4chan’s “Adult Requests” imageboard was one of the internet’s largest and fastest-growing venues for the nonconsensual trading and solicitation of sexually explicit images generated with AI tools — commonly known as “deepfakes.”

Then, on May 21, 4chan abruptly shut Adult Requests down. At the time of writing, the imageboard has been removed from the site’s index, and its URL returns an error page reading: “File not found.”

We’ve seen Adult Requests go dark before, only to return within days. But this time feels different: more than a month has now passed with no apparent sign it’s coming back.

The closure appears to have largely gone unnoticed by users on 4chan’s other boards, though a handful have voiced confusion over its disappearance and the absence of any explanation.

Earlier this year, Open Measures published an investigation into Adult Requests that exposed the scale and intensity of abuse occurring on the board. It sparked a broader wave of scrutiny — among researchers, policy analysts, and journalists — into its role in the wider ecosystem of nonconsensual intimate imagery (NCII) online.

We’re glad our report helped drive a broader reckoning with this corner of the internet, and we’ll keep watching for where its former inhabitants migrate next.

Subscribe now

As we enter the dog days of summer, here’s a look back at the research we published in June.

But first…

4chan Quietly Pulled ‘Adult Requests’ Last Month. There’s Still No Sign It’s Coming Back.

By Jared Holt

4chan’s “Adult Requests” imageboard was one of the internet’s largest and fastest-growing venues for the nonconsensual trading and solicitation of sexually explicit images generated with AI tools — commonly known as “deepfakes.”

Then, on May 21, 4chan abruptly shut Adult Requests down. At the time of writing, the imageboard has been removed from the site’s index, and its URL returns an error page reading: “File not found.”

We’ve seen Adult Requests go dark before, only to return within days. But this time feels different: more than a month has now passed with no apparent sign it’s coming back.

The closure appears to have largely gone unnoticed by users on 4chan’s other boards, though a handful have voiced confusion over its disappearance and the absence of any explanation.

Earlier this year, Open Measures published an investigation into Adult Requests that exposed the scale and intensity of abuse occurring on the board. It sparked a broader wave of scrutiny — among researchers, policy analysts, and journalists — into its role in the wider ecosystem of nonconsensual intimate imagery (NCII) online.

We're glad our report helped drive a broader reckoning with this corner of the internet, and we'll keep watching for where its former inhabitants migrate next.

What We’re Reading:

• An Influential Time (SPLC)

• Fake Dating Profiles, Real Foreign Influence (NewsGuard)

• Big Trouble on Small Forums: Largely Unknown Small Sites Driving Extremist Violence (GPAHE)

• Dear Media is the vaccine skeptical trojan horse targeting millennial women (Number Two Pencil)

• It Is Trivially Easy to Use Reddit to Manipulate AI Search, Research Suggests (404 Media)

Before you go…

• Check out recent articles in The Atlantic and Hate Comes to Main Street featuring insights from Open Measures researchers.

• Revisit our flash report about the right-wing media “antifa” narratives that set the stage for DOJ prosecutors to charge 15 anti-ICE protesters in Minnesota.

• But perhaps most importantly…

A recent article published in The Atlantic detailed how MAGA media figures have changed their tune around the botched renovation of the Lincoln Memorial Reflecting Pool, presenting those rapidly changing talking points as phases in a 13-step political spin cycle regularly seen in pro-Trump punditry.

Subscribe now

The piece featured insights from Open Measures senior researcher Jared Holt, supported by findings produced with our platform’s new Research Assistant. Holt used the Research Assistant to quickly generate a summary of evolving narratives about the Reflecting Pool across 2,500+ posts in our datasets and talked to The Atlantic to provide additional context and commentary about those findings:

These recurrent steps extend beyond Trump into the broader MAGA coalition. Recently, Jared Holt, a senior researcher at Open Measures, an organization that tracks online extremism, used a generative-AI research tool to spot patterns in posts about the Reflecting Pool by right-wing accounts on a selection of right-wing social-media platforms such as Truth Social. The tool broke down more than 2,500 posts into three buckets:

Phase 1: Triumph and Restoration

Phase 2: Defending the Project

Phase 3: Sabotage and Culture War

“For the MAGA faithful, Trump’s renovation of the Reflecting Pool was supposed to be a shining example of his efforts to restore America from its decaying state,” Holt told me. “When it became clear the renovation had been a disaster, MAGA influencers shifted their talking points to instead portray the situation as being emblematic of their critics’ depravity and derangement.” The pattern, Holt noted, is similar to how the MAGA media system responded to the ICE killings in Minnesota earlier this year, or how it has tried to spin the war in Iran. “The primary function of this media ecosystem is to hype up and pacify Trump’s base. And these days, as public support for the administration craters, it’s doing a lot more of the latter.”

Check out the full article, here:

The Atlantic

Subscribe now

Background

Libs of TikTok is a popular far-right social media account widely recognized for its role in helping to repopularize anti-LGBTQ+ hate and conspiracy theories within the conservative movement, including “groomer” narratives that falsely portray LGBTQ+ people as predatory sex abusers who target children. Since the account was started on Twitter in 2021 by Chaya Raichik, a former real estate agent, Libs of TikTok has amassed millions of followers across multiple platforms and leveraged its audience to inflict real-world harms against LGBTQ+ people and their allies.

The account’s posts routinely encourage ridicule and outrage against individuals and institutions it claims are complicit in “grooming” children for sex abuse or demonstrate the supposedly sinister dispositions of LGBTQ+ people. Among other targets, Raichik has frequently attacked public schools and their their staff, claiming they promote radical ideologies and sexual degeneracy to their students, and posted content containing the contact information for targeted faculty members. Schools and teachers featured in Libs of TikTok posts have faced bomb threats and severe harassment, causing major disruptions and safety risks.

As Raichik’s account grew in popularity with online right-wing audiences, so did her role in guiding the Republican Party’s escalating attacks on LGBTQ+ rights and public education, extending her influence far beyond the confines of any particular social media platform. Raichik and her Libs of TikTok account have directly and indirectly guided the focus of GOP policymakers, right-wing media outlets, conservative activist groups, and far-right extremists – providing them a constant roster of potential villains and hateful narratives to justify antagonizing them. President Donald Trump courted Raichik during his 2024 campaign, and officials in his second administration have consulted her on education policy and public messaging.

In addition to anti-LGBTQ+ rhetoric, the account has also targeted a host of people and organizations in posts promoting anti-immigrant sentiments and hostility toward diversity, equity, and inclusion (“DEI”) policies. And beyond educators and LGBTQ+ people, the account’s posts have elicited threats against private businesses, healthcare providers, and nonprofit organizations.

Libs of TikTok is best-known as an X (formerly Twitter) account, but its digital footprint expands across an array of mainstream and alternative social media platforms, where its self-identified “team” of unspecified individuals (likely including paid employees) distribute their posts to millions of followers.

After Years of Inactivity, Libs of TikTok Suddenly Ascends on Truth Social

Earlier this year, our researchers noticed that Libs of TikTok’s profile on Truth Social, an alternative microblogging site launched by Trump in 2022, had become one of the platform’s most-influential accounts. As our researchers observed Libs of TikTok ramping up its attacks against schools during Pride Month, we sought to examine its influence on Truth Social and how users there have responded to its posts.

Raichik created a Libs of TikTok account on Truth Social in February 2022, coinciding with the site’s public launch. In her first post on the site, she expressed enthusiasm for Trump’s new social media platform: “I can’t wait!! This is really exciting!”

But despite that initial enthusiasm, the Libs of TikTok account has been relatively inactive on the platform for most of its existence. Using our platform’s Timeline tool, we saw that the account has exhibited on-and-off activity since its creation, sometimes going months without posting.

That changed on Dec. 23, 2025. Libs of TikTok returned to Truth Social after a 300-day period of inactivity and began ramping up its daily activity to previously unseen levels. At the time of writing, more than two-thirds of all observed Libs of TikTok posts were shared in 2026. Since rejoining Truth Social, the account has averaged 29 posts per day on the dates it uploaded content. (Libs of TikTok’s account is “usually offline” on Saturdays.)

Libs of TikTok’s Truth Social posts are often word-for-word copies of posts that originally appeared on its better-known X account. Notably, Libs of TikTok does not mirror every popular post made on X onto Truth Social; we were unable to surmise how the account might determine which of its posts to omit.

Libs of TikTok posts have consistently seen high engagement on the platform since the account ramped up its activity late last year. Of the 3,986 posts it shared in 2026 at the time of writing, more than 40% were reshared 500 or more times by Truth Social users. Less than 20% of the posts it shared before 2026 saw such engagement – indicating that Libs of TikTok’s reach on Truth Social has significantly grown since its return.

We performed another search to identify all Truth Social posts in our datasets that were made this year and received 500 or more reshares, then used our Activity tool to group the results by account. At the time of writing, Libs of TikTok had shared 1,578 posts that received 500 or more reshares in 2026 – more than double the number of high-engagement posts the official White House account shared on the platform over the same period.

The only account that shared more posts achieving such traction was the one used by Trump, who owns the site and serves as its primary draw.

Libs of TikTok Routes Truth Social Users’ Focus Toward LGBTQ+ People and Public Educators During Pride Month

We used our platform’s Discover tool to identify every post that Libs of TikTok shared on its Truth Social account between June 1 and June 14 – the first two weeks of Pride Month – and reviewed them to count how many expressed hostility toward others surrounding issues related to LGBTQ+ identity, gender identity, and public education.

Of the 392 posts Libs of TikTok shared on Truth Social during that period, about one-third (131 posts) featured hostile language about the LGBTQ+ community and its allies. Most posts identified in this category highlighted individuals and entities that shared pro-LGBTQ+ messages for Pride Month, often targeting state and local government officials and entities.

About a quarter of the account’s anti-LGBTQ+ posts during the first two weeks of Pride Month expressed outrage at the public education system, which Raichik has long claimed is complicit in “grooming” children for LGBTQ+ people to sexually abuse. Nearly all posts targeting educators named specific schools and faculty members, and several provided contact information that Libs of TikTok followers could use to reach them.

Libs of TikTok’s anti-LGBTQ+ posts targeting public educators were reshared by Truth Social users more frequently than those that targeted individuals and entities unrelated to schools, on average. The 34 anti-LGBTQ+ posts targeting public educators in the period analyzed received an average of about 393 reshares each, while the 97 posts targeting other subjects saw an average of about 336 reshares each.

An additional 14 posts targeted education-related subjects over issues unrelated to LGBTQ+ identity or gender-identity, including posts that attacked schools for allegedly engaging in discrimination against white people, targeted educators who allegedly shared violent rhetoric on social media, and faulted schools for accommodating Muslim students. In total, more than one-in-ten (about 12%) Libs of TikTok posts on Truth Social in the period we analyzed targeted public educators in some way.

As Seen On Other Platforms, Libs of TikTok Posts Elicit Violent Rhetoric Against Their Subjects on Truth Social

Open Measures saw that Libs of TikTok’s anti-LGBTQ+ posts consistently elicited hostile and violent rhetoric from Truth Social users – not unlike the responses it has regularly provoked on mainstream social media platforms – and in turn inspired some users to target the same individuals and entities Libs of TikTok mentioned in their own posts.

Over the first two weeks of Pride Month, Truth Social users reshared the 131 anti-LGBTQ+ posts we identified on Libs of TikTok’s profile a total of 45,965 times and replied to those posts a total of 12,404 times.

Of the posts targeting public educators, the most-reshared was a June 5 post that attacked a female school board director in Bellingham, Washington, who owned a sex shop that planned to host educational sessions for children during Pride Month. Libs of TikTok’s post included the name and photo of the school board director, a picture of her store, a copy of a flyer advertising the classes, and a screenshot of a post it previously shared on X that targeted a high school in the district she oversees and included the school’s phone number.

Truth Social users who replied to that post called for the school board director’s arrest, encouraged one another to report the woman to federal authorities, fantasized about violence against her and her business, and alluded to harassing her further. “She has an address,” one user replied. “We need to put these pedophiles to death,” another wrote. Several users posted that they had called the school; one said they were searching for a phone number for the sex shop.

The Libs of TikTok post targeting a public educator that elicited the highest number of replies in our analysis period was a June 8 post attacking a math teacher and coach at a high school in Fort Worth, Texas, who shared a video discussing her students’ reactions to learning she was in a same-sex relationship. The post named the teacher, included a clip of the video she shared, and listed the email address of the principal at the school she worked for.

In replies to that post, Truth Social users baselessly claimed the teacher was a pedophile, called for her to be fired from her position, and expressed violent fantasies. “LEGALIZE EUTHANASIA,” one reply stated. Another user wrote: “If this EVIL BITCH had done this to my child she wouldn’t be sitting their bragging online because she would be 6 FEET UNDER WITH NOT 1 STRAND OF HAIR ON HER COLD EMBALMED NAPPY HEAD.”

We found that Libs of TikTok’s posts about public educators regularly elicited responses like these from Truth Social users.

After Libs of TikTok posted about a school soccer coach who is a transgender woman, a Truth Social user responded that it was “curb check time.” When it attacked an Oregon school district that displayed a LGBTQ+ Pride flag outside its headquarters, a user called for “public hanging” of education officials. Notably, Libs of TikTok posts that included school and faculty members’ emails and phone numbers regularly elicited replies from users who reported contacting them to voice their disapproval.

In a 2024 interview, Raichik said she does not condone threats against schools featured in her account’s posts and questioned whether people who had sent bomb threats those institutions received were actually her followers.

“We don’t know who’s calling in the threats,” Raichik said in that interview. “I mean, look, bomb threats are bad. I’ve said that a thousand times. People that call in bomb threats should be arrested and investigated. You can’t call in bomb threats. But I just don’t know what – what does it have to do with me?”

What We’re Watching

Libs of TikTok’s posts have consistently elicited threats and harassment against LGBTQ+ people and public educators since its launch in 2022, and the account’s increased activity on alternative platforms expands the potential scale of the backlash it can spark against its targets.

The account’s overnight dominance on Truth Social is particularly notable, since the platform serves as the Trump Administration’s semi-official communications platform. As the account’s owner, Raichik, deepens her ties to the Trump Administration and other Republican Party leaders, posts shared by her Truth Social account could have even greater impacts on pro-Trump officials’ policymaking and rhetoric.

Open Measures’ platform is designed to enable threat-monitoring investigations across dozens of alternative platforms that often go unmonitored. As such, we will continue to monitor and report on harmful activity that occurs on those sites.

TLDR

• Telegram, a popular privacy-oriented messaging and social media app, promised to overhaul its approach to platform moderation after French authorities brought criminal charges against its founder in 2024, alleging that the company’s historically minimal moderation and longtime refusal to cooperate with law enforcement investigators amounted to complicity in the illegal activities taking place on the platform.

• In 2025, Telegram reportedly removed more than 43.5 million channels and groups, including millions linked to cybercriminal activities. The scale of enforcement was unprecedented in the platform’s history, but analysts have found that Telegram remains a fixture of the cybercriminal economy.

• To investigate these claims ourselves, Open Measures analyzed the activity in Telegram channels and groups in our datasets from 2024 (before Durov’s arrest) to the present to assess how cybercriminal actors have adjusted to the platform’s shifting policies.

What is Telegram?

Telegram is a privacy-oriented, cloud-based messaging app launched in 2013 by Russian-born brothers Pavel and Nikolai Durov. The Durovs developed Telegram amid escalating pressure from the Russian government over their refusals to censor content on VK, seeking to create a secure communications platform that was impervious to government surveillance and speech restrictions.1 While Russian state actors have used Telegram to disseminate their own messaging, Russian officials have limited access to the app in their country, ultimately banning it outright in April 2026.2

The app’s design allows for greater degrees of privacy than other platforms. Telegram allows users to create accounts with anonymous phone numbers, offers limited encryption methods to protect private communications, and spreads its infrastructure across data centers and servers owned by an array of shell companies in multiple jurisdictions – making it more difficult for countries to subpoena user data. In addition to direct communication between individual users, it also facilitates groups and channels, which function similarly to chat rooms and microblogging profiles on other social media sites.3

Since its launch, Telegram has become one of the most widely used apps of its kind, attracting billions of users worldwide.4 Some of its earliest non-Russian users were based in nations with heavy censorship laws and included pro-democracy activists organizing under repressive governments. But Telegram’s privacy features and reluctance to moderate content have also attracted nefarious actors, including repressive regimes, terrorist groups, violent extremist movements, and cybercriminals.5

In 2024, French authorities arrested Pavel Durov and alleged that Telegram’s inaction against illegal content and failure to cooperate with legal investigations amounted to complicity in a host of severe crimes occurring on the platform.6 (Russia also launched its own criminal investigation into Durov for “abetting terrorist activities” in February 2026.)7 After his arrest, Durov announced that Telegram would make greater efforts to comply with valid legal requests and take proactive action against illicit user activity – a significant departure from its longtime “hands-off” philosophy.8

Shortcomings of Policy Changes and Takedowns Meant to Address Cybercrimal Activity

In his first public post after his 2024 arrest, Durov said the criminal charges brought against him were “misguided,” but acknowledged that criminal abuse was occurring on Telegram and said the company was taking down “millions of posts and channels every day” while continuing to work through the “growing pains” of illicit activity on its platform.9 In the weeks after Durov’s arrest, Telegram introduced new reporting mechanisms for users to flag illegal activity and updated its privacy policy, stating that it would disclose users’ phone numbers and IP addresses when it received valid court orders.10 The company also stepped up its enforcement actions against illicit content.11

But cybersecurity professionals have found that Telegram’s policy changes and takedowns have not meaningfully deterred or addressed cybercriminal activities taking place on its platform; some reports suggest the issue may have actually worsened since the crackdowns began.12 Users engaged in cybercriminal activities have reportedly rejoined the platform with new accounts and adopted new tactics for evading enforcement actions in lieu of migrating to other platforms.13

Telegram remains uniquely appealing to would-be cybercriminals today, offering unmatched features that allow for users to start and scale-up their operations with ease and speed. Unlike dark web forums, which can require special software or privileged access, the platform is simple to join. It also allows users to deploy administrative bots in their groups and channels that can facilitate financial transactions, aggregate messages, and interact with members on their behalf. Additionally, its message-forwarding mechanic allows for channel creators and group members to distribute messages far and fast, and for previously-forwarded messages to continue circulating even if a network’s “hub” is taken down.14

Methodology

Open Measures’ datasets include archives for thousands of Telegram groups and channels, including many that appear to engage in cybercriminal activities. Our researchers sought to examine how the channels we collect data for have adapted to Telegrams’s policy changes and takedowns targeting illicit user activity.

To identify a range of potentially relevant posts, we created a broad search query that included cybercrime-related keywords drawn from our prior research and published reports that name known threat actors, marketplaces, and criminal services:

“fullz” OR “fulls” OR “combolist” OR “stealer logs” OR “CVV” OR “CVVs” OR “credential stuffing” OR “LummaC2” OR “Lumma” OR “RedLine” OR “Redline Stealer” OR “Raccoon Stealer” OR “stealer” OR “ransomware affiliate” OR “affiliate program” OR “malware” OR “exploit” OR “payload” OR “dropper” OR “romance scam” OR “investment scam” OR “ghost-tapping” OR “NFC relay” OR “romance scam” OR “investment scam” OR “ghost-tapping” OR “NFC relay” OR “deepfake” OR “face swap” OR “voice clone” OR “BidenCash” OR “Omega Cloud” OR “Observer Cloud” OR “Moon Cloud”

Researchers used built-in tools on the Open Measures platform to analyze the posts that matched our search query and identify trends.

Analysis

Our researchers performed three separate searches with our Timeline tool to visualize the number of Telegram posts in our datasets matching our search query in 2024, 2025, and 2026.

Among channels we collected, daily activity levels remained consistent throughout 2024 – including the months after Durov’s arrest in August – and much of 2025, though we saw a dramatic increase beginning in October 2025. That surge was followed by another series of spikes between November 2025 and January 2026, with elevated activity sustained thereafter.

As illustrated by Telegram’s own data (included below), the platform has steadily increased its overall moderation efforts since May 2024, with average daily account takedowns in 2026 approximately four times the daily average in May 2024. These efforts have been accompanied by periodic enforcement spikes through early 2025 and into early 2026 (with a sustained decline in moderation and no major spikes after Feb. 20, 2026).

Telegram’s self-reported moderation data mirrors our own findings: as the volume of posts matching our query in late 2025 and early 2026 increased, so did Telegram’s reported takedowns. Likewise, Telegram’s declining moderation in mid-February 2026 onward also aligns with the declining volume of query-matching posts our researchers observed.

Though Durov’s arrest in France served as a catalyst for Telegram’s increased moderation, the platform has sustained its efforts in response to increased suspected illicit activity for several years. Though the recent decrease in both posts matching our query and Telegram’s account takedowns might suggest the platform has attempted to address its cybercrime problem, the average volume of posts matching our query remains higher today than in years prior, suggesting cybercriminals are finding ways to adapt to Telegram’s policy changes and increased takedowns.

Trends By Search Period

Activity matching our search queries was led by different sets of groups and channels included in our datasets in 2024, 2025, and 2026. Notably, the names of the dominant groups and channels we observed hosting cybercriminal activities in each period were often misleading, presumably as a strategy to avoid moderation and attract unsuspecting users. Our researchers also observed that groups and channels most active in 2024 and 2025 seemed to use names with similar themes; in 2026, the groups and channels whose posts matched our queries changed, as did their naming conventions.

2024: Cybercrime-themed Spam in Politically-styled Telegram Groups

Throughout 2024, many of the most active groups and channels in our datasets that we observed engaging in likely cybercriminal activities (e.g., spammed advertisements for fraudulent documents and stolen user credentials) were styled after US political themes, most notably “ThePatriotPartyofOH,” “FreeWestVirginia,” and “PatriotPartyOregon.” Volume during this period was moderate, with “ThePatriotPartyofOH” leading with more than 3,000 hits.

2025: Increased Activity and Proliferation of Politically-styled Groups

Throughout 2025, our researchers saw the volume of posts in our datasets matching their search query significantly increase. The previously identified “FreeWestVirginia” channel shared approximately 16,000 posts matching our query (a roughly 30-fold increase from the period before). We also saw approximately triple the number of positive hits in posts shared by the “ThePatriotPartyofOH” channel.

The most active groups in this period that explicitly advertised cybercriminal services included additional channels and groups with “Patriot Party” names or political themes (e.g., “PatriotPartyNewHampshire,” “FreeSouthDakota”). As we observed in the 2024 search period, many posts we identified in other channels were apparent advertisements for cybercriminal services.

2026: Increased Activity, Proliferation of Financially-styled Groups

In 2026, despite Telegram’s reported takedowns of millions of accounts in late 2025, the volume of posts in our datasets matching our query was still dramatically higher than prior years. Researchers identified roughly four times as many posts matching their search query that were shared in 2026 than were shared 2025.

Rather than groups and channels with American political themes, the groups we identified as advertising cybercriminal services were often named after finance and OTC (“over-the-counter”) investing terms, like “otc_investorhub” and “chat_nft.” We also identified a cluster of similar groups styled around employment in Ukraine, like “truework_stkyiv.” The channel that shared the highest number of posts matching our query, “ChekerCCsLive,” was named in reference to “checking” if a stolen credit card or “CC” number is still “live” and usable.

Fraud Services and Scam Recruitment Posts

Our researchers observed that posts in “OTC” channels frequently featured advertisements for apparent financial fraud and money laundering services. Posts shared in the “WTSotc” channel, which shared hundreds of thousands of posts matching our search query prior to its removal, often followed one of several distinct spam formats. The posts we reviewed included offers to provide fraudulent documents, account logins, and money laundering services, and attempts to solicit peer-to-peer crypto transactions with other users.

In Ukrainian-employment-themed groups we identified, such as “truework_stkyiv,” our researchers encountered an array of posts advertising remote work opportunities using language consistent with online “pig-butchering” schemes and romance scams.15

Persistence of ‘Patriot Party’ Channels

While most cybercriminal channels and groups from earlier periods appeared to have been taken down or ceased their activity in recent years, many of the politically-named groups we identified – namely “PatriotPartyRI,” “FreeSouthDakota,” “PatriotPartyNewHampshire,” “PatriotPartyOregon,” and “FreeWestVirginia” – had survived Telegram’s increased moderation efforts and remained active at the time of writing.

Based on activity patterns in our datasets and manual verification, only the “ThePatriotPartyofOH” and “FreeNorthDakota” had been taken down (likely around October 2024 and May 2025, respectively). Other than “otc_investorhub,” all the active groups we identified in 2026 remained active as well.

Conclusion

While Telegram has demonstrated significant efforts to crackdown on cybercrime, it remains a fixture of the cybercriminal economy as illicit actors continue to adapt to its policies to avoid moderation. Despite a slight decline in recent months, the volume of posts on Telegram likely related to cybercriminal activities remains much higher than it was just two years ago.

Telegram’s moderation efforts appear to have done little to reduce overall cybercriminal on the platform – and as our research suggests, the problem is likely to persist as a result of the platform’s infrastructure, which remains unchanged.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.

Open Measures found that alternative platform users promoted conspiracy theories attacking a host of pharmaceutical companies that develop vaccines last month after reports that global health authorities were responding to a deadly Ebola virus outbreak in the Democratic Republic of the Congo. With the help of our new Research Assistant, researchers identified harmful narratives targeting several companies.

Subscribe now

Context

The World Health Organization (WHO) declared on May 17 that the spread of Bundibugyo virus, which can cause Ebola in humans, in the Democratic Republic of the Congo was a “public health emergency of international concern” and advised global health authorities to take precautionary measures to limit its spread. In response, medical scientists have expedited research into possible vaccines for the disease.

Amid international alarm over the outbreak, misinformation and conspiracy theories about Ebola have run rampant on social media, following close on the heels of such claims surrounding a hantavirus outbreak aboard a Dutch cruise ship weeks earlier. Some of these narratives have taken direct aim at major pharmaceutical companies, including one actively working to develop an Ebola vaccine.

Our Approach

Open Measures sought to better understand how communities on the platforms we monitor have refashioned grievances against pharmaceutical companies into new narratives and conspiracy theories surrounding the recent Ebola outbreak. The pharmaceutical companies included in our search queries included Moderna, Pfizer, AstraZeneca, Merck, and GSK. We also searched for mentions of “big pharma” in posts discussing Ebola.

Our researchers used Open Measures’ new Research Assistant to generate a report summarizing claims made about major pharmaceutical companies related to Ebola across 24 platforms in our datasets in a month-long period spanning May 4 to June 3, 2026. An excerpt of the report produced by Research Assistant can be viewed below.

Informed by that report, researchers proceeded to use the analysis tools built into our platform to corroborate its findings and explore the themes it identified in greater detail. By using Research Assistant to identify prominent narratives in our datasets in the early stages of their analysis, our researchers saved hours that would otherwise be spent manually reviewing search query results to identify potential leads for their research.

‘Every. Single. Time’: Conspiracy Theorists Fault Pharmaceutical Companies Amid Ebola Outbreak

Open Measures found that hostile narratives about pharmaceutical companies surged across several platforms after the WHO declared the Ebola outbreak in the Democratic Republic of the Congo was a public health emergency and again following reports the Coalition for Epidemic Preparedness Innovations (CEPI) awarded millions of dollars to scientists developing potential vaccines against the disease.

Using our platform’s Discover tool, researchers reviewed more than 650 posts mentioning pharmaceutical companies in relation to Ebola to understand how different companies were being targeted.

Moderna

More than 75% of the posts we identified took specific aim at Moderna, an American pharmaceutical company that specializes in the development of mRNA vaccines. Earlier this year, the CEPI awarded $26.7 million to scientists working with the company to develop vaccines against several deadly filoviruses, including Ebola, and last week gave millions more to fast-track those efforts in light of the recent outbreak.

Health-focus conspiracy theorists have antagonized the CEPI for years, often fixating on its support for COVID-19 vaccine research and the substantial financial backing it receives from the charitable foundation of Microsoft co-founder Bill Gates.

Across multiple platforms, our researchers saw users highlighting reports about the CEPI’s funding of Moderna to insinuate that the Ebola crisis in the Democratic Republic of the Congo was orchestrated to generate profits for pharmaceutical companies and advance supposed sinister agendas of global elites.

A Telegram post shared May 27 pointed to the CEPI’s “perfectly timed investment” as evidence that the WHO’s advisories around Ebola were “propaganda to sell toxic vaccines.” Another Telegram post, shared on May 24, derided Moderna as one of many “pandemic profiteers” that haven’t been “held accountable.”

“Forecasting future pandemics, expanding emergency powers, and rapidly deploying vaccines has become a lucrative global industry,” a May 25 Telegram post mentioning Moderna read.

Other posts that mentioned Moderna made reference to a supposed “playbook” that health officials used to push vaccines on the public, as seen in this Truth Social post shared on May 18:

The same playbook always repeats: Develop “vaccine” → Fearmonger new outbreak → Declare emergency → Gain power & control → push “vaccine” as [the] only solution.

A Gab post shared on May 19 also alluded to this supposed scheme: “The same playbook always repeats. Every. Single. Time.” Another Gab user posted on June 2 that the response to Ebola was following “the same script” used to hype fears about previous outbreaks.

Pfizer

Our researchers also saw users targeting Pfizer, an American pharmaceutical and biotech company that is not among the groups expediting development of an Ebola vaccine. Several posts we reviewed promoted narratives that insinuated the Ebola outbreak was the fault of Pfizer’s COVID-19 vaccine.

A Gab post shared on May 25 declared that the Ebola outbreak was a “Pfizer Adverse Event.” In a May 30 comment shared on a Breitbart News article via the Disqus platform, another user wrote that the “Pfizer Ebola outbreak” was “sponsored by the CIA, NED, and USAID” – referencing three US federal agencies often attacked in “deep state” conspiracy theories. A comment posted to Rumble on May 12 declared that Ebola fears amounted to “fear porn brought to you by Bill Gates and Pfizer.”

Other Companies

Health-focused conspiracy theories about the Ebola outbreak also targeted other pharmaceutical companies, though our researchers identified significantly fewer of those posts than those that targeted Moderna and Pfizer. One such post was a comment shared on a Breitbart News article via Disqus, where a user wrote they would “rather catch Ebola than have anything produced by AstraZeneca jabbed into my body.”

‘Murder by injection’: Anti-Vaccine Users Encourage Refusal of Potential Ebola Vaccines

When reviewing posts mentioning pharmaceutical companies, our researchers also saw users prematurely declaring their refusal of any potential Ebola vaccines and encouraging others to decline them, should they eventually be available.

Wayne Allyn Root, a conservative radio host and longtime Trump ally, shared a Truth Social post on June 1 mocking anyone who might eventually receive an Ebola vaccine:

Good luck to all those dumb-as-a- doorknob sheeple who take it. If it’s anything like Covid vaxx, I’ll never be able to say, “I told you so.” Because it will kill or cripple you.

Similar warnings appeared in other posts. On May 20, a Truth Social user warned: “Be prepared. This is going to be Murder by injection.” Five days later, on May 25, a 4chan user posted: “REMEMBER TO NOT TAKE ANY MRNA VACCINE FOR EBOLA.”

Across platforms, our researchers saw users sharing posts categorically rejecting global concerns about Ebola. From a Gab post declaring Ebola was a “nazi fascist communist satanic ploy” to a BitChute video questioning whether the outbreak would be “what strips US citizens of their Constitutional Rights,” health-focused conspiracy theorists portrayed the deadly outbreak as a ruse meant to advance the interests of sinister liberal elites.

What We’re Watching

Conspiracy theories about medicine can influence believers to make unwise decisions related to healthcare, like forgoing preventative treatments, experimenting with unproven alternative medicines, and skipping routine check-ups. The spread of anti-medicine narratives can also complicate responses to global health emergencies and elicit threats against the individuals and entities leading those efforts, as seen during the COVID-19 pandemic.

Open Measures will continue to monitor developing narratives around the Ebola outbreak as they appear on alternative platforms, where our researchers have repeatedly seen high-impact narratives first appear before achieving wider online spread.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.

Last month, we debuted our platform’s new Research Assistant tool and published an in-depth white paper on new and developing threats related to AI “jailbreaking.”

You also may have spotted our researcher team in news reports, appearing quoted in The Washington Post, USA Today, KPBS, IT Brew, Raw America, and more.

Hantavirus Conspiracy Theories Spread by MAGA Influencers Appeared Earlier On Alternative Platforms

Shortly after the initial alerts about a possible hantavirus outbreak in early May, social media users on an array of alternative social platforms spread baseless conspiracy theories that health officials might leverage the virus to disrupt 2026 US midterm elections – and three days later, high-profile conservative social media personalities amplified them on various mainstream platforms.

New Product: Research Assistant

We were excited to release Research Assistant, an AI-powered workflow for processing large datasets, identifying key patterns, and generating actionable reports – all in one window. With this new interface, researchers can navigate our datasets seamlessly, transparently, and without sacrificing accuracy or human judgment. Building on existing workflows, Research Assistant helps researchers move from topic or question to finished report in minutes or hours rather than weeks.

Pro-Trump Communities Spent Years Claiming Elections Were ‘Rigged.’ Now They Support Gerrymandering.

Over the last year, President Donald Trump has pressured Republican state lawmakers to voluntarily redraw their maps in order to help Republicans defend their narrow majority in the US House of Representatives. Meanwhile, Republican politicians and their social media influencer supporters have attempted to drum up support for partisan gerrymandering efforts online – in communities that historically claimed US elections were being rigged against Trump and his political allies.

The 2026 AI Threat Landscape Report

The rise of AI has created a new frontier of cyberthreats for organizations and individuals. Many threats are becoming increasingly common, accessible, and sophisticated, with new exploits being developed in organized online forums daily. In our white paper, we did a year-long analysis of the platforms, communities, and tools driving these threats in 2026, offering strategies on how to defend against them before they affect your organization.

Subscribe now

TLDR

• The World Health Organization alerted global health officials to a hantavirus outbreak aboard a cruise ship in early May, encouraging precautionary measures to limit the spread of the disease.

• Shortly following alerts about the outbreak, social media users across an array of alternative social platforms amplified baseless conspiracy theories alleging that health officials were stirring fear over hantavirus to disrupt 2026 US midterm elections.

• Three days after these theories began to spread on alternative platforms, multiple high-profile conservative social media personalities amplified them to mainstream audiences.

Background

The World Health Organization issued alerts earlier this month stating that it was monitoring a hantavirus outbreak after three passengers died of respiratory illness aboard a Dutch cruise ship that departed from Argentina in April. Global health authorities assessed that hantavirus posed a low risk to the global population but advised nations to take precautionary measures to prevent its spread.1

As news spread about the outbreak, users across an array of social media sites spread speculative conspiracy theories and hyperbolic claims about hantavirus that echoed false narratives popularized during the COVID-19 pandemic.2 Many of these high-engagement conspiracy theories implicitly and explicitly alleged that hantavirus was a “plandemic” – a term popularized by a debunked video series that claimed the COVID-19 pandemic was orchestrated by global elites with sinister motives.3

Among the theories our researchers identified were claims that global health officials’ caution about hantavirus signaled the beginning of a plot to disrupt 2026 US midterm elections in ways that would harm Republican candidates. These theories were amplified on social media and various podcasts by a host of high-profile conservative personalities, including Benny Johnson and Tim Pool.4

Our Approach

Open Measures sought to understand where narratives linking May’s hantavirus outbreak to the 2026 US midterm elections originated and where they gained steam before later being amplified by high-profile figures.

Our researchers used our platform to identify posts that mentioned both terms associated with hantavirus and terms associated with midterm elections across alternative platforms we monitor including Telegram, Truth Social, Scored, and 4chan. We also searched Disqus, a networked platform used by websites and blogs to coordinate user comments. To surface potentially relevant posts, our researchers used the following search query:

(”hantavirus” OR “andes virus” OR “sin nombre virus” OR “hantaan virus” OR “seoul virus” OR “puumala virus” OR “ebola” OR “evd”) AND (“plandemic” OR election* OR voting OR midterm*)

We used our platform’s Discover feature to review the query results chronologically, to identify relevant narratives’ earliest appearances on alternative platforms. All searches were limited to April 30 and May 7, the one-week period prior to the day that high-profile conservative figures began amplifying narratives linking hantavirus to midterm elections.

Conspiracy Theorists Dub Hantavirus the ‘Midterm Virus’

Across an array of alternative platforms dominated by right-wing communities, Open Measures observed users beginning to circulate claims that global health authorities hoped to use hantavirus fears to disrupt 2026 US midterm elections almost immediately after the WHO published its May 3 alert about the cruise ship outbreak.

In our datasets, the earliest post we identified promoting this narrative was a May 3 comment on Scored, a platform that hosts a handful of pro-Trump forum boards:

World Health Organization (WHO) is supporting a public health event
Following an election virus (hantavirus) outbreak.

Within hours, a different user on Truth Social, a microblogging site owned by Trump, shared this post [sic]:

Hanti virus just in time to pave way for mail in ballots for midterms

Later that day, a comment left on an article published by The Gateway Pundit, a hyperpartisan junk news blog, read:

It wouldn’t surprise me if they were to weaponize this virus (or bacteria) as the new pandemic for the midterms.

I’ve really developed a taste for 1.87% Ivermectin “horse paste” over the years.

Remember to spay and neuter your liberals

Expansion of Hantavirus Conspiracy Theories on Alternative Platforms

In hundreds of posts shared over a three-day period, various users spread the narrative further across alternative platforms. Researchers saw various users among these platforms refer to hantavirus as an “election virus” and the “midterm virus,” claiming that the infectious disease was “made up” to complicate voting in this year’s US midterm elections and “rig the election again.”

After iterating through conspiracist communities on alternative platforms, several high-profile social media personalities relayed them to larger audiences around May 7.

Our researchers also noted that, on alternative platforms, these conspiratorial narratives about hantavirus appeared alongside other posts espousing predictions that nefarious actors might leverage the disease to stir chaos in American society. In turn, these posts stirred even broader speculation, generating additional groundless discussion about which global elites might be involved and what their possible motivations might be.

Conclusion

Even as mainstream platforms loosen their content guidelines to allow more extreme content, Open Measures has previously observed that alternative platforms still function as originators and incubators for conspiratorial narratives and far-right talking points. In this case, our researchers identified high-profile conservative social media personalities amplifying baseless narratives that health officials’ hantavirus response was in some way connected to the 2026 US midterm elections – a narrative that had already been circulating on alternative platforms days earlier.

For researchers tracking the spread of harmful claims, monitoring alternative platforms can often provide early warning signals about which narratives are most likely to spread. As Election Day nears, Open Measures will continue to track conspiratorial narratives ahead of the 2026 midterms.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.

Introduction

Open Measures is excited to introduce Research Assistant, an all-in-one interface for navigating our datasets more quickly, seamlessly, and transparently, without sacrificing accuracy or human judgment.

Research Assistant harnesses Discover, Timeline, and Activity to deliver greater insights and results than any one of our tools can produce in isolation while remaining grounded in relevant data from Open Measures’ platform. Research Assistant builds on researchers’ existing workflows to help them move from topic or question to finished report in minutes or hours rather than weeks.

What it is:

• A faster way to analyze large datasets. With natural language processing, Research Assistant can synthesize information from thousands of posts quickly, extracting novel insights, narrative trends, and detailed patterns.

• A faster way to produce actionable reports. After quickly gathering critical insights from many large datasets, Research Assistant can help draft comprehensive, shareable reports in five different formats – Summary, Evolving Narratives, Threat Assessment, Spike Analysis, and Brand Monitoring – with the click of a button.

• A simpler way to use Discover, Activity, and Timeline. Instead of manually reviewing posts, exporting spreadsheets, or toggling between views, researchers can run their entire workflow from one interface.

What it’s not:

• A general-purpose chatbot. Research Assistant draws from Open Measures’ data, preventing hallucinations – and ensuring researchers’ expertise and judgment are still essential (by design). It is also not overly personified – we’ve intentionally named it “Research Assistant” (not “Gizmo” or “Steve,” for example).

• A replacement for researchers. Research Assistant uses our platform’s features on researchers’ behalf, reducing friction, allowing them greater access to our platform, accelerating their workflows, and compounding on their expertise.

Our Philosophy

With AI adoption now in countless workflows and many sectors of the economy, Research Assistant intends to bring the positives of AI natively into our platform thoughtfully and responsibly. As such, we designed Research Assistant carefully to reflect Open Measures’ values. After many conversations with employees, customers, and stakeholders, we identified four key ideas that guided our approach:

• Human-in-the-lead (HITL). The user manually controls every step, with the tool showing the underlying queries it will run before it runs them (and asking what results to include in a report). Conclusions are traceable back to real data, and researchers’ domain expertise and query skills remain central (and are not compromised or replaced by the tool).

• Flexible, not prescriptive. Research Assistant does not presume one workflow or one way of presenting results. Instead, it is a non-technical and intuitive interface that supports many different workflows and levels of AI fluency.

• Trustworthy and reliable. Designed not to use web search, Research Assistant draws from real data from Open Measures platform using RAG architecture to reduce hallucinations and promote researcher privacy.

• Transparency without sacrificing speed. New insights generated by Research Assistant are paired with the search queries that produced them, allowing researchers to verify them independently. While the tool does greatly speed up research workflows, it does not transform them into a “black box.”

Product Features

Key capabilities include:

• All-in-one interface: Researchers can combine complex Discover, Timeline, and Activity searches in one chat-based workspace without switching between tools.

• Novel insights and reports: Research Assistant can expand on researchers’ insights, make insights of its own, and generate five types of reports: summary, narrative tracking, threat assessment, spike analysis, and brand monitoring.

• Transparent queries: Every insight the tool generates is mapped onto precise queries that users can review, edit, or rerun.

• Branching conversation paths: Each message ends with options for next steps in a way that branches, allowing users to backtrack to any decision point.

• Multi-agent architecture: To balance speed, accuracy, and cost, Research Assistant automatically switches between models for queries and reporting.

Use Cases

Tracking Narrative Surges Across Platforms

Situation: A communications team notices a new conspiracy narrative gaining traction and wants to quickly understand if or how it’s developing on multiple fringe platforms like 4chan and Telegram.

Role of the tool: Research Assistant generates platform-specific queries, retrieves relevant posts, summarizes the dominant patterns from each platform, and produces comparative timelines - with each analyst approving each decision at each step.

Impact: Without toggling between many windows and posts, the team gains a cross-platform understanding of where the narrative came from and where it might spread almost instantly, giving them a head start on deeper investigations.

Enhancing Reports with Graphs and Artifacts

Situation: A security analyst under a tight deadline needs to gather cross-platform research to create a comprehensive trend analysis report for an important stakeholder, complete with visualizations, specific examples, and info-driven summaries.

Role of the tool: Using Research Assistant, the analyst makes suggestions, receives queries to approve and execute, and gathers a wealth of cross-platform information (using the tool’s branching structure to explore many different queries in parallel at various depths). When satisfied, the analyst has Research Assistant generate a comprehensive trend report with graphs and individual posts cited.

Impact: The analyst gives a polished deliverable grounded in concrete data to the stakeholder ahead of their deadline, helping the stakeholder in a crucial upcoming meeting and improving collaboration across teams.

Beyond primary use cases, Research Assistant also supports many complementary workflows:

• Crawl requests: When a query finds no relevant posts, users can submit new Crawl Requests directly through the chat window.

• Labels: Upon finding an important channel, post, or actor, the user tells Research Assistant to add a custom label to it.

• Post and link extraction: From broad data, the user requests the top five posts by engagement - or extracts URLs from all of the content at once.

• Harm reduction. While browsing potentially harmful data, Research Assistant warns the user about traumatic images or posts rather than showing them automatically.

Looking Ahead

Research Assistant is built to bring the power of AI into the Open Measures platform while keeping researchers in control of the context. We see this as a foundation that we’ll continue to refine and improve based on user feedback. Above all, Research Assistant will always be designed to enhance and preserve human judgment, expertise, and accuracy rather than replacing it.

Due to costs of running and maintaining Research Assistant, it is unlikely to be incorporated into the public, open-source version of Open Measures. For more information on bringing Research Assistant to your organization, reach out to schedule a demo.

TLDR

• State lawmakers across the United States are rushing to voluntarily implement new electoral district maps, hoping to create advantages for their respective parties ahead of 2026 midterm elections – a naked effort at partisan gerrymandering. Over the last year, President Donald Trump has pressured Republican state lawmakers to voluntarily redraw their maps in order to help Republicans defend their narrow majority in the US House of Representatives.

• Republican politicians and their social media influencer supporters have attempted to drum up support for their partisan gerrymandering efforts online, including in communities that have historically promoted conspiratorial narratives alleging elections are rigged against Trump and his political allies.

• Open Measures identified four prominent narratives that right-wing influencers have promoted to garner support for partisan gerrymandering efforts.

Background

Redistricting is the process of reestablishing the geographical boundaries of electoral districts in each state. States are legally required to redraw their district maps once per decade, following the results of the federal census, to account for population shifts and ensure that each district represents roughly the same number of residents.

Unlike other countries that assign the process to independent, non-partisan commissions, redistricting in the United States is performed by each state’s own elected officials, who often strategically redraw electoral maps to their own political advantage (a practice known as gerrymandering).1 Throughout US history, politicians have used partisan gerrymandering to defy voters’ preferences, protect incumbent politicians from potential challengers, and manipulate the electoral impacts of racial and ethnic minority groups.2

President Donald Trump urged Republican state lawmakers in Texas to voluntarily redraw their electoral maps last summer with the explicit goal of creating more Republican-leaning districts in order to help defend their party’s narrow majority in the US House of Representatives in the 2026 midterms.3 Texas officials obliged the request, setting off a larger wave of partisan redistricting efforts across the country.4

These efforts intensified in late April, after the US Supreme Court issued a ruling that effectively demolished provisions in the Voting Rights Act that prohibit racial gerrymandering. In light of that Supreme Court decision, Republican lawmakers in Tennessee passed new electoral maps that eliminated districts where a majority of voters were Black. Other Republican-led states have reportedly debated doing the same.5

Polls show that a majority of Americans are opposed to gerrymandering; more than two-thirds of respondents to an August 2025 YouGov survey said it should be illegal.6 Gerrymandering has been found to damage public faith in democracy and fuel doubts about election integrity.7

Methodology

Open Measures sought to identify posts discussing recent redistricting efforts on five text-based alternative platforms where election denialist movements and their supporters have historically congregated: Gab, Gettr, Telegram, Truth Social, and Scored.

To identify relevant posts, our researchers created a search query including terms referring to redistricting shared over the last year (between May 13, 2025 and May 13, 2026):

(redistrict* OR gerrymander* OR “district map” OR “district maps” OR “congressional map” OR “congressional maps” OR “precinct map” OR “precinct maps” OR “legislative district” OR “legislative districts” OR “district lines” OR “district boundaries” OR “district boundary” OR “new district” OR “new districts” OR “new maps” OR “new map” OR “new line” OR “new lines” OR “new precinct” OR “new precincts”) NOT “RT”

From the query results, our researchers used proprietary data tools built into Open Measures’ platform to identify prominent narratives, actors, and themes.

Interest in Redistricting Surged Around Partisan Push

Open Measures found that users on the five platforms included in our analysis shared more than 80,000 total unique posts that contained a keyword related to redistricting over the last year. Nearly half of the results we identified were shared on Truth Social, an alternative microblogging platform Trump created after he was banned from mainstream platforms for inciting the 2021 riot at the US Capitol Building.8

Using our platform’s Timeline feature, we created a visualization of unique posts shared on each platform per week during our search period. Our researchers saw that increased discussion related to redistricting first occurred on Truth Social, as illustrated by an activity spike in August 2025, shortly after Trump asked Texas lawmakers to redraw their electoral maps. Discussion swelled at various points in the analysis period, typically coinciding with news reports about redistricting efforts across the US, and spiked again as the Supreme Court undercut the Voting Rights Act.

As seen in our prior analysis of election denialist communities, redistricting discussions on platforms we examined were largely driven by articles published by The Gateway Pundit, a hyper-partisan news blog known for publishing falsehoods and conspiracy theories about elections.9 When researchers used our Activity tool to identify the most-shared links in the posts their query identified, they saw the numbers of posts linking to Gateway Pundit articles vastly outnumbered those that linked to stories published by other sites.

On Truth Social, where we identified the most posts discussing redistricting, periods of increased discussion often followed Trump’s posts on the platform that mentioned the topic (which he referenced in at least 50 posts over the last year). Using the Activity tool to show which accounts on Truth Social shared the most posts that received 500 or more re-shares, we identified right-wing media outlets and influencers that frequently promoted conspiracy theories about elections were also among the top drivers of redistricting discussions.

How Pro-Trump Communities Are Selling Partisan Gerrymandering Efforts

Pro-Trump communities have spent years promoting outlandish and conspiratorial claims that US elections are irredeemably corrupt – allegedly rigged by election administrators, voting machine manufacturers, non-profit advocacy groups, law enforcement agencies, and foreign governments in order to sabotage Republicans.10 But ahead of the 2026 midterm elections, the same communities have voiced overwhelming support for partisan gerrymandering efforts.

To gain a fuller context, our researchers reviewed posts our search query identified to assess prominent narratives that users of platforms we reviewed put forward to encourage support of Republican-led redistricting efforts. From our analysis, we identified four key themes.

Immigration Narratives

Pro-Trump influencers have argued that partisan redistricting efforts are necessary to offset the fact that federal census data includes counts of all people who reside in the country – including unauthorized immigrants (who, as non-citizens, are ineligible to vote). Our researchers saw that many posts promoting this argument reiterated talking points from the Trump Administration, framing partisan gerrymandering as a corrective measure meant to level the playing field for Republican candidates.

Last year, around the time Texas was drawing its new district maps, the Trump Administration also discussed ordering a “new” census that would exclude undocumented people from its totals.11

Broader anti-immigrant sentiments also appeared to motivate users who voiced support for redistricting efforts ahead of midterms. Some argued that partisan gerrymandering was necessary to preserve Trump’s immigration agenda, as seen in this post on Gab, shared on April 23, 2026:

NewsFlash: I dislike “gerrymandering” however FL and SC must start their ‘map’ immediately as GOP can NOT loose what we’ve gain! GOP had to finish deporting ALL illegals as well as DACA and now anchor babies. Fact is they destroying all social programs as well as our educational systems.

Dominance Narratives

Many high-engagement posts related to redistricting that we identified argued that redrawing election maps was necessary to prevent Democrats from blocking the Trump Administration’s legislative agenda, impeaching Trump for a third time, and otherwise destroying the nation with their own political priorities.

Posts promoting these narratives often framed redistricting as a non-ideal but necessary move to prevent damage to their own political movement and to prevent their political opponents from gaining power. One high-engagement post, seen below, shared by conspiracy theorist Jacob Creech (aka “Clandestine”) on Truth Social referred to redistricting as “irregular warfare” needed to defeat “the enemy within” – referring to Democrats.

This attitude can also be seen in this Telegram post, shared on Dec. 5, 2025:

We don’t care, if we don’t fix redistricting then everything MAGA falls apart. GROWUP

Fairness Narratives

Other high-engagement posts highlighted cases where Democrat-majority state legislatures enacted electoral maps that had been gerrymandered on partisan and racial lines, framing Republican efforts to do the same as an uncontroversial or justified response to a lack of representation in certain states. In many posts our researchers identified, users highlighted Democratic politicians’ alarm over Republican redistricting efforts and celebrated their apparent distress.

Many posts insisted that Republicans were simply borrowing Democrats’ own tactics, as seen in this post on Scored on April 22, 2026:

They didn’t really start it. All Texas was doing was fixing the insanely Gerrymandered, and illegally created by Democrats, districts.

And this Scored post from Aug. 7, 2025:

Democrats gerrymander the FUCK out of blue states. No matter how you feel about it, we have to do the same in red states.

Racism Narratives

As the conservative-majority Supreme Court effectively gutted protections against racial gerrymandering in April 2026, high-engagement posts from pro-Trump social media personalities framed the decision as a victory against supposedly racist map-drawing by Democrats.

These narratives were also shared between platform users, as seen in this Scored post from April 30, 2026:

All that SCOTUS found on the redistricting decision is that racism doesn’t cure racism. It’s just more racism. Dems clearly need racism to win.

And this Gab post from May 10, 2026:

DEMS ARE HYSTERICAL, THEY’VE LOST SOME OF THEIR VOTER BASE, THEY’VE LOST THEIR RACIST GERRYMANDERING PLOYS, THEY’RE GOING TO LOSE MAIL-IN AND VOTER ID WILL INSURE ONLY AMERICAN CITIZENS VOTE IN OUR ELECTIONS…HOW GLORIOUS IS THAT ?

Conclusion

False narratives about the integrity of elections have driven a rise in threats against elections officials, empowered legislative efforts to restrict ballot access, and undermined public trust in democracy.12 It is likely that discourse in communities that previously promoted similar narratives could elicit similar effects in the future, particularly in relation to current redistricting efforts and other issues pertaining to the 2026 midterm elections.

In the interest of public safety, Open Measures’ platform was designed to track these narratives and reduce the risks that their spread might inflame.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.

The rise of AI has created a new frontier of cyberthreats for organizations and individuals. AI-driven attacks are no longer an emerging risk. Instead, they are increasingly common, accessible, and sophisticated, with new threats being developed in organized online forums daily.

When the most visible platforms shut these forums down, it does not disrupt their activity. Instead, those communities move to fringe platforms with looser moderation and enforcement, allowing them even more freedom to continue their discussions.

This report analyzes multiple social platforms to map where AI exploits are being discovered, refined, and sold today. It also provides concrete guidance on the most common exploits and direction on how to identify them before they affect your organization.

Read our full report in the link below:

2026 AI Threat Report

3.9MB ∙ PDF file

Download

Download

Key Takeaways:

• Evidence suggests platform bans pushed AI exploit communities into less-visible spaces often already occupied by active cybercriminals.

• The same technology behind documented business fraud attacks is being tested, refined, and shared in semi-public online spaces.

• 4chan serves as a discovery platform for new exploits, generating 300–350 related posts per day.

• Discord is growing quickly as a platform for R&D, hosting invite-only servers that share step-by-step instructions, refined prompt injection strategies, and access to dark LLMs not yet available elsewhere.

• Telegram is a commercialization layer, where hobbyist techniques are packaged as purchasable tools. New editions of purchasable exploits, such as the launch of WormGPT 4 in September 2025, correlate with on-platform activity spikes.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state-backed info ops. Click here to book a demo.

Last month, Open Measures was cited in news articles from The Boston Globe, The Washington Post, NPR, and MSNOW – and be sure to check out “The Gate 15 Interview” podcast episode featuring our CEO, Hank Teran!

Iran’s Claims of Alleged Strikes on USS Abraham Lincoln Spread through State-Aligned Telegram Accounts

Our researchers examined the roles state-backed media outlets and state-aligned news aggregator accounts on Telegram played in circulating conflicting claims about Iran’s attacks on a US aircraft carrier — stirring confusion and doubt among English-speaking audiences online. Some posts promoting Iran’s claims included AI-generated images and videos falsely purporting to show the ship taking on heavy fire.

CBS News Hired Bari Weiss to Appeal to Conservatives. It Doesn’t Seem to Be Working.

Paramount Skydance CEO David Ellison said he hired conservative opinion writer Bari Weiss to serve as the editor-in-chief of CBS News last year so she could help the network “modernize” its content and draw in new audiences. Critics raised concerns that Weiss and Ellison would seek to soften the network’s coverage of the Trump Administration. But if that was the goal, pro-Trump communities aren’t buying it.

4chan’s ‘Deepfakes’ of Celebrity Women Seem to Spike When Women Make Headlines

Adding to our research in March, Open Measures re-examined 4chan’s “Adult Requests” imageboard, one of the internet’s largest fountains of nonconsensual deepfakes, for mentions of three female celebrities frequently targeted by the board’s users. Notably, users’ requests for nonconsensual images of all three women seemed to spike during periods of increased media exposure that elevated their public profiles.

Subscribe now

TLDR

• Generative AI software’s rapid technological advancement and increased accessibility has accelerated the production and spread of digitally generated images depicting others in sexually explicit ways (often referred to as “deepfakes”). This form of online sex abuse overwhelmingly targets women, and sometimes children.

• Open Measures examined historical data for 4chan’s “Adult Requests” imageboard, one of the internet’s largest fountains of nonconsensual deepfakes, for mentions of three female celebrities frequently targeted by the board’s users.

• Our researchers found that periods where Adult Requests users requested explicit deepfakes of the three female celebrities often overlapped with periods when the women were receiving above average media exposure that boosted their public profiles.

Background

Policymakers around the world have sounded alarms over the use of generative AI software to inflict acts of online sexual abuse,1 including the creation of sexually explicit and nonconsensual “deepfakes”: digitally generated images and videos intended to look authentic.2 The vast majority of individuals victimized by nonconsensual deepfakes are female3 – including children, in some cases.4 Legal efforts to address the issue have severely lagged behind the rapid development and accessibility of generative AI software.5

Open Measures previously reported on “Adult Requests,” a growing, pornography-centered community on 4chan where users are almost singularly focused on the production and consumption of sexually explicit deepfakes. Most threads on the board include user-submitted images of people – typically women and girls – with requests for others to make AI-generated images depicting them in nude and pornographic scenes. These requests, and the images other users create to fulfill them, are viewable to anyone who visits the board.

Adult Requests users frequently victimize high-profile individuals, including celebrities, politicians, and athletes. But even more request threads seem to target women that users have encountered online or in their personal lives. Today, the board is one of the internet’s most active and dedicated hubs for this form of online sexual abuse.

Open Measures has recorded more than 624,000 posts made on 4chan’s Adult Requests board in the last year. Around a quarter of those posts contained a keyword related to requests for non-consensual sexual images.

Our Approach

We sought to determine whether Adult Requests users were more likely to victimize famous women when their public profiles had recently been elevated, whether by making news headlines or becoming the subjects of viral online discussions.

Using Open Measures’ platform, our researchers searched for posts made on Adult Requests in the last year mentioning three female celebrities they had seen users discussing in previous research: musical artist Billie Eilish, US Congresswoman Rep. Alexandria Ocasio-Cortez, and actress Sydney Sweeney. Our researchers created simple search queries for each of the women above, using our platform’s Timeline feature to chart their mentions over the last year. For further analysis, we reviewed the results we surfaced using our Discover tool.

Since a comprehensive picture of interest in one figure across the broader internet is difficult to reduce to any single data point, our researchers’ approach was to work backwards: Upon seeing a period of increased activity in an individual on Adult Requests, they then reviewed a range of news and web analytics sources for context on the individual’s relative amount of public awareness or exposure during the same period.

Analysis

For each of the celebrities included in this analysis, our researchers identified distinct periods during which their names were mentioned more frequently on Adult Requests. Upon closer review, we saw that the majority of these mentions appeared in posts requesting sexually explicit deepfakes of those individuals.

Note: Adult Requests is an imageboard forum where users converse in threads. Open Measures’ search query only identified mentions of each individual where they appeared in text posts, meaning that the totals included in our analysis likely reflect only a portion of the activity associated with each figure.

Billie Eilish

Adult Requests users shared at least 114 posts mentioning musical artist Billie Eilish last year, more than half of which were recorded between Dec. 21, 2025, and Jan. 22, 2026. During that period, the day with the highest number of posts mentioning Eilish was Dec. 27, 2025.

While our researchers were unable to identify any single event that triggered a surge in deepfake requests of Eilish, Eilish was experiencing a period of heightened publicity that aligned with observed activity spikes – after receiving nominations for Grammy awards, hosting an episode of “Saturday Night Live,” and sharing a trailer for her upcoming concert documentary film.

When reviewing posts from the surge period, researchers identified one post from Adult Requests on Jan. 5 that included a link to low-rank adaptation models (LoRAs), shareable files used to alter a generative AI model’s settings for a specific use case. In that post, the user linked to LoRA models for creating images of Eilish and actress Jennifer Lawrence specifically, indicating that they recently “got a v2” (i.e., had been updated or improved).

Rep. Alexandria Ocasio-Cortez

At least 112 posts on Adult Requests made last year mentioned Rep. Alexandria Ocasio-Cortez, often in requests for fake images that depict her in pornographic images. Using the Timeline feature, our researchers saw that the daily totals of posts mentioning Ocasio-Cortez spiked throughout December 2025 and January 2026.

While users did not explicitly mention news coverage in the posts we identified, the spiking requests for sexually explicit deepfakes of Ocasio-Cortez we identified closely correlated with a period of increased media attention on the congresswoman. Around that time, Ocasio-Cortez made news headlines for introducing New York Mayor Zohran Mamdani at his inauguration ceremony, predicting that she’d “stomp” Vice President JD Vance if she challenged him in a hypothetical 2028 presidential election matchup, and demanding prosecutions of federal immigration enforcement officers who killed Minneapolis residents.

Our researchers identified the greatest single-day spike in mentions of Ocasio-Cortez on Jan. 7, when footage of Ocasio-Cortez confronting a Fox News producer over a network host’s sexualized commentary about her was widely circulating on social media. It is unclear whether the spike in requests for explicit deepfakes of Ocasio-Cortez was directly influenced by the viral video clip.

Sydney Sweeney

Adult Requests users mentioned actress Sydney Sweeney in at least 77 posts over the last year, most of which were shared in the last few months. Our researchers saw that the board’s users began mentioning Sweeney more frequently beginning in February and peaking in April.

The greatest single-day spike our researchers identified in requests for explicit deepfakes of Sweeney occurred on April 16, 2026. Similar to Eilish and Ocasio-Cortez, Adult Requests users did not explicitly cite their motivations for requesting for deepfakes. Around the same time, however, clothing company American Eagle debuted its second advertising campaign featuring Sweeney, following on from a similar campaign last year that stirred online outrage. The actress also made headlines in recent months for red-carpet appearances at Hollywood events and for her romantic relationship with music industry executive Scooter Braun.

As in Eilish’s case, the posts mentioning Sweeney that our researchers reviewed also included discussion of LoRAs. In one post made to Adult Requests on Jan. 8, a user stated that they had LoRAs for a handful of celebrity women, including Sweeney, “ready to go if anyone wants something of them.”

Conclusion

Open Measures saw Adult Requests users requesting explicit deepfakes of the three female celebrities in our analysis more often in periods that overlapped with increased public interest in those figures. While our findings do not prove a causal relationship, they do suggest that women experiencing heightened levels of online and media visibility may also face a heightened risk of being targeted as subjects for nonconsensual deepfakes.

Open Measures’ information from 4chan’s Adult Requests board is among the most-complete archive of its kind, and our proprietary tools allow users to further investigate the activity on the board (and to minimize their exposure to graphic and potentially illegal material while doing so).

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state-backed info ops. Click here to book a demo.

TLDR

• Paramount Skydance, the parent company of CBS News, acquired the right-leaning blog The Free Press last year and hired its co-founder Bari Weiss to lead the network’s newsroom. Since then, the network has undergone structural and staffing changes that critics have alleged were meant to be favorable to the Trump Administration.

• Pro-Trump audiences on alternative platforms initially took interest in Weiss’ takeover of CBS News, but Open Measures found that those communities have showed less interest in the network as her tenure goes on.

Background

Paramount Skydance, the parent company of CBS News, announced in October 2025 that it had acquired The Free Press, a right-leaning media company co-founded by polarizing conservative opinion writer Bari Weiss. In addition to purchasing the site and absorbing it into CBS News, Paramount Skydance CEO David Ellison also hired Weiss to be CBS News’ new editor-in-chief – stirring controversy in its newsroom.1

Under the direction of Weiss and Ellison, CBS News has laid off journalists, hired additional opinion commentators, and promoted like-minded staff to larger roles. Critics of the takeover have voiced concerns that the duo seeks to bend CBS News’ coverage to be more favorable to the Trump Administration, as Ellison seeks its approval for his planned acquisition of another mass media corporation: Warner Bros. Discovery.

While the newsroom shakeup has found support from Trump and his administration’s top officials, recent reporting shows CBS News’ overall ratings have been in sharp decline since Weiss’s takeover,2 with its flagship news program on pace for its lowest-rated first quarter this century (notably outperformed by rivals ABC and NBC during the same period).3

Our Approach

As a brand monitoring case study, Open Measures’ researchers sought to contrast the popular media narratives about Bari Weiss' and recent changes at CBS News with real social activity from pro-Trump audiences to whom those changes were meant to appeal.

To do so, we searched for posts mentioning CBS News on five platforms that host predominantly Trump-aligned communities: Gab, Gettr, Rumble, Scored, and Truth Social using the following query:

(”CBS News” OR “CBS Evening News” OR “CBS Mornings” OR “60 Minutes”)

To narrow the analysis to posts that also mentioned Weiss or Ellison, our researchers added the following query:

(”Bari” OR “Weiss” OR “Weiss Effect” OR “Ellison”) AND (”CBS News” OR “CBS Evening News” OR “CBS Mornings” OR “60 Minutes”)

Our researchers used various tools available in our platform to analyze the posts their search queries identified.

MAGA Communities’ Interest in CBS News Has Faded Under Bari Weiss’ Leadership

Users across all five platforms we analyzed shared nearly 46,000 posts over the last year that mentioned CBS News or one of its flagship programs. About 70 percent of those posts were shared in the 169 days preceding Weiss’ takeover of CBS News, suggesting audiences on those platforms have generally lost interest in the network over the 197 days since she joined the network.

Of the platforms we examined in the pre-Weiss period, our query identified the highest number of posts on Truth Social. Users on the Trump-owned microblogging site shared nearly 24,000 posts mentioning CBS News and its top programs prior to Weiss’ arrival – about 73 percent of all posts identified in that period.

Using our platform’s Discover tool, researchers saw that conversation about CBS News on Truth Social was largely driven by news developments related to President Trump’s lawsuit against the network concerning a “60 Minutes” interview with former Vice President Kamala Harris, his 2024 presidential election opponent. CBS News’ parent company Paramount settled the case for $16 million – and Skydance, Ellison’s company, reportedly gave Trump an additional $20 million.

Our researchers observed similar trends on other platforms: When Trump or his allies disparaged CBS, so did their supporters.

Ellison and Weiss Become the Story of CBS News

About 30 percent of the posts Open Measures identified that mentioned CBS News or its top programs over the last year were shared after Ellison hired Weiss to the newsroom’s top perch, indicating that interest in the network on the platforms we examined had declined since Weiss became editor-in-chief.

In the period since Weiss joined the network, the greatest spike in mentions of CBS News on the five platforms occurred in November 2025, after Trump gave an interview to “60 Minutes” and praised Ellison and Weiss’ takeover. Smaller spikes were observed in December 2025, after former Congresswoman Marjorie Taylor Greene criticized Trump in a “60 Minutes” interview and after news outlets reported that Weiss had abruptly blocked the airing of a “60 Minutes” segment on a brutal prison in El Salvador, to which the Trump Administration was sending migrants.

About 13 percent of the posts we identified in the period after Weiss’ hire also mentioned Weiss or Ellison by name, suggesting that the duo has become a significant part of the story pro-Trump communities are sharing about CBS News. The ratio was highest on Gab, where more than 16 percent of posts discussing CBS News also mentioned Weiss or Ellison.

Compared to the overall mentions of CBS News, posts that also mentioned Weiss or Ellison appeared more uniformly across platforms during the analysis period following Weiss’ hire, suggesting audiences have maintained their focus on the duo throughout Weiss’ tenure at the network.

What We’re Watching

Open Measures found that users on platforms harboring large pro-Trump communities have shown decreased interest in CBS News since Ellison acquired its parent company, Paramount, and installed Weiss as the editor-in-chief of its newsroom. Ellison said he hired Weiss to “modernize content and the way it connects” at CBS News, but our findings suggest those efforts have so far been unsuccessful. Rather, our analysis suggests that hiring Weiss has damaged the network’s brand – even among pro-Trump audiences that critics suspect the takeover hoped to appease.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state-backed info ops. Click here to book a demo.

TLDR

• The United States and Israel conducted surprise airstrikes that killed dozens of Iranian government leaders on Feb. 28, initiating a war that has resulted in thousands of deaths across the Middle East. But beyond the battlefield, the war has also played out on social media, where state actors have sought to bolster support and shape public opinion.

• Throughout the war, Iran’s military has repeatedly claimed to have targeted the USS Abraham Lincoln, a US aircraft carrier, in missile and drone strikes, resulting in severe damage to the ship. US Central Command has denied Iran’s claims.

• State-backed media organizations and state-aligned aggregator channels on Telegram have boosted Iran’s claims about the USS Abraham Lincoln even after US officials denied them, stirring confusion and debate among English-speaking audiences on the platform.

Background

The United States and Israel carried out surprise military strikes against Iran on Feb. 28 that killed dozens of top Iranian government officials – including its head of state, Supreme Leader Ali Khamenei – and initiated a war that has since resulted in thousands of deaths and severely disrupted global trade.1 At the time of writing, attempts to negotiate a peace deal between the US and Iran have been strained.2

Beyond the battlefield, the war is also being fought on social media platforms, where warring countries and their allies have sought to rally support and shape public opinion. US and Israeli state officials have used social media to threaten and criticize Iranian leaders.3 Iranian state actors, alongside allied operatives in Russia and China, have reportedly intensified their longtime efforts to influence online political discourse among Western audiences.4

As we’ve previously reported on other conflicts, state and state-aligned actors have taken steps to manipulate the flow of information during escalations in the war in Iran, polluting the environment with false and misleading claims and creating obstacles for open-source researchers. As an additional complication, some false or disputed claims have been supported by inauthentic photos and videos produced with generative AI software.5 Some researchers have alleged that operatives aligned with Iran’s government were responsible for the majority of AI-generated fakes spread during the war, but Open Measures was unable to independently corroborate those claims.6

On Mar. 15, US President Donald Trump shared a post on Truth Social that described Iran’s reported use of AI-generated content on social media as amounting to a “Disinformation weapon,” arguing that news media organizations “should be brought up on Charges for TREASON” for sharing AI-generated material from Iran.7

Reported Attacks Against US Aircraft Carrier Stir Confusion

The Islamic Revolutionary Guard Corps (IRGC), Iran’s primary military force, has repeatedly targeted US warships deployed in the region with missiles and drones since the war began. Many of its attempted attacks have targeted the USS Abraham Lincoln, a US aircraft carrier supporting airstrike operations against Iran.

On several occasions, the IRGC claimed its strikes on the USS Abraham Lincoln inflicted significant damage on the ship that forced it to flee the region. US Central Command (CENTCOM) has repeatedly denied those claims and stated that the ship remains fully operational.8 But despite US rebuttals, Iranian officials have continued to declare that their operations aimed at the ship have been successful – with newer claims sometimes in direct conflict with their own prior claims.

Amidst contradictory statements from government officials, fact-checkers and researchers observed AI-generated videos circulating on social media that purported to show the USS Abraham Lincoln taking on major damage from Iran’s reported strikes.9 On Mar. 16, Trump told reporters that after seeing one such video, he asked a US military general about the ship’s status, only then learning that the video was fake.10

State-Backed Media Shared IRGC Claims, State-Aligned Aggregators Spread Them Further

Open Measures sought to better understand the role that state-backed media outlets and state-aligned actors played in promoting disputed claims about Iran’s attacks on the USS Abraham Lincoln among English-language audiences. For our analysis, researchers examined how state-affiliated actors boosted the IRGC’s claims on Telegram: a cloud-based messaging app used by billions around the globe.11

Using our platform’s Timeline feature, we analyzed the daily post volume of four English-language, Iranian-government-backed news outlets on Telegram – Mehr News Agency, Tehran Times, Press TV, and the Islamic Republic News Agency (IRNA) – and found that all four began to post more frequently after the war began.

To identify Telegram posts discussing Iran’s attacks on the USS Abraham Lincoln in our datasets, researchers used the following search query:

((("USS" OR "US") AND ("Abraham Lincoln" OR "Lincoln")) NOT ("Gerald R. Ford" OR "Gerald Ford" OR "Tripoli" OR "Bataan" OR "Carter Hall")) AND (missile* OR drone* OR attack* OR fire* OR damage* OR strike* OR struck OR sank OR sunk OR flee* OR fled OR retreat*)

The query identified 564 total Telegram posts shared across 172 unique channels between Feb. 28 and April 14. According to our data, those posts cumulatively received nearly 3.5 million views and were together re-shared more than 19,000 times.

Using our platform’s Activity feature, we saw the highest number of posts matching our query in a Telegram channel operated by Press TV, an English-language outlet operated by Iran’s government. Since the war began, 38 posts in the channel mentioned attacks on the USS Abraham Lincoln. In total, the 38 posts identified were re-shared at least 645 times and received nearly 165,000 views.

Other channels that had frequently shared posts we identified included state-backed news outlets in Russia and dozens of aggregator channels that promote news reports and messaging aligned with Iran and its allies, including Russia, Turkey and Palestine.

Case Study

Open Measures found that Iranian and Russian state-affiliated media organizations played critical roles in spreading the IRGC’s claims about attacking the USS Abraham Lincoln on Telegram. Throughout the war, the outlets shared English-language posts amplifying statements made by IRGC officials, which were then shared and cited by a host of state-aligned news aggregation channels. As the claims gained traction, they spread to groups with broader political orientations, spurring debate and confusion – a key objective of past misinformation campaigns.12

Our researchers looked closer at the posts our query identified between Mar. 12 and Mar. 16, after the IRGC claimed its attacks against the USS Abraham Lincoln had been severe enough to render the ship “inoperable” and force it to retreat to the US. CENTCOM denied the claims, calling them “recycled lies,” and stated that the ship was still in use.13

On Mar. 12, a host of state-aligned aggregator channels shared posts promoting IRGC claims that the USS Abraham Lincoln had suffered major damage and was retreating back to the United States.

During this period, we identified 108 posts from our query that together received more than a quarter-million views and 6,400 re-shares. Some results were false positives, sharing reports that US forces fired on an Iranian vessel that got too close to the ship.14 Researchers excluded those posts from the following analysis.

In the hours that followed, Iranian and Russian state-backed media organizations shared posts containing the same claims, but packaged as news reports.

As the story developed, more news aggregation accounts shared the claims, sometimes sharing or attributing directly to Iranian and Russian state-backed media organizations. As the story developed, this circular process repeated several times.

After CENTCOM denied the IRGC’s reports about the attack and Trump denounced Iran’s alleged use of AI-generated misinformation, state-backed outlets and state-aligned aggregators responded by recirculating the IRGC’s claims the ship was severely damaged in its attacks and forced to retreat from the region, reposting and citing prior reports from aggregators and state-backed outlets.

The conflicting claims spurred doubt among some online communities, who questioned what had actually happened to the ship. For example, on Mar. 12, a post in a Telegram aggregator account questioned “what truly happened.”

Conclusion

The rise of open-source intelligence research and social media analysis in recent decades has caused global conflicts to receive unprecedented scrutiny from their onlookers. Our analysis suggests that state-backed media organizations and state-aligned aggregator accounts are cognizant of this fact and may be seeking to complicate online analysis of the Iran war (in addition to other objectives, like rallying public support, or creating confusion and political unrest among the citizens of an opposing country).

As seen in the case of the USS Abraham Lincoln, state-backed actors play a critical role in stirring confusion over reported events but are rarely the sole drivers of information disorder surrounding international conflicts. Rather, they seed the ecosystem with the source material state-aligned actors need to spin up their own narratives. Advancements in generative AI technology have exacerbated the issue, making it easier than ever to create fake images and videos as “evidence” for false narratives.

Open Measures builds research tools to help researchers stay afloat in this ever-evolving social media landscape.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state-backed info ops. Click here to book a demo.

Here’s a look back at the stories we published in March.

Dark Market for Explicit AI ‘Deepfakes’ Evolves on 4chan

This piece took a deep look at 4chan’s “Adult Requests” imageboard. While the subforum was initially dedicated to discussing and sharing pornography, in recent years it has since evolved to become one of the largest distributors of nonconsensual sexual images made with generative AI tools — offer referred to as “deepfakes.” The imageboard’s users almost exclusively target female subjects in their abuse, some of which plausibly appeared to be minors.

Alternative Platforms Aren’t Fringe Anymore

Our CEO, Hank Teran, wrote this op-ed to dispel suggestions from researchers and journalists that alternative social media platforms are a dying breed. That couldn’t be further from the truth. Our team continues to see niche and specialized social platforms influence the broader internet in profound ways and produce unique harms.

Conspiracy Theories About Bill Gates See Revival Following ‘Epstein Files’ Release

Bill Gates, the billionaire co-founder of Microsoft, has been the subject of far-fetched conspiracy theories for as long as we can remember. After the US Department of Justice released millions of “Epstein Files” in January, some of which included communications Gates and his top associates had with the child sex offender in the early 2010s, those conspiracy theories saw a resurgence among far-right communities.

Election Denialists’ Obsession with Georgia Fueled by Narratives From Gateway Pundit

Ahead of 2026 midterm elections, our team has been checking in on the state of election denialist chatter surrounding key states. In this piece, they focused on Georgia. We found that conspiracy theorists’ chatter about voting in the state was heavily shaped by a small number of actors — most notably The Gateway Pundit, a pro-Trump conspiracy blog.

Polymarket Taps Palantir for On-Chain Monitoring as Fraudulent Schemes Thrive Off-Chain on Telegram

Polymarket, a so-called “prediction market” that allows users to gamble on the outcomes of virtually any future event, has scrambled to introduce new policies and initiatives meant to address concerns about insider betting and platform integrity. Most of the company’s efforts focus on activity on the platform itself, but our researchers uncovered a host of suspicious activity being organized off-platform on Telegram.

Thanks for being here! Our newsletter has been steadily growing, which is really exciting for us. Don’t hesitate to forward new editions to others or recommend us to colleagues and friends.

TLDR

• Amid regulatory pressure and public concern about alleged insider trading, Polymarket recently announced it would partner with Palantir and TWG AI, using the companies’ Vergence AI engine to monitor its sports contracts and prevent or report on suspicious activity.

• Polymarket contracts are executed in cryptocurrency (USDC) on the Polygon blockchain, which Vergence AI can monitor directly. However, the coordination of Polymarket trades occurs off-chain, in a complex ecosystem spread across alternative platforms such as Telegram, and remains unmonitored.

• Using Open Measures’ platform to monitor the off-chain coordination of Polymarket activity, our researchers discovered a network of automated Telegram bots, KYC account farming, and predatory copy-trading schemes.

What is Polymarket? An Abbreviated History

Polymarket is the world’s largest so-called “prediction market,” an industry term for online platforms that facilitate betting on the outcomes of future events surrounding virtually any topic, including sports, politics, business, and weather. As companies like Polymarket have grown in recent years to facilitate billions of dollars’ worth of wagers, so has concern over its potential for abuse, manipulation, and insider betting.1

Polymarket has historically operated with minimal oversight and few safeguards. Since its founding in 2020, Polymarket has structured its business in ways seemingly intended to evade the scrutiny and oversight of US regulators. When the Commodity Futures Trading Commission (CFTC) fined the company for operating as an unlicensed futures broker in 2022, it offshored its operations to Panama and blocked access for users with US-based IP addresses.2 Transactions on the platform are conducted using USDC – a “stablecoin” cryptocurrency traded on the Polygon blockchain – rather than US dollars, and the company collects no KYC (“know your customer”) data for users outside the US. By contrast, its largest rival, Kalshi, has taken the opposite approach: working closely with regulators, collecting KYC data for its users, and conducting business in US dollars.3

In September, the CFTC approved Polymarket to reengage in US markets. One month earlier, Polymarket appointed Donald Trump Jr., the president’s adult son, to its advisory board and accepted an eight-figure investment from a venture capital firm where Trump Jr. is a partner.4 (Trump Jr. is also an advisory board member at Polymarket’s largest direct competitor, Kalshi.)

Polymarket now operates legally in the US, but the company still faces mounting pressure from US lawmakers and many of its US-based users have remained waitlisted while the company navigates various state-level restrictions and legal challenges.5 Under increasing scrutiny, the company has scrambled to erect new policies and systems for monitoring and reporting unusual and suspicious activity on its platform.6

Common Polymarket Scams and Schemes

Open Measures examined discussion of Polymarket on active alternative platforms (Telegram, 4chan, Bluesky) and recorded in our platform’s datasets since March 2025 to identify suspicious activity being organized off-platform. Using a mix of tools available in the Open Measures’ platform, we discovered a sprawling ecosystem of questionable tools and schemes aimed at gaming alleged vulnerabilities in Polymarket’s safeguards.

Bots and Third-Party Software Vulnerabilities

Polymarket enables its users, who may not possess much knowledge about trading or investing, to identify the platform’s most successful traders and mimic their bets – a strategy known as “copy-trading.”

While Polymarket offers some native tools that help users identify successful traders to copy, including a real-time “Leaderboard” page, many of its users pay for access to third-party software that alerts them to noteworthy transactions on the platform and directs Telegram bots to execute identical trades on their behalf. Open Measures identified thousands of posts on alternative platforms advertising two such services: PolyGun and Polypok.

Polypok

On Bluesky, nearly 41% of posts we identified mentioning “polymarket” were made by a single automated account: the Polypok bot. A whale-tracking service, the bot exclusively created two kinds of posts hundreds of times each: “SMART MONEY ALERT” posts, categorizing specific accounts or wallets as “elite traders” and “S-tier whales (top 1% win rate)”, and “Polymarket Anomaly” posts, flagging statistically unusual trades, accompanied by z-scores and order flow percentages. (For example, a $25,000 bet on the Iranian regime falling by June 30 was given a z-score of 19.6σ, meaning a trade that was allegedly 19.6 standard deviations away from the mean size in that market).

While the use of labels appeared intended to add authority to the alerts, the method (if one exists) for generating each label was not disclosed. Similarly, the outrageously extreme probability scores associated with certain events make it a near certainty that the mathematics in the “anomalies” are fabricated.

PolyGun

PolyGun is a prominent Telegram trading bot and discussion community with nearly 206,000 users at the time of writing. Users who join an associated Telegram channel are connected to a private chat with the bot, which instructs them how to create a cryptocurrency wallet, open a Polymarket account, and arrange for the bot to execute automated copy-trading strategies on users’ behalf. US users can then avoid the KYC required for email-based accounts by connecting their wallet to the site and checking a box.

While PolyGun’s services are not illegal and many of its users seem to be ordinary retail traders, using the bot entails risks that are not readily apparent while onboarding.

Since various automated trading strategies are multiplied by the hundreds of thousands of users deploying them, a high-volume of trades concentrated on a specific event can have significant impacts on a given market (in some cases, moving or consciously manipulating its price). Additionally, trade latency creates structural disadvantages for retail traders, as one user openly discussed in PolyGun’s “Prediction Desk” channel on Jan. 29, 2026:

the bot copied the trade only after 30sec-1minute from the polymarket api, so when you try to copy the market already moved . . . if you accept slippage above 0.03 cents each direction it’s already in a loss.

Similarly, bot operators’ can see user trades as they come in but before they resolve, making it possible for them to use that information to take advantaged positions against users (known as “front-running”).

Despite PolyGun’s “non-custodial” architecture – meaning users “own” their own wallets and can export their private keys – it still stores users’ private keys in its servers, meaning its users’ safety is dependent on the integrity of the app’s architecture (which users can’t easily assess). If a trading bot’s architecture has vulnerabilities, it can fall victim to server-side attacks wherein users’ wallets are drained (as users of Polycule, another trading bot, experienced firsthand in January 2026, when hackers drained the bot’s treasury of $240,000).7

KYC and Account Farming

“Account farming” is the mass creation or purchase of verified accounts using illegitimate identity documents, effectively producing anonymous access points users can buy to avoid platforms’ KYC restrictions. Selling fraudulent accounts is a federal crime under 18 U.S.C. § 1028, with precedent;8 using such accounts to trade on a CFTC-regulated platform also implicates anti-fraud provisions under Rule 180.1, as well as violating terms of service. Since Polymarket’s ability to operate legally in the US depends on KYC, this secondary market allows users to undermine the framework.

Of the 10 Telegram accounts included in our datasets that mentioned Polymarket most often since November 2025, we found that eight had shared thousands of near-identical posts advertising KYC and account farming services related to Polymarket. Seven of the eight accounts shared posts written in Russian; the other used an English-language template.

One template (left, above), translated from Russian read:

VERIFIED ACCOUNTS FOR YOUR BUSINESS 🏦 Banks / cards / payment systems 💱 Crypto exchanges / P2P / exchangers 🎰 Bookmakers / casinos 🔒 SOF / AML / KYC / DeepFake / proxies 🧼 Crypto cleaning / withdrawal / unblocking 🌍 Any geography. Using your data or ours.

“SOF” (“source of funds”) refers to the sale of forged documents, “AML” refers to services that help users pass “anti-money laundering” screenings, “KYC” refers to the sale of verified accounts on financial platforms, and “DeepFake” refers to related, custom AI-generated images. The post also listed financial institutions these services were available for, including Polymarket.

The eight accounts shared thousands of similar posts, often in so-called “over the counter” Telegram channels: bootleg peer-to-peer marketplaces ostensibly meant to facilitate large cryptocurrency trades without platform brokerage fees that often feature advertisements for questionable and illegal services.9

Though the template each account used for its posts was unique, all eight shared their posts to the same channels, plausibly indicating their activities were coordinated.

Scams Based on Fake ‘Insider’ Information

Telegram hosts many public, semi-public, and private Polymarket trading groups where users discuss trade ideas and share information. Some of these groups, such as “Insiders Polymarket,” markets itself as a group of Fortune 500 insiders with access to private information and “leaks” that could be used to make profitable trades on Polymarket.

As one example of this scheme, the group’s moderators ran a series of promotional messages teasing a “leaked email”, eventually revealed to be related to Minnesota Rep. Ilhan Omar’s alleged plans to resign. As the document is fake (and Omar did not retire), it appears to be a scheme to manipulate users into inflating the price of a small political event contract by betting “Yes” in one direction (so that the group operators can bet “No” against them, making greater profits).

Private Trading Groups

On 4chan, users primarily discussed and commented on ideas for trades and exploits with one another in /pol/ and /biz/. One anonymous /pol/ user alluded to recruiting other disciplined traders, rather than gamblers, into a private Telegram trading group (“TG”) to manipulate less sophisticated traders (“frontrun normiedom”) in a post made on Jan. 13, 2026:

so are you guys betting on polymarket too?

anyone wanna form a TG for this? we can alert eachother if news is there and frontrun normiedom

i’m holding a bunch of money on polymarket in cash just so I can buy in the moment some conclusive news appears regarding iran strikes

pls no gambletards tho

Others, were more critical of Polymarket’s existence at all, including an anonymous /pol/ user who posted on Feb. 4, 2026:

Suffice to say, Polymarket is a rigged, corrupt, broken system that is not legitimate and should be investigated and banned . . . literal blatant corruption in a betting market and there’s no recourse. People’s money stolen because the more powerful users can control the outcomes of these bets

Conclusion

Palantir’s partnership with Polymarket appears to be a step toward on-chain transparency, but off-chain coordination remains a structural problem. While various Telegram communities promise retail traders easy and automated profits, many of these services are designed in ways that allow operators to hold users’ private keys and front-run their positions.

As Open Measures indexes millions of posts from alternative platforms including Telegram, we will continue to monitor off-chain activity surrounding prediction markets – and we encourage other financial and cybercrime researchers to do the same.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.

TLDR

• Partisan “election integrity” activists have sustained their focus on Georgia since President Donald Trump narrowly lost the state in the 2020 presidential election, working to undermine public faith in voting processes, state officials, and legal systems.

• As the United States prepares for its 2026 midterm elections, Open Measures examined Georgia-centric election denialist discourse on four platforms that have historically harbored proponents of similar narratives.

• Our researchers found that a small number of hyper-partisan news blogs and activist groups played a significant role in shaping the discussion of Georgia-centric election denialism.

• Many of the most-active accounts sowing doubts about the legitimacy of Georgia elections were also found to have promoted extreme conspiracy theories like QAnon.

Background

After President Donald Trump narrowly lost Georgia to former President Joe Biden in the 2020 presidential election, Trump and his political allies falsely claimed that reported vote totals were illegitimate due to widespread fraud and pressured Georgia officials to overturn the results.1 Though every audit, recount, lawsuit, and law enforcement investigation into those accusations has thoroughly dispelled them, the Trump Administration and its activist supporters have remained fixated on far-fetched conspiracy theories alleging corruption in Georgia’s elections.2

Since the 2020 election, self-described “election integrity” activists in Georgia have sought to undermine public confidence in the state’s elections by challenging voter registrations and lobbying for changes to election laws they believe would advantage Republican candidates, reflecting national efforts to do the same.3 Aligned with these efforts, some have sought to advance their cause by working for the second Trump Administration, which seized thousands of ballots from election offices in Fulton County in January 2026, pursuant to claims a local denialist group published only weeks earlier.4

False accusations about election integrity have also created unprecedented risks to election workers across the US,5 with Georgian poll workers, public officials, and their respective offices receiving violent threats.6 Others have been targeted by partisan media figures in defamatory smear campaigns, resulting in online threats and harassment.7

Ahead of 2026 midterm elections, Open Measures examined the state of Georgia-centric election denialism on four platforms where election denialist movements have historically disseminated propaganda and organized in the last year: Gab, Gettr, Telegram, and Truth Social.

Methodology

To begin, our researchers submitted crawl requests to our platform for posts mentioning Georgia’s top election officials, “election integrity” activist organizations, and government entities. Next, we created a search string to identify election denialist posts made since President Donald Trump began his second term on Jan. 20, 2025, using the following query:

(”GA” OR “Georgia” OR “Kemp” OR “Raffensperger”) AND (”voting” OR vote* OR electi* OR poll* OR ballot* OR referendum* OR “polling station” OR registrat* OR “turnout” OR cast* OR absentee* OR “voter roll” OR “voter rolls” OR database* OR “voting machine” OR “voting machines” OR record* OR mail* OR tabulator* OR “smartmatic” OR “dominion voting” OR “qvf” OR “qvfs”) AND (fraud* OR scandal* OR corrupt* OR fake* OR hack* OR noncitizen* OR illegal* OR criminal* OR crime* OR fault* OR error* OR invalid* OR problem* OR conspirac* OR cabal* OR collu* OR cheat*) NOT (“smm panel” OR “promotion boost”)

Analysis

Our search query identified more than 19,000 posts made across the four platforms we examined. With our platform’s recently updated Timeline tool, we visualized how many of those posts were made each day during our analysis period.

Among these posts, discussion about voting in Georgia remained fairly constant throughout Trump’s second term but surged at several points in our analysis period. Upon closer examination, we found the largest spikes appeared to be driven by inflammatory articles on hyper-partisan news blogs and statements from public officials.

Our researchers saw increased activity following news developments related to Georgia politician and voting rights activist Stacey Abrams, the dismissal of criminal charges against Trump related to his efforts to overturn the 2020 presidential election, and instances where public officials claimed state electoral processes had suffered from administrative errors.

The largest uptick in daily posts our researchers observed, both in size and duration, corresponded to the Trump Administration’s raid of Fulton County’s electoral offices on Jan. 28, 2026. about 18% of all posts included in our analysis were shared since the raid occurred.

Partisan Blogs and Activist Groups Shape Election Denialism about Georgia

For each platform, we used our platform’s Activity feature to identify users whose posts matched our query most frequently during our analysis period, as well as which URLs were included most frequently in those posts. Similar to our previous reporting about election denialism in Michigan, we found that similar discourse about Georgia had been heavily shaped by a handful of hyper-partisan news blogs and right-wing activist groups.

On Truth Social, where we identified the greatest number of posts, at least 746 included links directing to The Gateway Pundit, a pro-Trump news blog notorious for promoting conspiracy theories about elections (nearly 9% of all Truth Social posts we identified).8 We observed similar trends on other platforms we analyzed, with more than 10% of all posts we identified containing a link to the Gateway Pundit.

On Gab, from which we identified our second-greatest number of posts, only Rumble – an alternative video platform popular with conspiracy theorist content creators – was more frequently linked-to than the Gateway Pundit. Rumble links appeared in at least 1,662 Gab posts, representing more than 28% of all posts from the platform that we identified.

Super-Spreaders of Georgia’s Election Denialism

To determine which accounts most frequently spread doubts about the integrity of Georgia’s elections, our researchers applied a search filter removing results with fewer than 10 re-shares. On each platform, they observed that the accounts posting the most election denialist content related to Georgia were also frequent proponents of other conspiracy theories, like QAnon.

On most platforms, the accounts that posted most frequently appeared to be random users. On Truth Social, however, similar accounts we identified included niche conspiracy theorist influencers, like QAnon promoter Cornelia DiNunzio, and pro-Trump media outlets Real America’s Voice and LindellTV.

To identify the loudest promoters of election denialism related to Georgia, our researchers adjusted the filter again to only show posts with 500 or more re-shares. We used our platform’s Discover feature to manually review the resulting 61 posts.

The most-reshared post identified by our search query was shared by a far-right Telegram channel on June 10, 2025. That post, re-shared nearly 8,600 times, listed world events supposedly “proving” various QAnon conspiracy theories true, including a claim that the 2020 election was “fake.” While the post included claims related to Georgia, it did not make specific claims about the state’s elections.

The second-most re-shared post came from President Trump’s Truth Social account on Nov. 26, 2025, made after a Georgia prosecutor filed to drop criminal charges filed against Trump two years earlier in relation to his efforts to overturn the results of the state’s 2020 presidential election.9 In that post, which was re-shared more than 7,400 times, Trump claimed the state’s charges against him were retaliation for “telling the TRUTH” that the 2020 election had been “RIGGED AND STOLEN.”

The most re-shared Truth Social post we identified from an account other than Trump’s was made by pro-Trump social media personality Rogan O’Handley (aka “DC_Draino”) on Feb. 19, 2026. O’Handley’s post, which was shared nearly 1,600 times, asserted a “direct correlation” between the Trump Administration’s raid on Fulton County elections offices and top Democratic Party figures’ campaign messaging ahead of 2026 midterm elections.

Conclusion

Open Measures found that a relatively small number of actors had outsized influence shaping election denialist discourse related to Georgia’s elections on platforms where election denialist movements had historically been most active.

Misinformation and conspiracy theories about elections continue to drive threats against officials, animate efforts to restrict ballot access, and undermine public confidence in democracy. Increased awareness about the networks of influence driving election misinformation may help inform efforts to protect voting. As such, we will continue to monitor and report on these trends as they develop and encourage other researchers to do the same using Open Measures’ platform.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.

TLDR

• Conspiracy theorists have spent years fixated on Bill Gates, the billionaire co-founder of Microsoft. The most popular theories have centered on Gates’ philanthropic giving and, more recently, his relationship to Jeffrey Epstein.

• Open Measures saw discussion of Gates surge on platforms harboring far-right conspiracist communities in late January after the Department of Justice published millions of previously unseen documents pertaining to Epstein, including emails Epstein exchanged with Gates and his top confidantes.

• Researchers saw users in conspiracy theorist communities capitalize on renewed interest in Gates’ relationship with Epstein, weaving the new material into their existing theories and citing them as proof of long-debunked claims.

Background

Conspiracy theorist media personalities, far-right online communities, and hostile state actors have spread theories about Bill Gates, the billionaire co-founder of Microsoft, for years.1 Many of the most-circulated theories have taken aim at Gates’ philanthropic support for global health programs, claiming his advocacy is guided by sinister ulterior agendas like reducing the global population and amassing power for a cabal of authoritarian liberal elites seeking world domination.2

As Gates’ charitable foundation disbursed billions of dollars to entities that led the worldwide response to the COVID-19 pandemic, conspiracy theories about the motives driving his philanthropy saw widespread circulation on social media.3 At the same time, Gates faced increased scrutiny over his ties to child sex offender Jeffrey Epstein, whose reported suicide in 2019 inspired countless viral conspiracy theories about the global elites with whom he’d been known to associate.4

Members of Congress and the Department of Justice (DOJ) have published several batches of previously private or classified documents related to Epstein in recent months, colloquially dubbed the “Epstein Files.” Among the millions of documents included in those releases were photos and email records revealing new details about Gates’ long-reported ties to Epstein.5

Documents published by the DOJ on Jan. 30 included records of emails Epstein exchanged with Gates and several of his top confidantes, who he hoped to convince to create a donor-advised fund for his charitable foundation. As Gates’ initial interest in the idea faded and his communication with Epstein stopped, emails suggest that Epstein attempted to insert himself into Gates’ marital issues. As Epstein’s pitches to Gates began to fizzle, Epstein drafted two emails in which he claimed he facilitated sexual encounters for Gates and helped him hide a sexually transmitted disease from his then-wife, Melinda Gates.6 (Gates has strongly denied those claims, and none of Epstein’s known victims have accused Gates of wrongdoing.7)

Social media influencers and online communities who previously promoted conspiracy theories and false claims about Gates capitalized on new details revealed in the Epstein Files, attempting to link old conspiracy theories about Gates’ support for COVID-19 pandemic response to newer narratives about Epstein.8

Methodology

Our researchers sought to better understand how new revelations about Gates’ and Epstein’s relationship impacted the spread of existing conspiracy theories about Gates. They began their analysis by searching our platform for posts that mentioned Gates by name since Dec. 12, 2025 – when lawmakers shared previously unseen materials from Epstein’s estate9 – across 11 distinct platforms where conspiracist right-wing communities have historically gathered. They identified more than 26,000 posts that mentioned Gates in the analysis period, including:

• More than 10,500 posts on the microblogging platforms Gab, Gettr, MeWe, Minds, and Truth Social

• More than 10,400 post on the video-based platforms Bitchute, LBRY, and Rumble

• More than 5,300 posts on the forum boards 4chan, 8kun, and Scored

From there, our researchers created search strings to narrow the results for further analysis. To identify posts that mentioned both Gates and Epstein, they used the following search string:

“Bill Gates” AND Epstein*

To identify posts that mentioned both Gates and at least one keyword related to previously documented conspiracy theories about his philanthropy (including those related to COVID-19), they used this search string:

“Bill Gates” AND (“nwo” OR “new world order” OR “covid” OR “covid-19” OR “coronavirus” OR “pandemic” OR “plandemic” OR “scamdemic” OR “vaccine” OR “vaccines” OR “vaccination” OR “vax” OR “vaxx” OR “vaxxed” OR “the jab” OR “the jabs” OR “china virus” OR “wuhan flu” OR “lab leak” OR “microchip” OR “nanochip” OR “5g” OR “depopulation” OR “population control” OR “global population” OR “great reset” OR “agenda 2030” OR “agenda 21” OR “illuminati” OR “globalist” OR “globalists” OR “globalism” OR “bioweapon” OR “mrna” OR “spike protein”)

Analysis

Open Measures researchers used the recently enhanced Timeline tool to visualize their search results – quantifying the posts made each day that matched their search strings, clustering them by platform type, and graphing them over our analysis period. Viewed this way, we saw major spikes across the platforms we analyzed in late January and early February, coinciding with the DOJ’s “Epstein Files” release on Jan. 30.

When researchers narrowed their search query to only return posts where Gates and Epstein were mentioned together, they saw more than half of the posts that mentioned Gates since Jan. 30 also mentioned Epstein. The number of daily posts mentioning both Gates and Epstein were curiously minimal prior to that surge – even after lawmakers published photos of Gates obtained from Epstein’s estate in December 2025. Prior to the document dump, less than 12% of posts that named Gates also mentioned Epstein.

Comparatively, we found that more than 40% of the posts that mentioned Gates prior to Jan. 30 also included at least one of the terms included in our search string related to conspiracy theories surrounding his philanthropy. The daily volume of those posts also spiked after the January “Epstein Files” release, but generally appeared at more consistent rates throughout the analysis period.

Researchers combined the two prior search strings to chart posts that mentioned Gates and Epstein together and also included a keyword related to conspiracy theories about Gates. Some of the spikes we observed appeared to be driven by posts attempting to link the two subjects together. The highest saturation of these posts were seen on video-based and microblogging platforms, where more than 18% and 16% of posts made since Jan. 30 mentioned Epstein in relation to longstanding conspiracy theories about Gates.

A review of those posts found that most of the users who shared them promoted debunked claims that materials in the Epstein Files proved Epstein had prior knowledge of the pandemic.

Conclusion

Our findings illustrate how conspiracy theorist communities fold new information and developing events into their existing narratives about their targets. Gates’ relationship to Epstein had no provable impact on Gates’ philanthropic work or his support for global disease response efforts, yet communities that have promoted conspiracy theories about the latter eagerly used newly revealed information from the Epstein Files to rehash and expand on prior claims.

This research underscores the importance of long-term monitoring for individuals who have been targeted by harmful activity online. Open Measures builds tools that help researchers track and analyze activity across dozens of alternative platforms, which often play outsized roles in the proliferation of digital safety risks.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.

Where We Are Now

Two days after supporters of President Donald Trump stormed the US Capitol Building in 2021, the social media platform Twitter (now called X) announced its team’s decision to indefinitely suspend Trump’s account “due to the risk of further incitement of violence.” Other major tech companies followed with similar actions following the violent insurrection.

These decisions were unprecedented in the US, even if consistent with respective site policies, eliciting outrage among Trump’s supporters and stirring unease among others concerned about big tech companies’ abilities to shape global affairs. But even before mainstream platforms banned Trump, their efforts to limit and remove harmful material on their sites had become the basis of dubious narratives among right-wing communities, who alleged that social platforms were systemically censoring conservative political beliefs.

As buy-in for these claims increased, a niche industry of alternative platforms marketing themselves to aggrieved communities as “free speech” havens began to proliferate. I refer to emerging social media platforms as “alternative platforms” (rather than “alt-tech” or “alt-platforms”) intentionally, here and throughout, to avoid misleading political connotations. “Alt-tech” is a more recent phenomenon, but alternative platforms have existed since the very beginning of social media and have hosted many different online communities.

Ideological Investment in a ‘Parallel Economy’

High-profile users and communities who saw their accounts banned or limited under evolving moderation policies at major platforms sought refuge in these alternatives, bringing their audiences with them. Right-wing investors and political leaders supported many alternative platforms throughout the late 2010s and early 2020s; some even theorized they could form the foundation of a new “parallel economy.” And Trump’s bans from major platforms drove ideological investment in alternative platforms to its peak.

In 2022, Trump debuted Truth Social: his own alternative platform that he claimed was meant to “stand up to Big Tech.” Later that year, billionaire and Trump ally Elon Musk bought Twitter, renamed it X, dismantled trust and safety programs, and ordered site-wide policy changes – all in the name of saving “free speech.” Musk also reinstated accounts that were previously banned on the site, including Trump’s, and tweaked its algorithms to amplify posts expressing far-right views.

In the years that followed, other major platforms would reshape their own approaches – a shift that accelerated after Trump won the 2024 presidential election. Many have since deprioritized their prior efforts to address online harms and adjusted their political postures to please government officials. TikTok recently sold a majority stake of its US operations under pressure from the US government to an investor group that included right-wing billionaires like Larry Ellison, and has since been accused of censoring content that may displease the Trump Administration.

The clawback of content moderation efforts on mainstream social media sites has effectively undercut the “free speech” sales pitch that many alternative platforms used to grow their user bases, forcing their role in the wider online ecosystem to change.

Open Measures’ team has seen many analysts and reporters interpret those shifts as signs that alternative platforms are dwindling, or even becoming irrelevant – but that couldn’t be further from the truth.

Alternative Platforms Aren’t Going Away

Suggestions that alternative platforms are losing their influence are unfounded – platforms like Bluesky and Fediverse have seen huge growth, while others like 4chan have proven their unique staying power on an always-changing internet.

Open Measures recorded more than 2.4 billion posts for the 2025 calendar year across the 35+ unique platforms we cover. Our datasets included:

• More than 1.7 billion posts on microblogging platforms like Bluesky, Fediverse sites, Gab, Gettr, and Truth Social, among others

• More than 459 million posts on channel messaging apps like Telegram and WhatsApp

• More than 222 million posts on forum boards like 4chan, 8kun, and Scored

• More than 82 million posts on video platforms like BitChute, LBRY, Rumble, and RuTube

Those figures carry additional weight when we consider the unique roles many alternative platforms have played in online harms and offline organizing. The posts on these platforms aren’t merely data points; they are a window into the ways digital chatter translates into material risk.

Impacts on Broader Online Trends

For all that has changed in recent years, Open Measures’ researchers have repeatedly seen alternative platforms continue to shape online discourse and drive harmful activities (often regardless of their relative size). Studying these platforms can often surface information that is virtually impossible to find elsewhere.

Many criminal networks and extremist groups use alternative platforms to organize members, plan attacks, and even evade international sanctions. Perpetrators of mass shootings and other violent attacks turn to anonymous forum boards for inspiration and encouragement. Threats against organizations and individuals spawn within fringe communities that fixate on them.

High-profile influencers on mainstream platforms crib content from niche sources to shape their own narratives. Global conflicts play out on messenger apps in areas where other platforms are inaccessible or unpopular. And today’s political leaders invest resources into alternative platforms as part of their public messaging strategies.

As social networking tools, alternative platforms often function as organizing hubs and “training grounds” – where users can coordinate as networks, develop group identities, and hone strategies for escalating harmful campaigns. In some environments, AI tools have accelerated these dynamics, in turn scaling their online harms.

Research has repeatedly shown that content from alternative platforms migrates onto larger ones, amplifying its reach and normalizing extremist ideas along the way. The January 6 Capitol attack, for instance, was organized across a constellation of alternative platforms before spilling into the physical world. That pattern has since been repeated in violent mobilizations around the world.

What Has Changed

The reordering of priorities at mainstream platforms has changed the roles that many alternative platforms play in the wider online ecosystem. While we’ve seen waves of users rejoin mainstream sites under loosened content moderation policies, we’ve also seen others refuse to do – alongside other, more recent and novel developments.

The political changes among mainstream platform leadership have instigated a new left-leaning diaspora, whose users have sought out online spaces aligned with values related to security, politics, and functionality. Bluesky’s open AT Protocol and the ActivityPub protocol used by federated networks allow users to carry their identity and social graph across platforms, reducing the centralized control that any single company can hold over public discourse.

Similarly, TikTok users’ concerned about the platform’s new ownership caused an influx of activity on UpScrolled, a platform advertising transparent content moderation and an algorithm that they claim isn’t engineered to keep users hooked.

These alternative platforms tell an arguably different story – where a move away from the mainstream is driven by a desire for more transparency, accountability, and user control. That said, this set of alternative platforms are not without their own range of online threats (crypto scams, astroturfing, proliferation of abuse material, among others) and are well-worth researchers’ time and attention.

Where We Go From Here

To keep up with the evolving social media ecosystem, we are constantly updating our platform with features and datasets to provide others with a more complete understanding of online activity – and to move beyond the false premise of a clean distinction between “mainstream” and “alternative” online spaces.

We’ve designed our platform with the intention of offering researchers a wider field of vision – both to clarify cross-pollination between platforms and to make mainstream investigations more robust. With our alternative platform datasets, researchers can surface influential posts from elsewhere that are less natively-searchable, while avoiding other financial and architectural restrictions.

Open Measures remains committed to tracking all these shifts in real time by paying attention to platforms that others can’t. As the complexity of online ecosystems increases, so does our conviction in the vision of a more transparent and understandable internet.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.