediately after the WHO published its May 3 alert about the cruise ship outbreak.

In our datasets, the earliest post we identified promoting this narrative was a May 3 comment on Scored, a platform that hosts a handful of pro-Trump forum boards:

World Health Organization (WHO) is supporting a public health event
Following an election virus (hantavirus) outbreak.

Within hours, a different user on Truth Social, a microblogging site owned by Trump, shared this post [sic]:

Hanti virus just in time to pave way for mail in ballots for midterms

Later that day, a comment left on an article published by The Gateway Pundit, a hyperpartisan junk news blog, read:

It wouldn’t surprise me if they were to weaponize this virus (or bacteria) as the new pandemic for the midterms.

I’ve really developed a taste for 1.87% Ivermectin “horse paste” over the years.

Remember to spay and neuter your liberals

Expansion of Hantavirus Conspiracy Theories on Alternative Platforms

In hundreds of posts shared over a three-day period, various users spread the narrative further across alternative platforms. Researchers saw various users among these platforms refer to hantavirus as an “election virus” and the “midterm virus,” claiming that the infectious disease was “made up” to complicate voting in this year’s US midterm elections and “rig the election again.”

After iterating through conspiracist communities on alternative platforms, several high-profile social media personalities relayed them to larger audiences around May 7.

Our researchers also noted that, on alternative platforms, these conspiratorial narratives about hantavirus appeared alongside other posts espousing predictions that nefarious actors might leverage the disease to stir chaos in American society. In turn, these posts stirred even broader speculation, generating additional groundless discussion about which global elites might be involved and what their possible motivations might be.

Conclusion

Even as mainstream platforms loosen their content guidelines to allow more extreme content, Open Measures has previously observed that alternative platforms still function as originators and incubators for conspiratorial narratives and far-right talking points. In this case, our researchers identified high-profile conservative social media personalities amplifying baseless narratives that health officials’ hantavirus response was in some way connected to the 2026 US midterm elections – a narrative that had already been circulating on alternative platforms days earlier.

For researchers tracking the spread of harmful claims, monitoring alternative platforms can often provide early warning signals about which narratives are most likely to spread. As Election Day nears, Open Measures will continue to track conspiratorial narratives ahead of the 2026 midterms.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.

Introduction

Open Measures is excited to introduce Research Assistant, an all-in-one interface for navigating our datasets more quickly, seamlessly, and transparently, without sacrificing accuracy or human judgment.

Research Assistant harnesses Discover, Timeline, and Activity to deliver greater insights and results than any one of our tools can produce in isolation while remaining grounded in relevant data from Open Measures’ platform. Research Assistant builds on researchers’ existing workflows to help them move from topic or question to finished report in minutes or hours rather than weeks.

What it is:

• A faster way to analyze large datasets. With natural language processing, Research Assistant can synthesize information from thousands of posts quickly, extracting novel insights, narrative trends, and detailed patterns.

• A faster way to produce actionable reports. After quickly gathering critical insights from many large datasets, Research Assistant can help draft comprehensive, shareable reports in five different formats – Summary, Evolving Narratives, Threat Assessment, Spike Analysis, and Brand Monitoring – with the click of a button.

• A simpler way to use Discover, Activity, and Timeline. Instead of manually reviewing posts, exporting spreadsheets, or toggling between views, researchers can run their entire workflow from one interface.

What it’s not:

• A general-purpose chatbot. Research Assistant draws from Open Measures’ data, preventing hallucinations – and ensuring researchers’ expertise and judgment are still essential (by design). It is also not overly personified – we’ve intentionally named it “Research Assistant” (not “Gizmo” or “Steve,” for example).

• A replacement for researchers. Research Assistant uses our platform’s features on researchers’ behalf, reducing friction, allowing them greater access to our platform, accelerating their workflows, and compounding on their expertise.

Our Philosophy

With AI adoption now in countless workflows and many sectors of the economy, Research Assistant intends to bring the positives of AI natively into our platform thoughtfully and responsibly. As such, we designed Research Assistant carefully to reflect Open Measures’ values. After many conversations with employees, customers, and stakeholders, we identified four key ideas that guided our approach:

• Human-in-the-lead (HITL). The user manually controls every step, with the tool showing the underlying queries it will run before it runs them (and asking what results to include in a report). Conclusions are traceable back to real data, and researchers’ domain expertise and query skills remain central (and are not compromised or replaced by the tool).

• Flexible, not prescriptive. Research Assistant does not presume one workflow or one way of presenting results. Instead, it is a non-technical and intuitive interface that supports many different workflows and levels of AI fluency.

• Trustworthy and reliable. Designed not to use web search, Research Assistant draws from real data from Open Measures platform using RAG architecture to reduce hallucinations and promote researcher privacy.

• Transparency without sacrificing speed. New insights generated by Research Assistant are paired with the search queries that produced them, allowing researchers to verify them independently. While the tool does greatly speed up research workflows, it does not transform them into a “black box.”

Product Features

Key capabilities include:

• All-in-one interface: Researchers can combine complex Discover, Timeline, and Activity searches in one chat-based workspace without switching between tools.

• Novel insights and reports: Research Assistant can expand on researchers’ insights, make insights of its own, and generate five types of reports: summary, narrative tracking, threat assessment, spike analysis, and brand monitoring.

• Transparent queries: Every insight the tool generates is mapped onto precise queries that users can review, edit, or rerun.

• Branching conversation paths: Each message ends with options for next steps in a way that branches, allowing users to backtrack to any decision point.

• Multi-agent architecture: To balance speed, accuracy, and cost, Research Assistant automatically switches between models for queries and reporting.

Use Cases

Tracking Narrative Surges Across Platforms

Situation: A communications team notices a new conspiracy narrative gaining traction and wants to quickly understand if or how it’s developing on multiple fringe platforms like 4chan and Telegram.

Role of the tool: Research Assistant generates platform-specific queries, retrieves relevant posts, summarizes the dominant patterns from each platform, and produces comparative timelines - with each analyst approving each decision at each step.

Impact: Without toggling between many windows and posts, the team gains a cross-platform understanding of where the narrative came from and where it might spread almost instantly, giving them a head start on deeper investigations.

Enhancing Reports with Graphs and Artifacts

Situation: A security analyst under a tight deadline needs to gather cross-platform research to create a comprehensive trend analysis report for an important stakeholder, complete with visualizations, specific examples, and info-driven summaries.

Role of the tool: Using Research Assistant, the analyst makes suggestions, receives queries to approve and execute, and gathers a wealth of cross-platform information (using the tool’s branching structure to explore many different queries in parallel at various depths). When satisfied, the analyst has Research Assistant generate a comprehensive trend report with graphs and individual posts cited.

Impact: The analyst gives a polished deliverable grounded in concrete data to the stakeholder ahead of their deadline, helping the stakeholder in a crucial upcoming meeting and improving collaboration across teams.

Beyond primary use cases, Research Assistant also supports many complementary workflows:

• Crawl requests: When a query finds no relevant posts, users can submit new Crawl Requests directly through the chat window.

• Labels: Upon finding an important channel, post, or actor, the user tells Research Assistant to add a custom label to it.

• Post and link extraction: From broad data, the user requests the top five posts by engagement - or extracts URLs from all of the content at once.

• Harm reduction. While browsing potentially harmful data, Research Assistant warns the user about traumatic images or posts rather than showing them automatically.

Looking Ahead

Research Assistant is built to bring the power of AI into the Open Measures platform while keeping researchers in control of the context. We see this as a foundation that we’ll continue to refine and improve based on user feedback. Above all, Research Assistant will always be designed to enhance and preserve human judgment, expertise, and accuracy rather than replacing it.

Due to costs of running and maintaining Research Assistant, it is unlikely to be incorporated into the public, open-source version of Open Measures. For more information on bringing Research Assistant to your organization, reach out to schedule a demo.

TLDR

• State lawmakers across the United States are rushing to voluntarily implement new electoral district maps, hoping to create advantages for their respective parties ahead of 2026 midterm elections – a naked effort at partisan gerrymandering. Over the last year, President Donald Trump has pressured Republican state lawmakers to voluntarily redraw their maps in order to help Republicans defend their narrow majority in the US House of Representatives.

• Republican politicians and their social media influencer supporters have attempted to drum up support for their partisan gerrymandering efforts online, including in communities that have historically promoted conspiratorial narratives alleging elections are rigged against Trump and his political allies.

• Open Measures identified four prominent narratives that right-wing influencers have promoted to garner support for partisan gerrymandering efforts.

Background

Redistricting is the process of reestablishing the geographical boundaries of electoral districts in each state. States are legally required to redraw their district maps once per decade, following the results of the federal census, to account for population shifts and ensure that each district represents roughly the same number of residents.

Unlike other countries that assign the process to independent, non-partisan commissions, redistricting in the United States is performed by each state’s own elected officials, who often strategically redraw electoral maps to their own political advantage (a practice known as gerrymandering).1 Throughout US history, politicians have used partisan gerrymandering to defy voters’ preferences, protect incumbent politicians from potential challengers, and manipulate the electoral impacts of racial and ethnic minority groups.2

President Donald Trump urged Republican state lawmakers in Texas to voluntarily redraw their electoral maps last summer with the explicit goal of creating more Republican-leaning districts in order to help defend their party’s narrow majority in the US House of Representatives in the 2026 midterms.3 Texas officials obliged the request, setting off a larger wave of partisan redistricting efforts across the country.4

These efforts intensified in late April, after the US Supreme Court issued a ruling that effectively demolished provisions in the Voting Rights Act that prohibit racial gerrymandering. In light of that Supreme Court decision, Republican lawmakers in Tennessee passed new electoral maps that eliminated districts where a majority of voters were Black. Other Republican-led states have reportedly debated doing the same.5

Polls show that a majority of Americans are opposed to gerrymandering; more than two-thirds of respondents to an August 2025 YouGov survey said it should be illegal.6 Gerrymandering has been found to damage public faith in democracy and fuel doubts about election integrity.7

Methodology

Open Measures sought to identify posts discussing recent redistricting efforts on five text-based alternative platforms where election denialist movements and their supporters have historically congregated: Gab, Gettr, Telegram, Truth Social, and Scored.

To identify relevant posts, our researchers created a search query including terms referring to redistricting shared over the last year (between May 13, 2025 and May 13, 2026):

(redistrict* OR gerrymander* OR “district map” OR “district maps” OR “congressional map” OR “congressional maps” OR “precinct map” OR “precinct maps” OR “legislative district” OR “legislative districts” OR “district lines” OR “district boundaries” OR “district boundary” OR “new district” OR “new districts” OR “new maps” OR “new map” OR “new line” OR “new lines” OR “new precinct” OR “new precincts”) NOT “RT”

From the query results, our researchers used proprietary data tools built into Open Measures’ platform to identify prominent narratives, actors, and themes.

Interest in Redistricting Surged Around Partisan Push

Open Measures found that users on the five platforms included in our analysis shared more than 80,000 total unique posts that contained a keyword related to redistricting over the last year. Nearly half of the results we identified were shared on Truth Social, an alternative microblogging platform Trump created after he was banned from mainstream platforms for inciting the 2021 riot at the US Capitol Building.8

Using our platform’s Timeline feature, we created a visualization of unique posts shared on each platform per week during our search period. Our researchers saw that increased discussion related to redistricting first occurred on Truth Social, as illustrated by an activity spike in August 2025, shortly after Trump asked Texas lawmakers to redraw their electoral maps. Discussion swelled at various points in the analysis period, typically coinciding with news reports about redistricting efforts across the US, and spiked again as the Supreme Court undercut the Voting Rights Act.

As seen in our prior analysis of election denialist communities, redistricting discussions on platforms we examined were largely driven by articles published by The Gateway Pundit, a hyper-partisan news blog known for publishing falsehoods and conspiracy theories about elections.9 When researchers used our Activity tool to identify the most-shared links in the posts their query identified, they saw the numbers of posts linking to Gateway Pundit articles vastly outnumbered those that linked to stories published by other sites.

On Truth Social, where we identified the most posts discussing redistricting, periods of increased discussion often followed Trump’s posts on the platform that mentioned the topic (which he referenced in at least 50 posts over the last year). Using the Activity tool to show which accounts on Truth Social shared the most posts that received 500 or more re-shares, we identified right-wing media outlets and influencers that frequently promoted conspiracy theories about elections were also among the top drivers of redistricting discussions.

How Pro-Trump Communities Are Selling Partisan Gerrymandering Efforts

Pro-Trump communities have spent years promoting outlandish and conspiratorial claims that US elections are irredeemably corrupt – allegedly rigged by election administrators, voting machine manufacturers, non-profit advocacy groups, law enforcement agencies, and foreign governments in order to sabotage Republicans.10 But ahead of the 2026 midterm elections, the same communities have voiced overwhelming support for partisan gerrymandering efforts.

To gain a fuller context, our researchers reviewed posts our search query identified to assess prominent narratives that users of platforms we reviewed put forward to encourage support of Republican-led redistricting efforts. From our analysis, we identified four key themes.

Immigration Narratives

Pro-Trump influencers have argued that partisan redistricting efforts are necessary to offset the fact that federal census data includes counts of all people who reside in the country – including unauthorized immigrants (who, as non-citizens, are ineligible to vote). Our researchers saw that many posts promoting this argument reiterated talking points from the Trump Administration, framing partisan gerrymandering as a corrective measure meant to level the playing field for Republican candidates.

Last year, around the time Texas was drawing its new district maps, the Trump Administration also discussed ordering a “new” census that would exclude undocumented people from its totals.11

Broader anti-immigrant sentiments also appeared to motivate users who voiced support for redistricting efforts ahead of midterms. Some argued that partisan gerrymandering was necessary to preserve Trump’s immigration agenda, as seen in this post on Gab, shared on April 23, 2026:

NewsFlash: I dislike “gerrymandering” however FL and SC must start their ‘map’ immediately as GOP can NOT loose what we’ve gain! GOP had to finish deporting ALL illegals as well as DACA and now anchor babies. Fact is they destroying all social programs as well as our educational systems.

Dominance Narratives

Many high-engagement posts related to redistricting that we identified argued that redrawing election maps was necessary to prevent Democrats from blocking the Trump Administration’s legislative agenda, impeaching Trump for a third time, and otherwise destroying the nation with their own political priorities.

Posts promoting these narratives often framed redistricting as a non-ideal but necessary move to prevent damage to their own political movement and to prevent their political opponents from gaining power. One high-engagement post, seen below, shared by conspiracy theorist Jacob Creech (aka “Clandestine”) on Truth Social referred to redistricting as “irregular warfare” needed to defeat “the enemy within” – referring to Democrats.

This attitude can also be seen in this Telegram post, shared on Dec. 5, 2025:

We don’t care, if we don’t fix redistricting then everything MAGA falls apart. GROWUP

Fairness Narratives

Other high-engagement posts highlighted cases where Democrat-majority state legislatures enacted electoral maps that had been gerrymandered on partisan and racial lines, framing Republican efforts to do the same as an uncontroversial or justified response to a lack of representation in certain states. In many posts our researchers identified, users highlighted Democratic politicians’ alarm over Republican redistricting efforts and celebrated their apparent distress.

Many posts insisted that Republicans were simply borrowing Democrats’ own tactics, as seen in this post on Scored on April 22, 2026:

They didn’t really start it. All Texas was doing was fixing the insanely Gerrymandered, and illegally created by Democrats, districts.

And this Scored post from Aug. 7, 2025:

Democrats gerrymander the FUCK out of blue states. No matter how you feel about it, we have to do the same in red states.

Racism Narratives

As the conservative-majority Supreme Court effectively gutted protections against racial gerrymandering in April 2026, high-engagement posts from pro-Trump social media personalities framed the decision as a victory against supposedly racist map-drawing by Democrats.

These narratives were also shared between platform users, as seen in this Scored post from April 30, 2026:

All that SCOTUS found on the redistricting decision is that racism doesn’t cure racism. It’s just more racism. Dems clearly need racism to win.

And this Gab post from May 10, 2026:

DEMS ARE HYSTERICAL, THEY’VE LOST SOME OF THEIR VOTER BASE, THEY’VE LOST THEIR RACIST GERRYMANDERING PLOYS, THEY’RE GOING TO LOSE MAIL-IN AND VOTER ID WILL INSURE ONLY AMERICAN CITIZENS VOTE IN OUR ELECTIONS…HOW GLORIOUS IS THAT ?

Conclusion

False narratives about the integrity of elections have driven a rise in threats against elections officials, empowered legislative efforts to restrict ballot access, and undermined public trust in democracy.12 It is likely that discourse in communities that previously promoted similar narratives could elicit similar effects in the future, particularly in relation to current redistricting efforts and other issues pertaining to the 2026 midterm elections.

In the interest of public safety, Open Measures’ platform was designed to track these narratives and reduce the risks that their spread might inflame.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.

The rise of AI has created a new frontier of cyberthreats for organizations and individuals. AI-driven attacks are no longer an emerging risk. Instead, they are increasingly common, accessible, and sophisticated, with new threats being developed in organized online forums daily.

When the most visible platforms shut these forums down, it does not disrupt their activity. Instead, those communities move to fringe platforms with looser moderation and enforcement, allowing them even more freedom to continue their discussions.

This report analyzes multiple social platforms to map where AI exploits are being discovered, refined, and sold today. It also provides concrete guidance on the most common exploits and direction on how to identify them before they affect your organization.

Read our full report in the link below:

2026 AI Threat Report

3.9MB ∙ PDF file

Download

Download

Key Takeaways:

• Evidence suggests platform bans pushed AI exploit communities into less-visible spaces often already occupied by active cybercriminals.

• The same technology behind documented business fraud attacks is being tested, refined, and shared in semi-public online spaces.

• 4chan serves as a discovery platform for new exploits, generating 300–350 related posts per day.

• Discord is growing quickly as a platform for R&D, hosting invite-only servers that share step-by-step instructions, refined prompt injection strategies, and access to dark LLMs not yet available elsewhere.

• Telegram is a commercialization layer, where hobbyist techniques are packaged as purchasable tools. New editions of purchasable exploits, such as the launch of WormGPT 4 in September 2025, correlate with on-platform activity spikes.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state-backed info ops. Click here to book a demo.

Last month, Open Measures was cited in news articles from The Boston Globe, The Washington Post, NPR, and MSNOW – and be sure to check out “The Gate 15 Interview” podcast episode featuring our CEO, Hank Teran!

Iran’s Claims of Alleged Strikes on USS Abraham Lincoln Spread through State-Aligned Telegram Accounts

Our researchers examined the roles state-backed media outlets and state-aligned news aggregator accounts on Telegram played in circulating conflicting claims about Iran’s attacks on a US aircraft carrier — stirring confusion and doubt among English-speaking audiences online. Some posts promoting Iran’s claims included AI-generated images and videos falsely purporting to show the ship taking on heavy fire.

CBS News Hired Bari Weiss to Appeal to Conservatives. It Doesn’t Seem to Be Working.

Paramount Skydance CEO David Ellison said he hired conservative opinion writer Bari Weiss to serve as the editor-in-chief of CBS News last year so she could help the network “modernize” its content and draw in new audiences. Critics raised concerns that Weiss and Ellison would seek to soften the network’s coverage of the Trump Administration. But if that was the goal, pro-Trump communities aren’t buying it.

4chan’s ‘Deepfakes’ of Celebrity Women Seem to Spike When Women Make Headlines

Adding to our research in March, Open Measures re-examined 4chan’s “Adult Requests” imageboard, one of the internet’s largest fountains of nonconsensual deepfakes, for mentions of three female celebrities frequently targeted by the board’s users. Notably, users’ requests for nonconsensual images of all three women seemed to spike during periods of increased media exposure that elevated their public profiles.

Subscribe now

TLDR

• Generative AI software’s rapid technological advancement and increased accessibility has accelerated the production and spread of digitally generated images depicting others in sexually explicit ways (often referred to as “deepfakes”). This form of online sex abuse overwhelmingly targets women, and sometimes children.

• Open Measures examined historical data for 4chan’s “Adult Requests” imageboard, one of the internet’s largest fountains of nonconsensual deepfakes, for mentions of three female celebrities frequently targeted by the board’s users.

• Our researchers found that periods where Adult Requests users requested explicit deepfakes of the three female celebrities often overlapped with periods when the women were receiving above average media exposure that boosted their public profiles.

Background

Policymakers around the world have sounded alarms over the use of generative AI software to inflict acts of online sexual abuse,1 including the creation of sexually explicit and nonconsensual “deepfakes”: digitally generated images and videos intended to look authentic.2 The vast majority of individuals victimized by nonconsensual deepfakes are female3 – including children, in some cases.4 Legal efforts to address the issue have severely lagged behind the rapid development and accessibility of generative AI software.5

Open Measures previously reported on “Adult Requests,” a growing, pornography-centered community on 4chan where users are almost singularly focused on the production and consumption of sexually explicit deepfakes. Most threads on the board include user-submitted images of people – typically women and girls – with requests for others to make AI-generated images depicting them in nude and pornographic scenes. These requests, and the images other users create to fulfill them, are viewable to anyone who visits the board.

Adult Requests users frequently victimize high-profile individuals, including celebrities, politicians, and athletes. But even more request threads seem to target women that users have encountered online or in their personal lives. Today, the board is one of the internet’s most active and dedicated hubs for this form of online sexual abuse.

Open Measures has recorded more than 624,000 posts made on 4chan’s Adult Requests board in the last year. Around a quarter of those posts contained a keyword related to requests for non-consensual sexual images.

Our Approach

We sought to determine whether Adult Requests users were more likely to victimize famous women when their public profiles had recently been elevated, whether by making news headlines or becoming the subjects of viral online discussions.

Using Open Measures’ platform, our researchers searched for posts made on Adult Requests in the last year mentioning three female celebrities they had seen users discussing in previous research: musical artist Billie Eilish, US Congresswoman Rep. Alexandria Ocasio-Cortez, and actress Sydney Sweeney. Our researchers created simple search queries for each of the women above, using our platform’s Timeline feature to chart their mentions over the last year. For further analysis, we reviewed the results we surfaced using our Discover tool.

Since a comprehensive picture of interest in one figure across the broader internet is difficult to reduce to any single data point, our researchers’ approach was to work backwards: Upon seeing a period of increased activity in an individual on Adult Requests, they then reviewed a range of news and web analytics sources for context on the individual’s relative amount of public awareness or exposure during the same period.

Analysis

For each of the celebrities included in this analysis, our researchers identified distinct periods during which their names were mentioned more frequently on Adult Requests. Upon closer review, we saw that the majority of these mentions appeared in posts requesting sexually explicit deepfakes of those individuals.

Note: Adult Requests is an imageboard forum where users converse in threads. Open Measures’ search query only identified mentions of each individual where they appeared in text posts, meaning that the totals included in our analysis likely reflect only a portion of the activity associated with each figure.

Billie Eilish

Adult Requests users shared at least 114 posts mentioning musical artist Billie Eilish last year, more than half of which were recorded between Dec. 21, 2025, and Jan. 22, 2026. During that period, the day with the highest number of posts mentioning Eilish was Dec. 27, 2025.

While our researchers were unable to identify any single event that triggered a surge in deepfake requests of Eilish, Eilish was experiencing a period of heightened publicity that aligned with observed activity spikes – after receiving nominations for Grammy awards, hosting an episode of “Saturday Night Live,” and sharing a trailer for her upcoming concert documentary film.

When reviewing posts from the surge period, researchers identified one post from Adult Requests on Jan. 5 that included a link to low-rank adaptation models (LoRAs), shareable files used to alter a generative AI model’s settings for a specific use case. In that post, the user linked to LoRA models for creating images of Eilish and actress Jennifer Lawrence specifically, indicating that they recently “got a v2” (i.e., had been updated or improved).

Rep. Alexandria Ocasio-Cortez

At least 112 posts on Adult Requests made last year mentioned Rep. Alexandria Ocasio-Cortez, often in requests for fake images that depict her in pornographic images. Using the Timeline feature, our researchers saw that the daily totals of posts mentioning Ocasio-Cortez spiked throughout December 2025 and January 2026.

While users did not explicitly mention news coverage in the posts we identified, the spiking requests for sexually explicit deepfakes of Ocasio-Cortez we identified closely correlated with a period of increased media attention on the congresswoman. Around that time, Ocasio-Cortez made news headlines for introducing New York Mayor Zohran Mamdani at his inauguration ceremony, predicting that she’d “stomp” Vice President JD Vance if she challenged him in a hypothetical 2028 presidential election matchup, and demanding prosecutions of federal immigration enforcement officers who killed Minneapolis residents.

Our researchers identified the greatest single-day spike in mentions of Ocasio-Cortez on Jan. 7, when footage of Ocasio-Cortez confronting a Fox News producer over a network host’s sexualized commentary about her was widely circulating on social media. It is unclear whether the spike in requests for explicit deepfakes of Ocasio-Cortez was directly influenced by the viral video clip.

Sydney Sweeney

Adult Requests users mentioned actress Sydney Sweeney in at least 77 posts over the last year, most of which were shared in the last few months. Our researchers saw that the board’s users began mentioning Sweeney more frequently beginning in February and peaking in April.

The greatest single-day spike our researchers identified in requests for explicit deepfakes of Sweeney occurred on April 16, 2026. Similar to Eilish and Ocasio-Cortez, Adult Requests users did not explicitly cite their motivations for requesting for deepfakes. Around the same time, however, clothing company American Eagle debuted its second advertising campaign featuring Sweeney, following on from a similar campaign last year that stirred online outrage. The actress also made headlines in recent months for red-carpet appearances at Hollywood events and for her romantic relationship with music industry executive Scooter Braun.

As in Eilish’s case, the posts mentioning Sweeney that our researchers reviewed also included discussion of LoRAs. In one post made to Adult Requests on Jan. 8, a user stated that they had LoRAs for a handful of celebrity women, including Sweeney, “ready to go if anyone wants something of them.”

Conclusion

Open Measures saw Adult Requests users requesting explicit deepfakes of the three female celebrities in our analysis more often in periods that overlapped with increased public interest in those figures. While our findings do not prove a causal relationship, they do suggest that women experiencing heightened levels of online and media visibility may also face a heightened risk of being targeted as subjects for nonconsensual deepfakes.

Open Measures’ information from 4chan’s Adult Requests board is among the most-complete archive of its kind, and our proprietary tools allow users to further investigate the activity on the board (and to minimize their exposure to graphic and potentially illegal material while doing so).

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state-backed info ops. Click here to book a demo.

TLDR

• Paramount Skydance, the parent company of CBS News, acquired the right-leaning blog The Free Press last year and hired its co-founder Bari Weiss to lead the network’s newsroom. Since then, the network has undergone structural and staffing changes that critics have alleged were meant to be favorable to the Trump Administration.

• Pro-Trump audiences on alternative platforms initially took interest in Weiss’ takeover of CBS News, but Open Measures found that those communities have showed less interest in the network as her tenure goes on.

Background

Paramount Skydance, the parent company of CBS News, announced in October 2025 that it had acquired The Free Press, a right-leaning media company co-founded by polarizing conservative opinion writer Bari Weiss. In addition to purchasing the site and absorbing it into CBS News, Paramount Skydance CEO David Ellison also hired Weiss to be CBS News’ new editor-in-chief – stirring controversy in its newsroom.1

Under the direction of Weiss and Ellison, CBS News has laid off journalists, hired additional opinion commentators, and promoted like-minded staff to larger roles. Critics of the takeover have voiced concerns that the duo seeks to bend CBS News’ coverage to be more favorable to the Trump Administration, as Ellison seeks its approval for his planned acquisition of another mass media corporation: Warner Bros. Discovery.

While the newsroom shakeup has found support from Trump and his administration’s top officials, recent reporting shows CBS News’ overall ratings have been in sharp decline since Weiss’s takeover,2 with its flagship news program on pace for its lowest-rated first quarter this century (notably outperformed by rivals ABC and NBC during the same period).3

Our Approach

As a brand monitoring case study, Open Measures’ researchers sought to contrast the popular media narratives about Bari Weiss' and recent changes at CBS News with real social activity from pro-Trump audiences to whom those changes were meant to appeal.

To do so, we searched for posts mentioning CBS News on five platforms that host predominantly Trump-aligned communities: Gab, Gettr, Rumble, Scored, and Truth Social using the following query:

(”CBS News” OR “CBS Evening News” OR “CBS Mornings” OR “60 Minutes”)

To narrow the analysis to posts that also mentioned Weiss or Ellison, our researchers added the following query:

(”Bari” OR “Weiss” OR “Weiss Effect” OR “Ellison”) AND (”CBS News” OR “CBS Evening News” OR “CBS Mornings” OR “60 Minutes”)

Our researchers used various tools available in our platform to analyze the posts their search queries identified.

MAGA Communities’ Interest in CBS News Has Faded Under Bari Weiss’ Leadership

Users across all five platforms we analyzed shared nearly 46,000 posts over the last year that mentioned CBS News or one of its flagship programs. About 70 percent of those posts were shared in the 169 days preceding Weiss’ takeover of CBS News, suggesting audiences on those platforms have generally lost interest in the network over the 197 days since she joined the network.

Of the platforms we examined in the pre-Weiss period, our query identified the highest number of posts on Truth Social. Users on the Trump-owned microblogging site shared nearly 24,000 posts mentioning CBS News and its top programs prior to Weiss’ arrival – about 73 percent of all posts identified in that period.

Using our platform’s Discover tool, researchers saw that conversation about CBS News on Truth Social was largely driven by news developments related to President Trump’s lawsuit against the network concerning a “60 Minutes” interview with former Vice President Kamala Harris, his 2024 presidential election opponent. CBS News’ parent company Paramount settled the case for $16 million – and Skydance, Ellison’s company, reportedly gave Trump an additional $20 million.

Our researchers observed similar trends on other platforms: When Trump or his allies disparaged CBS, so did their supporters.

Ellison and Weiss Become the Story of CBS News

About 30 percent of the posts Open Measures identified that mentioned CBS News or its top programs over the last year were shared after Ellison hired Weiss to the newsroom’s top perch, indicating that interest in the network on the platforms we examined had declined since Weiss became editor-in-chief.

In the period since Weiss joined the network, the greatest spike in mentions of CBS News on the five platforms occurred in November 2025, after Trump gave an interview to “60 Minutes” and praised Ellison and Weiss’ takeover. Smaller spikes were observed in December 2025, after former Congresswoman Marjorie Taylor Greene criticized Trump in a “60 Minutes” interview and after news outlets reported that Weiss had abruptly blocked the airing of a “60 Minutes” segment on a brutal prison in El Salvador, to which the Trump Administration was sending migrants.

About 13 percent of the posts we identified in the period after Weiss’ hire also mentioned Weiss or Ellison by name, suggesting that the duo has become a significant part of the story pro-Trump communities are sharing about CBS News. The ratio was highest on Gab, where more than 16 percent of posts discussing CBS News also mentioned Weiss or Ellison.

Compared to the overall mentions of CBS News, posts that also mentioned Weiss or Ellison appeared more uniformly across platforms during the analysis period following Weiss’ hire, suggesting audiences have maintained their focus on the duo throughout Weiss’ tenure at the network.

What We’re Watching

Open Measures found that users on platforms harboring large pro-Trump communities have shown decreased interest in CBS News since Ellison acquired its parent company, Paramount, and installed Weiss as the editor-in-chief of its newsroom. Ellison said he hired Weiss to “modernize content and the way it connects” at CBS News, but our findings suggest those efforts have so far been unsuccessful. Rather, our analysis suggests that hiring Weiss has damaged the network’s brand – even among pro-Trump audiences that critics suspect the takeover hoped to appease.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state-backed info ops. Click here to book a demo.

TLDR

• The United States and Israel conducted surprise airstrikes that killed dozens of Iranian government leaders on Feb. 28, initiating a war that has resulted in thousands of deaths across the Middle East. But beyond the battlefield, the war has also played out on social media, where state actors have sought to bolster support and shape public opinion.

• Throughout the war, Iran’s military has repeatedly claimed to have targeted the USS Abraham Lincoln, a US aircraft carrier, in missile and drone strikes, resulting in severe damage to the ship. US Central Command has denied Iran’s claims.

• State-backed media organizations and state-aligned aggregator channels on Telegram have boosted Iran’s claims about the USS Abraham Lincoln even after US officials denied them, stirring confusion and debate among English-speaking audiences on the platform.

Background

The United States and Israel carried out surprise military strikes against Iran on Feb. 28 that killed dozens of top Iranian government officials – including its head of state, Supreme Leader Ali Khamenei – and initiated a war that has since resulted in thousands of deaths and severely disrupted global trade.1 At the time of writing, attempts to negotiate a peace deal between the US and Iran have been strained.2

Beyond the battlefield, the war is also being fought on social media platforms, where warring countries and their allies have sought to rally support and shape public opinion. US and Israeli state officials have used social media to threaten and criticize Iranian leaders.3 Iranian state actors, alongside allied operatives in Russia and China, have reportedly intensified their longtime efforts to influence online political discourse among Western audiences.4

As we’ve previously reported on other conflicts, state and state-aligned actors have taken steps to manipulate the flow of information during escalations in the war in Iran, polluting the environment with false and misleading claims and creating obstacles for open-source researchers. As an additional complication, some false or disputed claims have been supported by inauthentic photos and videos produced with generative AI software.5 Some researchers have alleged that operatives aligned with Iran’s government were responsible for the majority of AI-generated fakes spread during the war, but Open Measures was unable to independently corroborate those claims.6

On Mar. 15, US President Donald Trump shared a post on Truth Social that described Iran’s reported use of AI-generated content on social media as amounting to a “Disinformation weapon,” arguing that news media organizations “should be brought up on Charges for TREASON” for sharing AI-generated material from Iran.7

Reported Attacks Against US Aircraft Carrier Stir Confusion

The Islamic Revolutionary Guard Corps (IRGC), Iran’s primary military force, has repeatedly targeted US warships deployed in the region with missiles and drones since the war began. Many of its attempted attacks have targeted the USS Abraham Lincoln, a US aircraft carrier supporting airstrike operations against Iran.

On several occasions, the IRGC claimed its strikes on the USS Abraham Lincoln inflicted significant damage on the ship that forced it to flee the region. US Central Command (CENTCOM) has repeatedly denied those claims and stated that the ship remains fully operational.8 But despite US rebuttals, Iranian officials have continued to declare that their operations aimed at the ship have been successful – with newer claims sometimes in direct conflict with their own prior claims.

Amidst contradictory statements from government officials, fact-checkers and researchers observed AI-generated videos circulating on social media that purported to show the USS Abraham Lincoln taking on major damage from Iran’s reported strikes.9 On Mar. 16, Trump told reporters that after seeing one such video, he asked a US military general about the ship’s status, only then learning that the video was fake.10

State-Backed Media Shared IRGC Claims, State-Aligned Aggregators Spread Them Further

Open Measures sought to better understand the role that state-backed media outlets and state-aligned actors played in promoting disputed claims about Iran’s attacks on the USS Abraham Lincoln among English-language audiences. For our analysis, researchers examined how state-affiliated actors boosted the IRGC’s claims on Telegram: a cloud-based messaging app used by billions around the globe.11

Using our platform’s Timeline feature, we analyzed the daily post volume of four English-language, Iranian-government-backed news outlets on Telegram – Mehr News Agency, Tehran Times, Press TV, and the Islamic Republic News Agency (IRNA) – and found that all four began to post more frequently after the war began.

To identify Telegram posts discussing Iran’s attacks on the USS Abraham Lincoln in our datasets, researchers used the following search query:

((("USS" OR "US") AND ("Abraham Lincoln" OR "Lincoln")) NOT ("Gerald R. Ford" OR "Gerald Ford" OR "Tripoli" OR "Bataan" OR "Carter Hall")) AND (missile* OR drone* OR attack* OR fire* OR damage* OR strike* OR struck OR sank OR sunk OR flee* OR fled OR retreat*)

The query identified 564 total Telegram posts shared across 172 unique channels between Feb. 28 and April 14. According to our data, those posts cumulatively received nearly 3.5 million views and were together re-shared more than 19,000 times.

Using our platform’s Activity feature, we saw the highest number of posts matching our query in a Telegram channel operated by Press TV, an English-language outlet operated by Iran’s government. Since the war began, 38 posts in the channel mentioned attacks on the USS Abraham Lincoln. In total, the 38 posts identified were re-shared at least 645 times and received nearly 165,000 views.

Other channels that had frequently shared posts we identified included state-backed news outlets in Russia and dozens of aggregator channels that promote news reports and messaging aligned with Iran and its allies, including Russia, Turkey and Palestine.

Case Study

Open Measures found that Iranian and Russian state-affiliated media organizations played critical roles in spreading the IRGC’s claims about attacking the USS Abraham Lincoln on Telegram. Throughout the war, the outlets shared English-language posts amplifying statements made by IRGC officials, which were then shared and cited by a host of state-aligned news aggregation channels. As the claims gained traction, they spread to groups with broader political orientations, spurring debate and confusion – a key objective of past misinformation campaigns.12

Our researchers looked closer at the posts our query identified between Mar. 12 and Mar. 16, after the IRGC claimed its attacks against the USS Abraham Lincoln had been severe enough to render the ship “inoperable” and force it to retreat to the US. CENTCOM denied the claims, calling them “recycled lies,” and stated that the ship was still in use.13

On Mar. 12, a host of state-aligned aggregator channels shared posts promoting IRGC claims that the USS Abraham Lincoln had suffered major damage and was retreating back to the United States.

During this period, we identified 108 posts from our query that together received more than a quarter-million views and 6,400 re-shares. Some results were false positives, sharing reports that US forces fired on an Iranian vessel that got too close to the ship.14 Researchers excluded those posts from the following analysis.

In the hours that followed, Iranian and Russian state-backed media organizations shared posts containing the same claims, but packaged as news reports.

As the story developed, more news aggregation accounts shared the claims, sometimes sharing or attributing directly to Iranian and Russian state-backed media organizations. As the story developed, this circular process repeated several times.

After CENTCOM denied the IRGC’s reports about the attack and Trump denounced Iran’s alleged use of AI-generated misinformation, state-backed outlets and state-aligned aggregators responded by recirculating the IRGC’s claims the ship was severely damaged in its attacks and forced to retreat from the region, reposting and citing prior reports from aggregators and state-backed outlets.

The conflicting claims spurred doubt among some online communities, who questioned what had actually happened to the ship. For example, on Mar. 12, a post in a Telegram aggregator account questioned “what truly happened.”

Conclusion

The rise of open-source intelligence research and social media analysis in recent decades has caused global conflicts to receive unprecedented scrutiny from their onlookers. Our analysis suggests that state-backed media organizations and state-aligned aggregator accounts are cognizant of this fact and may be seeking to complicate online analysis of the Iran war (in addition to other objectives, like rallying public support, or creating confusion and political unrest among the citizens of an opposing country).

As seen in the case of the USS Abraham Lincoln, state-backed actors play a critical role in stirring confusion over reported events but are rarely the sole drivers of information disorder surrounding international conflicts. Rather, they seed the ecosystem with the source material state-aligned actors need to spin up their own narratives. Advancements in generative AI technology have exacerbated the issue, making it easier than ever to create fake images and videos as “evidence” for false narratives.

Open Measures builds research tools to help researchers stay afloat in this ever-evolving social media landscape.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state-backed info ops. Click here to book a demo.

Here’s a look back at the stories we published in March.

Dark Market for Explicit AI ‘Deepfakes’ Evolves on 4chan

This piece took a deep look at 4chan’s “Adult Requests” imageboard. While the subforum was initially dedicated to discussing and sharing pornography, in recent years it has since evolved to become one of the largest distributors of nonconsensual sexual images made with generative AI tools — offer referred to as “deepfakes.” The imageboard’s users almost exclusively target female subjects in their abuse, some of which plausibly appeared to be minors.

Alternative Platforms Aren’t Fringe Anymore

Our CEO, Hank Teran, wrote this op-ed to dispel suggestions from researchers and journalists that alternative social media platforms are a dying breed. That couldn’t be further from the truth. Our team continues to see niche and specialized social platforms influence the broader internet in profound ways and produce unique harms.

Conspiracy Theories About Bill Gates See Revival Following ‘Epstein Files’ Release

Bill Gates, the billionaire co-founder of Microsoft, has been the subject of far-fetched conspiracy theories for as long as we can remember. After the US Department of Justice released millions of “Epstein Files” in January, some of which included communications Gates and his top associates had with the child sex offender in the early 2010s, those conspiracy theories saw a resurgence among far-right communities.

Election Denialists’ Obsession with Georgia Fueled by Narratives From Gateway Pundit

Ahead of 2026 midterm elections, our team has been checking in on the state of election denialist chatter surrounding key states. In this piece, they focused on Georgia. We found that conspiracy theorists’ chatter about voting in the state was heavily shaped by a small number of actors — most notably The Gateway Pundit, a pro-Trump conspiracy blog.

Polymarket Taps Palantir for On-Chain Monitoring as Fraudulent Schemes Thrive Off-Chain on Telegram

Polymarket, a so-called “prediction market” that allows users to gamble on the outcomes of virtually any future event, has scrambled to introduce new policies and initiatives meant to address concerns about insider betting and platform integrity. Most of the company’s efforts focus on activity on the platform itself, but our researchers uncovered a host of suspicious activity being organized off-platform on Telegram.

Thanks for being here! Our newsletter has been steadily growing, which is really exciting for us. Don’t hesitate to forward new editions to others or recommend us to colleagues and friends.