Subscribe now

Users in Telegram channels openly associated with networks of West African cybercriminals known as “Yahoo Boys” have discussed using artificial intelligence tools, including generative AI models and face-swapping and voice-cloning software, to make their scams more convincing and effective.

The term “Yahoo Boys” refers to networks of West African cybercriminals, often younger men in countries like Nigeria, best known for targeting web users in Western nations using social engineering tactics like romance scams, wherein scammers develop fake relationships with their victims that they later exploit to extract their victims’ money and sensitive personal information; many schemes also involve impersonation, as seen in the network’s now-infamous “Nigerian Prince” email scams.

As Open Measures previously observed on 4chan, the posts we identified showed that users in chat groups associated with Yahoo Boys networks have applied AI tools in increasingly sophisticated ways. Today, some Telegram group leaders even offer educational “VIP classes” and “AI tools packages” to subscribers looking to enhance their abilities to scam others.

Tech and cybersecurity reports on the Yahoo Boys have often been sardonic, portraying the network as a “low-level” threat whose limited successes can be attributed to a strategy of targeting naive victims. However, recent reports have detailed the Yahoo Boy network’s expansion into more sinister sextortion scams and overlap with Black Axe, a violent Nigerian criminal syndicate recently pursued by state authorities, INTERPOL, and the FBI, suggesting the network may pose a more serious threat today than it had in the past.

their threat level may have adjusted. Through social media sites, dating apps, and fintech services, the network’s reach has expanded and now takes on more ambitious targets; these and other threats may soon be amplified by the Yahoo Boys’ increasing fluency in AI tools.

Our Approach

To separate explicitly Yahoo Boys-affiliated Telegram channels from other likely cybercriminal marketplaces we monitor on the platform, we limited our analysis to posts shared in Telegram channels and groups in our datasets that included the term “yahoo” in their names. Using the analysis tools in our platform, we identified and analyzed all posts that appeared in those channels since the start of the 2026 calendar year and identified a handful of channels where a majority of the relevant posts we found had appeared.

The analysis that follows is based on our review of posts in the channels we identified, but does not represent all Yahoo Boys-affiliated activity on Telegram. Rather, our findings present a partial view at the ways cybercriminals and scammers have looked to AI tools to enhance the effectiveness and scale of their illicit operations.

How Yahoo Boys Are Using AI Tools

The sorts of romance and impersonation scams that Yahoo Boys became notorious for were relatively unsophisticated and required their perpetrators to invest significant amounts of time developing relationships with their targets that can later be exploited. Their success depended on a scammer’s ability to appear genuine and respond to tests of their authenticity, like sending requested photos or answering calls from their victims.

Disarming their victims’ skepticism can sometimes prove difficult for Yahoo Boys scammers, like when a target requests that they participate in a live video call to prove their identity or asks for specific forms of confirmation, like documents. The posts we reviewed from the Yahoo Boys-affiliated Telegram channels in our datasets showed that scammers in those networks have looked to AI tools to pass those checks, potentially enabling them to carry out more convincing scams at greater scales than before.

Throughout 2026, we saw administrators of Yahoo Boys channels recommend increasingly sophisticated AI tools and techniques for using them. Some of the earliest posts we identified from the year recommended free and simple-to-use generative AI programs capable of producing synthetic images, videos, and audio files that could make a scammer’s profile appear more legitimate. But as the year went on, some of those same channels began recommending more advanced AI tools, including programs capable of rendering synthetic material in live video calls.

Open Measures identified posts recommending specific AI tools by name and shared instructions for using them in furtherance of impersonation and romance scams. We’ve listed some of the tools that appeared by name most often in posts in the channels we analyzed and explained how users in Yahoo Boys-affiliated channels proposed using them.

Yahoo Boys’ Synthetic Voice-Cloning and Face-Swapping Strategies Grew More Advanced Through 2026

In the posts we reviewed, users in Yahoo Boys-affiliated Telegram channels most often recommended AI programs that allow users to generate synthetic media. The first mentions of such tools we identified directed channel subscribers toward free and relatively simplistic apps. Later posts pointed users toward more complex programs, including those capable of producing “live” videos.

In order of their appearance in the channels we reviewed, the tools recommended in posts included:

Any Voice Lab, an AI tool allowing users to submit an audio snippet and convert it into one of thousands of available voice templates and accents. The app’s free version includes a character limit and allows a limited number of samples to be made before a user must pay to subscribe, a feature which, admins suggested, might make the tool suboptimal for certain scams (Apr. 27, “Dating Formats and Yahoo Updates”).

FakeYou, a browser-based app for converting short audio and video clips into lip-synced deepfake videos, cited as a “sharp site to clone your celeb voice.” The app’s free tier allows users to produce audio and video more generously than Any Voice Lab, making it a more scalable tool enabling some simple, low-quality use cases for celebrity impersonation scammers (with comparatively few celebrity voice and video templates available (May 10, “Dating Formats and Yahoo Updates”).

Revoice, a similarly simple, audio-only “clone voice” app, mentioned in a post that included a screen recorded walkthrough briefly explaining the tool (May 15, “Dating Formats and Yahoo Updates”).

DreamFace, an app allowing users to convert videos of themselves into simple, lip-synced deepfake videos complete with audio, described by admins suggested for making short videos scammers could send to their victims as identity proof in lieu of answering them on a live call. As the app’s capabilities are somewhat more advanced than earlier tools, the post we identified included a detailed tutorial (Aug 21, “Yahoo Format”):

upload a clear photo with the person’s face looking directly at the camera . . . Choose how the photo will speak . . . Tap generate or create . . . the AI animates the face and syncs the lips to the audio . . . preview the result. If you’re happy with it, save or export the video. Free accounts often add a watermark or limit the number of videos you can create

Later in 2026, our researchers began to observe posts recommending commercial and enterprise-grade AI tools more frequently, for many of the same use cases mentioned above:

ChatGPT was recommended alongside explicitly detailed text prompts for generating “ultra-realistic” photos of Canadian and Nigerian identification cards held in a person’s hand (likely to submit to online identity verification tests). The example prompts included in posts we identified were schematically formatted and labelled, possibly allowing users to edit their fields and generate other false documents (May 1, “Dating Formats and Yahoo Updates”). A separate post recommended the app for compositing images of scammers’ fake profiles into images featuring Elon Musk, a technique designed to bridge romance scam victims into investment scams described at length in the image below (May 25, “Yahoo Format”).

Snapchat AI, the social media platform’s built-in generative AI writing assistant, which admins recommended for generating “sharp descriptions” for fake profiles – useful as a platform-native way to populate fake profiles with fluent, colloquial English text (June 19, “Yahoo Format”).

Higgsfield, a commercial AI image and video generation app, was suggested as a “site to do face swap” capable of supplementing authentic stolen images and videos by generating additional, inauthentic ones more passably than simpler tools (June 19, “Dating Formats and Yahoo Updates”).

ElevenLabs, a hybrid platform for generating text-to-speech AI voice audio and related video, was suggested for the creation of “realistic male or female” voices with detailed instructions for fine-tuning outputs (Aug 20, “Yahoo Format”):

if you want it to sound more expressive, adjust the voice settings (such as emotion or pacing if available)

InnoCaption, a free app providing call-captioning services for the deaf and hard-of-hearing, was promoted by admins as a tool for smooth, type-to-text “voice cloning” on live calls (the app also has an AI assist feature, capable of expanding a sentence fragment into a full sentence and converting it into voice almost instantaneously). InnoCaption’s official website lists use cases for audiologists, veterans, and those with disabilities, promising it can help users “make calls with confidence.” It is also FCC-certified, requiring US-based phone numbers and proof of US residency from customers in order to use the platform; for a non-US citizen, accessing the app requires providing fraudulent documentation, which AI tools have made much easier to generate (June 21, “Dating Formats and Yahoo Updates”).

Magicam.ai, an AI virtual camera self-described as “the ultimate real-time face swap solution,” was similarly described in a post by Yahoo Boys admins as a “live video call changer, voice clone all in one,” though posts promoting it noted that it required “powerful hardware support” – ideally, a NVIDIA graphics card – to run properly (Aug. 24, “Dating Formats and Yahoo Updates”).

Pyzra AI Camera, a similar AI virtual camera app, was recommended to help users “face swap on WhatsApp video call” in a post that included a two-minute instructional video voiced by an AI narrator, complete with “step by step” instructions, from installation through Google’s App store to uploading reference images, configuring audio and video, and adjusting aspect ratios to render images correctly (Sep. 10, “Dating Formats and Yahoo Updates”).

Admins in Yahoo Boys Channels Selling ‘VIP Classes’ and ‘AI Tools Packages’

Many of the Yahoo Boys-affiliated channels we identified appeared to operate as storefronts, sharing posts that listed menus of tools and services that users might purchase to enhance their fraudulent and scam activities. In these channels, we saw that admins have sought to capitalize on other Yahoo Boys-affiliated users’ interest in AI tools by offering educational material and specialized programs tailored toward scammers.

For example, a Feb. 21 post in the “Dating Formats and Yahoo Updates” Telegram channel advertised a “CELEB VIP CLASS” that claimed to include an exclusive “AI Tools Package” and guidance on advanced techniques that subscribers could use to make their own impersonation scams more convincing.

We observed the first of these posts on June 7, though the operator shared an additional 20 posts – 11 of which were nearly identical – periodically from June through October. Many of these posts included a Telegram username at the bottom, asking those interested to sign up and coordinate payment via DM. Variants of this post template that we observed offered the class at a fluctuating price point that appeared to be enumerated in local currencies accepted by the operator (“50k 480gh” and “30K (Regular price: 50K),” with “k” and “gh” likely indicating Nigerian naira and Ghanaian cedis).

Through native Telegram search, our researchers confirmed both “Yahoo Format” and “Dating Formats and Yahoo Updates” were still active as of this writing.

Our Take

In September 2024, Telegram announced it would take a stronger stance against cybercrime on its platform, a position the company demonstrated by removing millions of channels suspected of illicit activity throughout 2024 and 2025. Telegram has continued reporting tens of thousands of daily takedowns throughout 2026, though our own research has shown cybercriminals remain resilient to the platform’s increased enforcement.

Despite these efforts, Yahoo Boys-associated channels continue to operate in the open on Telegram, using methods that have since matured and are now simpler to execute. While publicly available AI tools have expanded the Yahoo Boys’ capabilities, our researchers were unable to identify many public statements from the developers of many of the tools we identified. Open Measures will continue to monitor these activities on Telegram and other platforms to mitigate harm against vulnerable populations.

Subscribe now

Two news outlets covering the spread of a quickly debunked conspiracy theory about James Talarico, a Democrat running for U.S. Senate in Texas, turned to Open Measures senior researcher Jared Holt to explain how the claims gained traction and what the episode signals about the online information landscape ahead of 2026 U.S. midterm elections.

HuffPost

HuffPost politics reporter Benjamin S. Weiss interviewed Holt for an Oct. 12 article on how easily disproven conspiracy theories about Talarico spread so quickly online. Holt explained that even though the claims were swiftly debunked, they still served a larger purpose: hijacking the conversation around a high-profile race in the final weeks before Election Day.

“Talarico, for the three weeks of the campaign, is answering questions about having the flu instead of his policies,” he said. “It throws chaos into the situation — they can force everyone to react to it, even if it’s complete nonsense … even if it embarrasses them. It gets their opponents off message.”

Holt also discussed the incentives that drive hyperpartisan social media influencers to push conspiracy theories to their audiences:

Animating many of those wild conspiracies, which blow up and fizzle quickly, is a media ecosystem which rewards “independent journalists” who are open about their true status as political operatives, Holt explained.

“It’s a lot of people who want to arrive at a certain endpoint,” he said. “They are willing to propel themselves through some of the most laughable, ridiculous hoops to get there.”

In the case of Talarico’s debunked visit to an Ohio medical facility, Holt argued commentators boosting those claims had long suggested that his absence from the campaign trail was a sign of an ulterior motive.

“They had this feeling that something was off, and that people should be concerned about this guy the way they’re concerned about this guy,” he said. “Here they have this anecdote that claims to be like an explosive confirmation of those feelings, so they latch onto it.”

HuffPost

The Washington Post

Holt also spoke with Washington Post reporter Emily Kennard for an Oct. 13 article examining billionaire Elon Musk’s role in amplifying the false claims about Talarico:

Jared Holt, a senior researcher at Open Measures, a platform that measures the spread of online extremism and disinformation, said Musk’s elevation helped claims like [Nick] Sortor’s proliferate.

“His engagement with posts promoting the claims did boost them to wider audiences than they may have reached otherwise and likely served to legitimize them in the eyes of ideologically aligned users,” Holt said in an email.

This kind of public attention can prove dangerous for ordinary figures suddenly lifted to the center of public fascination, he added. “The ecosystem where these claims spread has regularly elicited threats to schools, medical facilities, election offices, courts, and private businesses,” Holt said.

The Washington Post

Subscribe now

Officials and organizations across the United States are preparing for potential chaos and confusion surrounding upcoming midterm elections, expecting to face threats and disruptions to the democratic process from government actors and outraged citizens, alike.

Open Measures assesses that the most pressing threats to 2026 midterm elections center on expected federal interventions in state election administration and reactions they may provoke from the current administration’s supporters and opponents. We expect to see threats against election officials, nongovernmental organizations, political figures, and others manifest themselves through this lens, which could drive sudden and intense changes to the threat landscape as voting and ballot-counting processes are conducted and results are announced.

What We’re Seeing

The online threat landscape surrounding 2026 midterm elections includes many of the same risks seen throughout prior elections over the last decade. Our researchers have observed troves of false, misleading, and inflammatory online narratives attacking the legitimacy of election results and the integrity of organizations and individuals involved in election-related activities ahead of 2026 midterms. Apart from eroding public trust in democracy, these narratives often elicit violent rhetoric against their subjects, sometimes resulting in physical threats to their safety. Hostile online narratives about elections have also inspired dangerous offline activity, including acts of violence, in prior election cycles.

In recent months, our researchers have noted the following election-related narratives as potential drivers of threats to 2026 midterm elections:

• Demands for federal officials to intervene in state elections and impose national restrictions on ballot access. Our researchers have observed steady calls for the current administration to override state-level election administration during 2026 midterm elections and enact federal policies that would restrict ballot access and make it more difficult to vote. Proponents of such measures have spent months recycling debunked and misleading claims about past elections to argue in support of federal interventions, and we’ve seen online communities aligned with the administration express extreme hostility toward officials who have blocked efforts to change election laws.

• Inflammatory claims about nonprofit groups engaged in election-related activities. Narratives and viral claims accusing nonprofit organizations of engaging in nefarious or potentially illegal activity have seen wide reach on the social media platforms we monitor. Our researchers have observed that these claims have most-often targeted liberally aligned and nonpartisan organizations, which proponents of these narratives have portrayed as conductors of fraudulent election activity meant to advantage the Democratic Party. As these narratives spread, nonprofits and their donors have reportedly faced threats of political violence and legal attacks.

• Scapegoating of minority communities in election-related issues. Narratives portraying racial, religious, and ethnic minority communities as inherent threats to national security and election integrity have gained traction online in recent months. Similarly, narratives alleging that illegal voting by noncitizen immigrants could swing close races have seen wider circulation in online political communities. Law enforcement organizations have warned that surges in dehumanizing and hateful political rhetoric can foster acts of targeted political violence.

• Concern and speculation about potential foreign interference from hostile state actors. Our researchers have noted a resurgence of narratives discussing how known hostile states may have interfered in previous elections, alongside speculation about what those actors may attempt in 2026. We’ve observed those that support federal intervention in upcoming elections cite threats of foreign interference as justification for the administration to declare a national security emergency and seize control over midterm elections.

• Renewed focus on certain methods of voting. Claims that certain methods of voting, including mail-in voting and ballot drop boxes, are uniquely vulnerable to election fraud have resurfaced ahead of 2026 midterms, though our researchers have found much of that chatter has been animated by the administration’s attempts to restrict mail-in voting. In prior elections, narratives about voting methods have inspired vigilante surveillance, alleged acts of voter intimidation, and illegal destruction of ballots.

• Fear and uncertainty over expected federal intervention in elections. Our researchers have seen online communities oppose potential federal interference in 2026 midterms with hyperbolic and speculative rhetoric, casting federal efforts as inevitable and sinister plots to subvert democracy. In some cases, discussions of expected events have included comments from users debating how aggressively they might respond to those scenarios. Over the last year, we’ve seen federal activity elicit widespread protest activity, some of which has turned chaotic and driven acts of violence against federal law enforcement.

What We’re Not Seeing

At the time of writing, our researchers noted that some threats they’d observed ahead of previous elections were less apparent:

• Planned activity from organized extremist movement groups. We have not identified evidence that organized extremist movement groups are actively planning violent or disruptive actions targeting 2026 midterm elections. Our researchers note that organized extremist group activity has steadily declined in the United States since 2023, reflecting many extremist movements’ pivot away from centrally organized groups in favor of decentralized networks. Much of the extremism-motivated violence seen in recent years has come from radicalized individuals. Recent activity and propaganda seen from organized extremist groups has targeted minority groups.

• Open chatter of compromising or sabotaging voting machines. Our researchers have not identified significant chatter concerning the exploitation or destruction of election infrastructure, like voting machines, as they have in prior election cycles.

• Organized efforts to conduct vigilante surveillance of polling places or ballot drop boxes. At the time of writing, our researchers had not seen clear efforts to organize amateur surveillance efforts of polling or ballot drop box locations on or around Election Day, as has occurred in prior election years.

What We’re Watching For

Our researchers will be watching the spaces they know best – niche online communities and platforms – for threats and developing trends that pose risks to election integrity and public safety, including:

• High-impact online narratives that show potential to drive other harms

• Targeted harassment campaigns against public officials and election workers

• Mobilization from extremist political movements and groups

• Planned protest activity that displays signs of being disruptive or violent

• Evidence and claims of inauthentic online activity, including from hostile state actors

• Threats to election-linked locations, like polling sites and ballot-counting centers

• AI-generated and manipulated media that shapes prominent narratives

• Evidence of insider threats to election offices

• Scams and cybercriminal activity related to elections

Open Measures will be monitoring for emerging online threats surrounding 2026 midterm elections on a daily cadence between Oct. 27 and Nov. 10, 2026, and sharing our findings with those interested. Individuals and organizations can opt-in to receive daily updates from our team using this form.

Subscribe now

Hello again from Open Measures! Our team is preparing for the upcoming US midterm elections. We’ll be actively monitoring for threats in the weeks surrounding Election Day, providing daily insights to our partners. Keep an eye out for more information about that in the next week.

Subscribe now

We’ve also been experimenting with making short videos that explain how we approached research pieces we’ve published. We’re calling this series “Under the Hood” and our first two videos discuss our research on the “culture war” outrage campaign against the WNBA and the 4chan users looking to home-brew AI deepfake porn.

What We’re Reading:

• Key election denial activists in the right-wing media ecosystem (Media Matters)

• As CNN, MS NOW, Politico Booted, White Nationalist Outlet Snags White House Press Slot (ConfrontTheHate.com)

• Someone ‘Torturing’ LLMs in a Robot Prison Has Triggered the Dumbest Debate in AI Yet (404 Media)

• The Real Threat to the Midterms Is Regular Americans Thinking Violence Is the Answer (WIRED)

Before you go…

• There are a lot of great movies in theaters right now, and our team highly recommends the following: Resident Evil, Primetime, and The History of Concrete.

Readers of a hyperpartisan news blog have shared violent and threatening comments about public officials in the United States ahead of 2026 midterm elections, a new analysis from Open Measures has found.

Public officials in the US have faced unprecedented amounts of threats, hate, and harassment in recent years, raising safety concerns and driving high turnover in some sectors of public service. Attacks have targeted both elected officials and nonpartisan government employees at the federal, state, and local level – imposing additional strains on democratic processes, like voting.

Ahead of the 2026 midterm elections, Open Measures reviewed an often-overlooked threat surface where threats against public officials routinely appear: comment sections on hyperpartisan news blogs. For our analysis, we looked at our collections for Disqus, a third-party platform used by many of the internet’s highest-trafficked publications to allow users to post comments on their sites’ content.

Subscribe now

Our Approach

Open Measures created two search queries to identify comments containing violent and threatening rhetoric targeting public officials on Disqus-enabled sites over the last month, between Aug. 22 and Sept. 22, 2026. The first included keywords related to titles of government positions, including terms like “senator”, “council,” and their variations. The second included terms related to violence, like “execute” and “kill,” among others. After separately reviewing the results of these queries, we combined them into a third query that would identify posts that contained at least one term from each.

While keyword-based search methods are useful for identifying and monitoring violent rhetoric, even the most carefully designed queries are likely to surface irrelevant posts and omit others that could be of interest. This limitation is relevant to the analysis of contemporary political discourse, as hyperbolic and aggressive online rhetoric about political figures is relatively widespread online and does not always reflecting immediate or specific threats to their safety. As such, a thorough manual review of results and the contexts they appear in is necessary to confidently arrive at broader conclusions.

Open Measures’ platform includes tools to streamline the manual review necessary to arrive at confident qualitative analysis; Discover enables researchers to filter and review individual posts identified by their search queries, while Research Assistant generates reports and insights from large volumes of data, and can be configured to flag posts that contain threatening language for closer inspection. We used both tools to help us assess the results surfaced by our queries, and to identify individual posts and threads for closer review.

As such, the analysis that follows should be understood as a partial snapshot of a larger threat environment targeting public officials, not a conclusive assessment of all concerning material that has appeared in the comment sections of Disqus-enabled sites.

High Volumes of Concerning Comments Identified on Hyperpartisan ‘Junk News’ Site

When reviewing the results of our queries, we observed a particularly high density of violent and threatening rhetoric among Disqus comments shared on The Gateway Pundit, so we narrowed the scope of our analysis to more closely examine activity associated with the site.

The Gateway Pundit is a political news blog that fact-checking organizations have repeatedly highlighted as a promoter of “junk news” and conspiracy theories. The site is known for its unabashed political bias toward President Donald Trump, routinely publishing flattering articles about him and other figures in or aligned with his administration and sharply criticizing others deemed to be political opponents. The outlet also presents stories in ways known to reinforce an audience’s prejudices against perceived out-groups, including racial and religious minorities, mainstream news media figures, left-wing activists, and public officials.

The outlet wields significant influence in the broader pro-Trump digital media ecosystem and has established itself as a vital platform for right-wing election denialist movements. Our prior research has found that Gateway Pundit articles are consistently among the most shared links on platforms dominated by pro-Trump userbases, like Truth Social and Gab, and that content published by the site often drives hostile narratives as they develop in those communities.

Of all Disqus-enabled sites in Open Measures’ platform, The Gateway Pundit is among those that see the highest number of comments on its content. Using a wildcard search -- a broad search not filtered by any specific keyword -- to assess all Disqus comments in our platform that were posted during our analysis period, we saw The Gateway Pundit hosted the 11th most-active Disqus comments section between Aug. 22 and Sept. 22. During that month-long period, articles on the site saw more than 620,000 comments.

Gateway Pundit Articles Criticizing Public Officials Frequently Elicit Comments Containing Violent Rhetoric

The Gateway Pundit’s coverage regularly takes aim at public officials, posting articles with headlines and images intended to emphasize their subjects’ alleged corruption. Stories on the site have previously directed readers’ anger toward both high-profile figures, like members of Congress, and otherwise obscure local officials, like county clerks, school board members, sheriffs, and judges, among others.

We found that these stories reliably elicited outrage from the site’s commenters, forming a call-and-response dynamic evident across dozens of Gateway Pundit articles we reviewed. Gateway Pundit commenters regularly used hyperbolic and hostile language when talking about public officials, and some openly fantasized about seeing those individuals physically harmed.

For example, Gateway Pundit ran a story on Sept. 18 that aggregated credulous claims about a federal judge who ruled against the Trump Administration in court, alleging he was linked to the Chinese Communist Party. Alongside hundreds of reader comments disparaging the judge, including many that likened him to a Nazi, some Gateway Pundit commenters fantasized about the judge’s death and called for his execution.

“Impeach convict and hang as an enemy agent,” one commenter wrote.

Another posted: “Why is [the judge] still breathing?”

“I could watch him dance at the end of a rope every day for a year and still not get tired of watching him kick,” another commenter wrote.

One commenter posted an animated image depicting a noose swinging in the wind, captioned: “Citizen Vigilantes time to act. it is the only way!”

As we reviewed similar comments that appeared on Gateway Pundit articles over the last month, we saw commenters shared similarly violent fantasies about other public officials featured in the site’s articles: a county sheriff in South Carolina, city government leaders in Seattle, congressional staffers on Capitol Hill, a labor union representing employees at a federal agency, and several judges across the country.

Open Measures did not observe any comments during our analysis where a user expressed specific plans to physically harm a subject of Gateway Pundit’s coverage, but we did encounter comments from users who expressed their hopes that others would do so. For example, one comment on a Sept. 10 article about federal judges who blocked the Trump Administration’s attempts to reinstate new rules around mail-in voting read:

These judges are the tyrants and despots that founding fathers warned us about. They’re the reason why we have a second amendment. At some point the American people, including the cowards in this comment section, are going to have to grow a collective set of nuts and rise up and overthrow this freezing is federal judiciary in tyrannical United States government by any means necessary.

Other comments in this vein fantasized about an eventual “revolution” and anticipated the arrival of a second US Civil War.

Our Take

Our research found that Gateway Pundit articles negatively depicting public officials regularly drew strong responses from the site’s readers, including comments that fantasized about and called for violence against the individuals featured on the site.

The violent rhetoric we observed Gateway Pundit readers using toward public officials provides a clear view of the sorts of harassment and intimidation threats that public officials are facing around 2026 US midterm elections. While we did not identify comments during our analysis that conveyed immediate and actionable threats to the physical safety of the individuals that they were directed toward, extreme political rhetoric has contributed to countless acts of real-world violence.

Comment sections on inflammatory political news sites like The Gateway Pundit are often overlooked as places where serious threats can appear online, and our findings underscore the importance of adding them to the sources researchers and security professionals already monitor. Open Measures will continue to track threats surrounding this year’s midterm elections.

You can read that story, below:

Users on 4chan’s “Technology” board have shown heightened interest in tools and techniques for using generative artificial intelligence models to create their own “deepfake porn” in recent months, new analysis from Open Measures and the American Sunlight Project has found.

Subscribe now

The uptick followed the abrupt closure of 4chan’s “Adult Requests” board in May, which functioned as one of the internet’s most active outposts for synthetic non-consensual intimate imagery (NCII) abuse prior to its removal, and the implementation of the TAKE IT DOWN Act in the United States, which criminalized the online distribution of NCII and imposed penalties against platforms that failed to respond to removal requests.

Amid these shifts, Technology board users have circulated dozens of different “guides” containing information about AI models and using them to generate synthetic images. Most guides consisted of compiled hyperlinks to commercial and open-source AI tools, instructions for using them offline on personal devices, and repositories of code for low-rank adaptation models (“LoRAs”) that tweak existing AI models for specific use cases.

While those guide posts rarely made explicit mentions of using the provided resources to produce synthetic NCII, we found that threads where the guides were shared regularly elicited replies from 4chan users who indicated they were interested in doing exactly that.

Increased Chatter About Generative AI Tools on 4chan’s ‘Technology’ Board Propelled, In Part, By Users Interested in Making Synthetic NCII

The number of posts per day on 4chan’s Technology board discussing generative AI models and synthetic imagemaking increased after the closure of Adult Requests and the implementation of the TAKE IT DOWN Act in May. Our analysis found that the increase is attributable, in part, to users who indicated they were interested in using AI models to create sexually explicit synthetic images.

A search query containing 41 terms related to AI image creation, including the names of specific AI models and techniques, identified more than 36,000 posts on the Technology board between May 20 and Sept. 8, 2026. Using the Timeline tool in Open Measures’ platform to visualize the number of posts per day that included at least one term from our query, we saw that discussion of those models and methods increased in late June and spiked in early August.

Talk of generative AI models on the Technology board spanned many different use cases during the period we analyzed, ranging from benign to malicious. To identify posts that discussed AI image creation in the context of NCII, we created three expanded search queries to identify posts that also included terms related to sexually explicit imagery.

Viewing the results of those searches over the same timeframe, we saw that periods of increased chatter about generative AI models alongside terms related to explicit imagery often coincided with periods of increased interest in the tools, broadly.

We used Open Measures’ Activity tool to identify which URL domains frequently appeared in posts matching our search query. Hyperlinks included in posts discussing AI image generation on the Technology board most often directed to pages on the developer platform GitHub, text editing site Rentry, research database arXiv, machine learning development forum Hugging Face, and anonymous file hosting service Catbox. This suggests that conversation about generative AI tools on the board included discussions of technical details related to their use, and an informal pipeline of sorts.

For instance: arXiv hosts thousands of preprints and detailed papers about principles, methods, and vulnerabilities in machine learning. HuggingFace offers publicly accessible downloads of both base and trained models, image datasets, and LoRAs that already exist of politicians and celebrities. GitHub enables modifications, jailbreaks, and other creative potential that is used to tweak models. Rentry allows users to train prompts and model skills, with results shared on anonymous media hosting sites like Catbox.

‘It’s Laughably Easy’: Users Share and Solicit Advice for Generating Synthetic NCII on Guide Threads

The threads we identified on the Technology board sharing guides for generating images with AI models rarely include direct references to synthetic NCII, but discussions on those threads frequently attracted users who expressed interest in using them for that purpose.

Our expanded search queries that included terms related to sexually explicit imagery identified posts where Technology board users shared and solicited advice for making pornographic content with generative AI models. For example, in an Aug. 28 thread, after one user suggested a particular AI model wasn’t ideal for creating sexually explicit images, another user suggested they utilize a LoRA model for that purpose:

it’s laughably easy to just apply a nsfw Lora and go from there

In similar “guide” threads, Technology board users praised specific AI models for their lack of guardrails preventing the generation of sexually explicit content, trading links to custom LoRAs tailored to depict realistic nudity, and sharing tips for prompting models to produce synthetic NCII. Some posts in those threads sought advice on how to circumvent guardrails built into certain AI tools, as seen in this Aug. 28 post:

What is the best AI system or model currently for undressing women and generating lingerie / nude shots? I haven’t been able to create anything since Grok was neutered

Other posts we identified showed users asking for help using specific models to produce pornographic images, like this reply to a guide thread on Aug. 9:

I need a guide for minimax. I don’t know how it is supposed to be good at porn. All my gens are absolute SHIT! Including those with video references

Anti-NCII Laws Haunt Users Discussing Synthetic NCII on 4chan

Adult Requests disappeared two days after the implementation of the TAKE IT DOWN Act, a US law that criminalized NCII and mandated tech companies to respond to requests to remove it when flagged on their platforms. Alongside broader discussions of AI image generation, we also saw that users on the Technology board acknowledge the increased legal implications surrounding deepfake porn.

Two days after Adult Requests’ removal, one user on the Technology board seemed to mock the implementation of the TAKE IT DOWN Act in a May 23 post referring to President Donald Trump and former Vice President Kamala Harris:

Do you think if *an individual* were to keep posting AI-generated deepfake nudes of Trump being pegged by Kamala…on /pol/ and reporting their own posts to the FBI, that board would get shut down just like they have shut down [Adult Requests] earlier today?

If the said individual were to also retweet such threads to President Donald Trump on TruthSocial, would that speed things up?

Posts remarking on the removal of Adult Requests also appeared on other boards across 4chan, where users were seen sharing theories for why site moderators took down Adult Requests.

On May 22, in reply to a thread asking where Adult Requests went, a 4chan user hypothesized that the board had been removed in response to the implementation of the TAKE IT DOWN Act and a news report about the synthetic NCII the board’s users were producing and sharing:

some suspect it might be connected to this story.

https://archive.is/2026.05.21-102104/https://www.wired.com/story/4chans-misogynist-wizards-are-nudifying-women-by-request/

also the Take it down act deadline expired on may 19th:

https://en.wikipedia.org/wiki/Take_It_Down_Act

Throughout June and July, remarks like these, and direct user-to-user interventions within threads containing synthetic NCII, occurred sporadically on the Technology board.

Fast forwarding to early August, we observed a notable interaction in a continuation of a long-running megathread called “Local Diffusion General.” On Aug. 4, users discussed the release of an uncensored version of H3 Minimax — a powerful generative AI model with minimal guardrails. In response to a post linking to a pornographic adaptation of the model, one user condemned others for publicizing the model’s malicious uses and insinuated that violative content was still being produced offline:

can you 4chan hackers stop ruining it for everyone? you’re going to get this shit banned if you keep genning problematic stuff and posting it online

Despite this attempt to shift the public discussion, other users in the thread replied in support of continuing to generate deepfake NCII. One declared:

Let them archive the models while we do what we must. THERE’S NO BREAKS ON THE GOONING TRAIN!

Another user blamed copyright-violating posts on Reddit for the increased enforcement against deepfake sexual abuse on 4chan:

From what I’ve seen reddit is a lot more likely to get it “”“Banned”“” with all the copyrighted stuff they post. Nobody gives a fuck about what people do on here.

Our Take

Communities that traffic in synthetic NCII have been forced to adapt their tactics in the wake of the implementation of the TAKE IT DOWN Act, increased guardrails on major commercial generative AI tools, and other factors that have made creating and sharing deepfake porn online more difficult and costly.

Our research suggests that one way communities have adapted is by developing and sharing an array of tools and techniques for homebrewing synthetic NCII with tweaked AI models run locally on personal devices. While this has manifested as a potential decrease in publicly available synthetic NCII, this does not appear to be the result of 4chan communities’ willful compliance with the law. Rather, it appears these communities are adopting new mechanisms to preserve their remaining online presence. This development presents new challenges for researchers tracking online abuse and those tasked with enforcing laws and platform guidelines prohibiting NCII.

While it remains to be seen exactly where former Adult Requests users will resettle online, our research found that 4chan users’ interest in finding new methods of producing synthetic NCII, often by hosting modified AI tools locally on their personal devices, has increased in recent months. And as governments around the world enact new laws to criminalize the distribution of NCII, those capable of homebrewing synthetic NCII with AI tools may draw increased interest from other nefarious online actors and communities.

Open Measures and the American Sunlight Project will continue monitoring toxic online communities to track how AI deepfake abuse evolves.

Subscribe now

Subscribe now

Security teams use online monitoring to help them predict where and how online activity may materialize into physical threats, but many of the tools available were designed to monitor major platforms that have since become less relevant. When online threats are first detected on a major platform, they are frequently a late signal, as threats have often been developing for months in unmonitored fringe communities on alternative platforms before entering the mainstream.

In 2026, threat actors exist in a wide range of fringe communities on numerous alternative platforms, from which many threats now originate. Security teams detect these threats as early as possible, as once they appear on major platforms, the window for an effective response has often already closed. Open Measures’ platform was designed to close this gap, giving security teams broader visibility for

To help security, risk intelligence, and executive protection teams detect threats earlier and respond more quickly, below are six platforms to monitor in 2026, all available through our platform.

1. Telegram: A Primary Marketplace and Communication Hub for International Cybercriminals

Despite a surge of enforcement on Telegram after founder Pavel Durov’s arrest in 2024, cybercrime syndicates have not left the messaging platform; instead, they have continued to flourish, developing new strategies to evade moderation.

In 2025, our researchers mapped one cybercriminal syndicate’s activity on Telegram as an operational template for similar groups. In 2026, our researchers confirmed that this networked structure remains alive and well for brokers of stolen accounts, with fourfold increases of keyword-matching activity from 2025 to 2026 in identified channels. As Telegram has increased support for automation and bot automations, these networks have proven only more resilient.

For corporate and private security teams alike, Telegram is likely to be a primary protective intelligence source for preventing insider recruitment, ensuring the physical security of executives and personnel, and defending against corporate cyberattacks across industries (including – but not limited to – payment processing, social media, e-commerce, gaming, and artificial intelligence).

2. Soyjak.party: Automated AI Doxxing Tools Lowering the Technical Barrier to Online Harassment

Soyjak.party is a fringe imageboard site known for hosting communities dedicated to “worshipping” mass shooters, which researchers have tied to successive shootings and bombings in 2024 and 2025, and for its numerous targeted harassment campaigns known as “raids.” While the site’s users have primarily targeted private individuals, they’ve recently developed tools that collapse the usual effort required to do so. Our researchers have already observed these tools beginning to spread off-platform, suggesting they could soon be used against targets deemed “higher value.”

In July, our researchers showed that Soyjak.party users had developed several AI-powered doxing tools since October 2025, among them a “fully autonomous” tool for assembling a given target’s private identifying information (PII) into a complete “dox report” using previously breached account information from breach databases. While breach databases sometimes contain only partial or outdated PII on a given target, we also identified Soyjak.party users combining various old data fragments (eg, IP geolocations, birthdays, family members) to successfully identify and attack new targets.

While executives and corporate personnel can use online data removal tools to protect their privacy and mitigate against online attacks, these tools do not remove access to previously breached data or prevent users from combining fragmented data into newly usable PII. While AI-doxxing remains largely limited to Soyjak.party thus far, the platform is still useful for security teams for monitoring these attack techniques before the spread elsewhere, and to identify pre-attack signals.

3. Scored/patriots.win: Dedicated User Base Crowdsourcing, Identifying, and Attacking Political Targets

Scored is a Reddit-style forum whose largest community is c/TheDonald (or “patriots.win”), a successor to the banned Reddit community r/TheDonald. Though overall activity on Scored peaked in 2020-2021, Similarweb data from July 2026 shows the site’s global ranking has quietly grown, with 92% of its traffic from the US and each site visits averaging 10 minutes (three times that of the average site visit on Truth Social), suggesting an unusually dedicated user base.

Our researchers previously examined Scored activity ahead of the January 6 insurrection and identified elevated activity, including posts discussing attacks against journalists and planned infrastructure attacks. Additionally, we observed users deanonymizing political and business figures using OSINT techniques to coordinate campaigns and attacks against them. Unlike sites like 4chan and Soyjak.party, where discussion threads are automatically archived upon hitting a certain post limit, threads on Scored are persistent and searchable, with upvotes from dedicated users increasing their visibility and keeping threats active. Ahead of the upcoming US election, security and safety teams are likely to benefit from monitoring Scored for advance warning of similar demonstrations and attacks.

4. TikTok: Attack Surface for Coordinated Campaigns Targeting Minors by State-Aligned Actors

Though TikTok is primarily a popular video streaming platform, the extensive metadata it collects from users have made it a growing vector for a wide range of targeted influence operations. We’ve previously reported on domestic influence operations on TikTok, but recent investigations have revealed Russian, Chinese, and Iranian state interests’ operations on the platform as well.

Examples of successful recent state operations on TikTok include Russian campaigns to sway elections in Romania in 2024 and Moldova in 2025 (with follow-on attempts to mobilize protests in 2026) as well as PRC influence campaigns targeting US audiences. Various reports have shown TikTok is an initial surface for persuasion, with viewers often funneled to platforms like Telegram for “tasking.” Recent actions downstream of Russian and Iranian operations include a 17-year-old committing arson in Vilnius in 2024 and alleged reconnaissance operations by Dutch teens in 2025, both resulting in arrests.

While the FBI recently debunked claims that TikTok campaigns drove a spike in retail crime among teens in 2025 and 2026, narratives of state actors using the platform to influence teens are well documented and worth monitoring for security teams.

5. FashFront: Fascist Vetting and Recruitment into Organized Violence and Infrastructure Attacks

FashFront, a small but concentrated neo-Nazi forum, emerged in 2025 as a place for self-described “fascists to network.” Previously identified as part of the now-defunct Terrorgram network, the site remains active as a space for vetting and recruiting users and funneling them into more private forums for planning and executing hate crimes and terroristic attacks.

According to a 2026 study, 31 of the 38 attacks on US infrastructure between 2020 and mid-2025 were organized by far-right actors. Likewise, on FashFront, users have previously been observed posting the coordinates and addresses of dozens of US electrical substations. As recent reports suggest the site’s influence may be growing, monitoring the site may provide helpful early warning signals for security and supply chain teams.

6. Disqus: An Underestimated Resource for Identifying Cross-Platform Threats

On its own, Disqus, a third-party platform for commenting on news blogs, is the largest platform of its kind, integrated into hundreds of fringe sites. Across all Disqus-enabled sites, users comment from only one username, and each comment is date-stamped and geolocatable. As a result, each user leaves a persistent, complete, and sometimes decades-long comment history behind them that security teams can analyze. As one Swedish research team demonstrated in 2013, these data trails can help analysts identify cross-platform threats much more easily.

While Disqus is unlikely to help analysts identify threat actors on its own, the platform’s data features offer an unusually extensive look at individual actors’ online activity across many different sites. Though fringe sites are beginning to disintegrate from Disqus for security reasons, the platform’s full archive of more than 270 million comments remains searchable in Open Measures’ platform.

In order to interrupt and disrupt emerging threats, security teams protecting executives, supply chains, and political figures need immediate alerts. While monitoring major platforms can provide a pulse, responding to time-sensitive situations often requires a broader field of view. With Open Measures’ platform, security teams can access additional insights from fringe platforms to fill in crucial context when they need it most.

Subscribe now

The Electronic Frontier Foundation published a two-part guide this week advising readers on how to protect themselves from doxxing attacks — first by locking down their digital footprint before anything happens, then by responding if an attack is already underway. Both installments, written by EFF Senior Staff Technologist Daly Barnett, point to Open Measures as a resource for tracking how harassment campaigns spread across platforms.

In Part I: Prevention and Footprint Management, Barnett recommends Open Measures to help track the spread of coordinated harassment attacks across platforms:

“If you’re the focus of coordinated attacks that span from online communities to media outlets participating in the harassment, a service like Open Measures is worth looking into. It tracks, maps, and analyzes the spread of hateful information online. They provide free access to their open-source API, so with some technical fancy-footwork, you can automate this process.”

Part II: Incident Response also mentions Open Measures as a tool to help track mentions of keywords (like names) by hostile actors:

“For a more sophisticated approach, you could use a tool like Open Measures to automate the task of tracking coordinated campaigns.”

Check out both parts of the guide, here:

• Doxxing Safety Pt I: Prevention and Footprint Management

• Doxxing Safety Part II: Incident Response

Hello again from the Open Measures team. We’ve had a busy August, pushing new features to our platform and working on some exciting research. The big news is that our company was acquired by Everbridge, an industry-leading critical event management platform, and we’re very excited about it. You can learn more about that in the announcement we shared yesterday.

Subscribe now

Here’s a look back at the research articles we published in August. We’ll keep this one short and sweet.

What We’re Reading:

• The rise and fall of Automata (Decoherence Media)

• AI-generated Costco employees got over 100 million views on Facebook and Instagram (Indicator)

• Subtlefakes: Slightly Altered Nonconsensual AI Images Are Taking Over X (404 Media)

• Paid actors, AI writing: How a new kind of video business cashed in on America’s divided politics (Semafor)

Before you go…

• Open Measures was cited in news articles from NPR and Decoherence Media. Be sure to check those out!

• Rest in peace to music legend Dolly Parton.

Open Measures is joining Everbridge, an industry-leading critical event management platform trusted by thousands of organizations worldwide, to provide security, safety, and communication teams a more complete picture of the threats and narratives that matter to them most.

When Open Measures was founded in 2021, with grant funding from the Mozilla Foundation, Start.coop, and Google Jigsaw, our team came together to solve a problem: disinformation and other online harms tend to first take shape on the unmoderated internet – on Telegram channels, fringe forums, and alternative platforms – long before the mainstream notices. We built a solution to make that space visible, designed for the researchers, press desks, enterprises, and civil society organizations that hoped to hold the otherwise hidden actors there accountable.

With this acquisition, we will have even more resources to deliver on our mission. Here’s why:

Our reach and impact will expand exponentially. Everbridge works with organizations managing critical events at a scale we couldn’t reach alone. Folding our social risk intelligence platform into that ecosystem means more organizations get earlier warnings about the narratives and coordinated activities that often precede real-world harm, which has always been important to us.

Our research – supporting journalists, academic researchers, and corporate teams alike – will continue without interruption. Over the years, Open Measures has been cited in NPR, The New York Times, the Washington Post, Bloomberg, The Guardian, and our findings have aided the work of organizations like ProPublica, Bellingcat, and Bridging Divides Initiative as well as researchers at Oxford and NYU. To preserve the trust our researchers have built, and with Everbridge’s enthusiastic support, we’ll continue producing the same quality reporting and coverage we always have.

The entire team will remain the same. It was critical to us that our entire team – from research to engineering to operations, international contractors to executives – would be retained through acquisition. Every member of our team remains on board and energized to continue this work.

Open Measures will still be Open Measures. We’ll continue our work developing cutting-edge software and pioneering research with the same branding and feel that the industry is used to. We’ll maintain our identity in all that we do (including our much-acclaimed merch – IYKYK).

After many conversations with Everbridge, the deal we’ve arrived at is designed to ensure that our mission will outlive our acquisition.

Before closing, we’d like to reflect on some of the work that we’ve been most proud of to date:

• Our research into 4chan’s “Adult Requests” board – one of the internet’s largest and fastest-growing venues for nonconsensual AI-generated explicit imagery – helped spark wider scrutiny and culminated in its coming offline. The board has stayed offline for months with no sign of returning.

• The New Arab partnered with Open Measures’ researchers and leveraged our platform to analyze roughly 4.4 million Telegram posts across 86 channels, uncovering how Israeli settler militias in the West Bank raised more than $3.75 million through nonprofits since October 2023. That reporting helped lead to the UK, Canada, Norway, New Zealand, and Australia sanctioning two of the named organizations in June 2026, and the investigation was later shortlisted for a 2025 Amnesty Media Award.

• Our 2026 AI Threat Landscape Report mapped how AI-enabled cybercrime moves across platforms, finding that 4chan serves as a discovery hub generating 300–350 related posts per day, while Discord hosts invite-only R&D servers, and Telegram increasingly functions as a commercialization layer for these tools.

• ProPublica and FRONTLINE’s investigation into the neo-Nazi Terrorgram network relied on our platform to help identify the coordinated and dangerous online activity tied to the network.

From our entire team: thank you to everyone who chose us to help with their hardest problems, believed in our platform, and trusted a small, worker-owned company to punch above its weight. As Open Measures enters this new chapter, with the same team and platform organizations have come to depend on, our work will continue.

Subscribe now

You can read that story, below:

Subscribe now

The WNBA has seen unprecedented growth in recent years, credited in large part to fans’ excitement for rising star players like Indiana Fever guard Caitlin Clark and Atlanta Dream forward Angel Reese. In 2025, the WNBA drew record-breaking attendance and television viewership, the highest that professional women’s basketball has seen in the United States since the league’s inception.

But the WNBA’s growth has also come at a cost to its players, who have reported being increasingly targeted by online commenters’ bigoted hate, personal harassment, and violent threats. The problem has grown so severe that the WNBA launched a dedicated task force meant to address the issue, which has implemented new security protocols, online threat-monitoring programs, and mental health resources for teams and players.

WNBA officials and many top players, like Clark, have repeatedly condemned threats made against members of their league, and have publicly denounced those who have sought to hijack public conversation to promote hateful and demeaning rhetoric. But those remarks have done little to quiet toxic commentary, which has devolved into a “rinse-and-repeat drama” over the summer.

Hyperpartisan News Blogs Drive Divisive Rhetoric Around WNBA

Conservative political figures have intensified their focus on the WNBA this summer, leveraging drama in the league to promote their movements’ longstanding and divisive “culture war” narratives targeting minority groups. Since June, largely egged on by hyperpartisan media, their rhetoric has grown more aggressive and earned buy-in from Republican lawmakers.

We used our platform’s Timeline tool to search for posts mentioning the WNBA across nine platforms dominated by right-wing political communities since May 24, finding that the daily volume of posts we identified per day drastically increased throughout the summer.

Between May 24 and Aug. 24, users on those nine platforms shared more than 14,000 posts mentioning the league. Over the three-month period we analyzed:

• May 24 to June 24: 536 posts (~4% of total posts)

• June 25 to July 24: 3,446 posts (~24% of total posts)

• July 25 to Aug. 24: 10,125 posts (~72% of total posts)

We identified a similar trend in the number of comments shared to websites that use Disqus, the web’s most-popular third party commenting and discussion platform. Between May 24 and Aug. 24, more than 46,000 comments on Disqus-enabled sites mentioned the WNBA.

Using our platform’s Activity tool, we found that the vast majority of Disqus comments mentioning the WNBA during our analysis period were shared on right-wing political news blogs, which ran a slew of inflammatory stories about the league this summer.

Of the 15 sites where the highest volumes of Disqus comments mentioning the WNBA appeared, 10 were hyperpartisan political news blogs. Together, those 10 publishers saw more than 27,000 comments – more than 58% of all Disqus comments we identified.

Initial Narratives Targeting WNBA Alleged Anti-White Racism

As seen in the Timeline chart above, discussion of the WNBA across platforms that harbor right-wing political communities began to surge in late June, as hyperpartisan media outlets ran stories highlighting fouls that Black WNBA players committed against Clark, who is white, and allegations that referees were calling a disproportionate number of fouls against Clark during games. Political actors cited those stories to fuel narratives suggesting the WNBA was racist against white people and that Clark was being targeted on the court on the basis of her race.

Those narratives surged through right-wing communities after June 25, when Phoenix Mercury forward Alyssa Thomas made contact with Clark’s throat during a game. The collision, which Thomas called a “complete accident,” was subsequently upgraded to a Flagrant Foul 2 penalty and resulted in a one-game suspension for Thomas.

In the following days on the platforms we analyzed, we identified thousands of users sharing disparaging remarks about the WNBA, Thomas, and referees. Using Research Assistant to summarize dominant themes across more than 5,500 posts in the week after the foul occurred, we found that the dominant narratives that emerged from the incident centered on racial grievances and prejudices against LGBTQ+ people.

Example posts promoting these narratives include a June 27 post from right-wing radio host Wayne Allyn Root on Truth Social:

Wow is there anti white hate and racism in WNBA. These black ladies hate a white lady superstar. They openly beat the crap out of her in front of tv cameras- and her teammates do nothing. Because she is white. This is allowed in America? Disgusting!

A June 25 comment shared on an article on the right-wing news outlet Townhall, via Disqus:

Black lesbians are black first, violent second and so rabidly racist, they cannot embrace or accept the only positive, real basketball player to hit the WNBA. Now, the WNBA has been exposed for what it is, a racist schoolyard brawl, where the blacks throw punches and elbows every chance they get, hoping to get rid of the white girl. Talk about a problem race, who has exhibited 27 years of failure on their own, and are trying to regain their failure these past two years by destroying Caitlin Clark.

And a June 25 comment shared on an article from the far-right news outlet Breitbart News, via Disqus:

The WNBA commissioner, an lgbt, has told head coaches to have goons on their teams harass and foul Clark incessantly, and try to injure her.

Then the commissioner laid an edict to the refs. to look away, don’t call it, LIE that they didn’t see it.

[...]

The league is made up of YES it’s true...men(trans players), lgbt and low IQ women.

They can’t have a straight white christian girl playing at a high level and is THE MOST popular player in the league.

Weeks later, a group of 11 GOP lawmakers sent a letter to the WNBA expressing concern that fouls against Clark – which they described as “attacks” – were “racially motivated,” adding that the league’s failure to protect Clark may have violated federal civil rights laws.

After fouling Clark, Thomas said she received death threats and was accosted with racial slurs; she also criticized WNBA commissioner Cathy Engelbert for not doing more to address threats players receive. Indiana Fever coach Stephanie White called the abuse hurled at Thomas “absolutely unacceptable,” adding that she believed most of the toxicity surrounding the WNBA wasn’t coming from its fans, but rather from online communities pushing “divisive, hateful narratives.”

Sophie Cunningham’s Anti-Transgender Comments Ignited Weeks of Partisan ‘Culture War’ Attacks on WNBA

Racialized commentary surrounding Clark and the WNBA persisted in right-wing media for weeks after the June 25 foul that set it off. Then, in late-July, one of Clark’s Indiana Fever teammates thrust the league into the crosshairs of contemporary right-wing media’s most excitable culture wars: transgender athletes competing in women’s sports.

On July 21, ESPN published a lengthy profile of Indiana Fever guard Sophie Cunningham, which quoted her voiced opposition to allowing transgender athletes to compete in women’s sports. Cunningham explained she wanted to “protect young girls in a locker room, or young girls in sport who shouldn’t have to go against biological men.”

Cunningham’s remarks, which echoed false anti-LGBTQ+ movement talking points that seek to portray transgender people as sexual predators who target children, elicited anger across the WNBA – a league that currently has no transgender players. Her comments, and their negative reactions, dragged the WNBA into the crosshairs of right-wing media’s longstanding anti-LGBTQ+ “outrage machine.”

Conservative political activists rallied to support Cunningham as she drew pushback from WNBA colleagues and the league’s fans. The Trump Administration lauded her in social media posts and public statements, anti-transgender activists like Riley Gaines appeared at Indiana Fever games, and former NBA players Enes Kanter Freedom and Royce White cynically declared they were women and would be submitting themselves for the 2027 WNBA draft.

Across the platforms we analyzed, right-wing communities lauded Cunningham as a heroic figure, and framed criticism of her comments as attacks on “truth.” In subsequent weeks, we also saw those communities incorporate Cunningham into their prior narratives alleging the WNBA was racist against white people, following fouls that the league’s Black players committed against Cunningham during games. Other prominent narratives disparaged Cunningham’s critics, praised right-wing activists who rallied to support her at games, and hyped the former NBA players who declared they were women who wanted to play in the WNBA.

The highest volume of posts related to Cunningham’s remarks surrounded an Aug. 12 meeting where a WNBA task force met to discuss the increased hate and harassment plaguing the league since it became an unwilling focal point in right-wing political commentary disparaging transgender people. Conservative social media personalities falsely claimed the meeting was meant to determine “what a woman is” and lambasted the league when it did not issue a statement along those lines.

Then, in mid-August, the r/WNBA subreddit banned new posts about Cunningham that were unrelated to basketball and filtered out new posts from users who had not been active in the community before. In an Aug. 16 post, moderators explained the rules were in place [sic] “so the subreddit will not be over-ran with trolls or brigaded.” Across several alternative platforms, right-wing communities cited the decision as proof of the league’s supposed political bias and framed it as a censorship issue.

Over the most recent month of our analysis period, we saw that right-wing news outlets and the communities that read them latched on to an array of inflammatory narratives surrounding the WNBA and transgender athletes, keeping the narrative active for several weeks. At the time of writing, anti-WNBA narratives are still circulating in hyperpartisan media and online communities – with more staying power than many outrage cycles we’ve previously analyzed.

WNBA Express Frustration with WNBA’s Response to Attacks

As the WNBA has attempted to respond to the months-long outrage campaign targeting the league this summer, users on platforms that harbor large left-wing political communities criticized its handling of the situation.

Some of the criticisms faulted WNBA commissioner Engelbert, as seen in this July 30 post on BlueSky:

If we’re talking about this moment in America where so many supposed-leaders (organizational, electoral, cultural, etc.) have failed to rise to the occasion, we shouldn’t just focus our ire on politicians!

Cathy Engelbert is a consultant masquerading as a commissioner.

Other users faulted the league for what they perceived as efforts to pacify its right-wing critics, as seen in this Aug. 8 post on Bluesky:

Pretty wild that the WNBA is deciding apparently to squander all the good will it built with the community who has spent an obscene amount of money on tickets and merch and formed the base of their success. Even if you don’t give a fuck about human rights (🫠), this is just a bad business decision!!!

We also saw hundreds of posts from Bluesky users who expressed resentment that the WNBA was being forced to deal with these sorts of controversies to begin with. A Sept. 30 post from a Bluesky user who said they were a fan of the league read:

Been a fan of the WNBA for years, and what the racists and homophobic/anti-trans bigots have done to the league and the attention it gets the last three years is so fucked. They are trying to steal our fun and fuck them all for it.

And an Aug. 14 post on Bluesky read:

I HATE it when people say “the culture wars” or “the discourse” are ruining the WNBA. BE PRECISE. Right-wing fascists are introducing misogyny and bigotry through their narratives and demands, in an effort to delegitimize an organization full of popular black women who vocally champion inclusivity.

Our Take

Women’s professional sports are experiencing a global surge, attracting new audiences, opportunities, and resources for teams and athletes. But that growth has also elicited previously unseen amounts of online hate and harassment against players, who typically have fewer resources available to detect and mitigate threats than men’s sports teams do.

Much of the controversy surrounding the WNBA this summer has revolved around longstanding “culture war” tropes employed by right-wing media and political figures to disparage minority groups, and that rhetoric has predictably elicited torrents of online hate against its players. And while the WNBA and its biggest stars have attempted to distance themselves from bad-faith critics, Cunningham’s anti-transgender comments effectively dissolved whatever barrier separated them.

Online threats against athletes – particularly women, racial minorities, and LGBTQ+ players – are a growing issue in professional sports. Open Measures’ platform is designed to assist monitoring and analysis across dozens of alternative platforms where online harms can arise, and our team will continue to monitor for threats as the landscape evolves.

Subscribe now

Subscribe now

What is Disqus?

Disqus, launched in 2007, is the internet’s largest third-party commenting and discussion platform, providing online publishers with simple tools for facilitating and managing audience engagement on their websites. According to Disqus’ company’s website, hundreds of thousands of websites use the platform and its users share tens of millions of posts each month.

The platform’s design enables online publishers to host comment sections on their sites without having to develop proprietary web infrastructure and data management systems to do so. Disqus also networks all publishers using its platform together, enabling users to create and use a single account to engage with content on many publishers.

Throughout its lifespan, Disqus has faced criticism for tracking its users and mishandling their data. Journalists and researchers have also noted that Disqus has struggled to enforce its rules regarding toxic content – particularly hate speech – and have suggested that hyperpartisan right-wing publishers that elicit high volumes of such material wield outsized influence over the platform.

Open Measures’ Disqus Coverage

Open Measures added Disqus comments to our collections in February. Due to the platform’s infrastructure, we are able to collect comments shared across all Disqus-enabled websites, enabling our users to monitor and analyze activity across thousands of communities in a single spot.

Our Disqus collection contains approximately 270 million searchable comments at the time of writing, it remains a lesser-understood dataset with unique advantages and use cases for threat intelligence, brand monitoring, and trust and safety teams.

Unique Features and Use Cases

Disqus serves as web infrastructure for many online publishers in alt-media, and platform users use the same account to comment on any Disqus-enabled publisher. In Open Measures’ platform, this makes it possible to trace a user’s activity and comment history across many different publishers, which is useful for a variety of different use cases:

Trust and Safety

• Identifying coordinated campaigns: Using the content of one identified spam post as a query, return all other accounts that posted it and on which publishers – or search for commonly shared URLs to trace spam campaigns executed in comment sections.

Threat Intelligence

• Account Clustering: Identify clusters of accounts created at the same time to expose coordinated activity.

• Identify Emerging Narratives: Analyze comment sections with infrequent moderation to identify emerging narratives before they cross into the mainstream.

Brand and Trend Monitoring

• Sentiment Analysis: Analyze specific audience reactions to any number of news topics across publishers; analyze upvotes or downvotes for additional texture.

• Visualize Narrative Spread: Use time-stamps and user-specific metadata to determine when, where, and how narratives spread across publishers.

Crafting Disqus Search Queries

As with our other sources, Disqus data is searchable in Activity, Discover, and Timeline. For those using our Pro API or Advanced Search, we’ve included a list of key terms for Disqus data below for ease of reference.

disqus: Platform endpoint

author.username: Username

author.name: Display name

content: Post content

url: Original comment URL

forum.url: Site URL

forum.name: Site name

For additional terms and details on query syntax, see the Standard Schema and Endpoints pages in our full documentation (please note that in Disqus queries, “forums” correspond to websites, “threads” correspond to articles, and “posts” correspond to comments).

Our Take

Comment sections on news sites have historically been an under-observed OSINT surface, as each site typically needed to be monitored individually. Open Measures’ Disqus coverage exposes much more of this hidden surface, making it searchable alongside nearly 30 other alternative platform sources.

Heading into the midterms, election officials have reported facing increasing threats with fewer federal resources to defend against them than in recent years. Open Measures will continue to support threat intelligence teams defending our elections, providing access to early threat indicators from the fringes before they materialize.

To better understand how your team might use Disqus data in your work, feel free to book a demo or subscribe to our newsletter for investigations conducted with Disqus data.

A new article and radio segment from NPR’s All Things Considered traces how Andrew Tate spent years cultivating relationships with Trump-world figures and the broader MAGA movement — and how those ties are now being strained as Tate and his brother Tristan fight extradition to the U.K. on criminal charges including rape and human trafficking.

NPR turned to Open Measures senior researcher Jared Holt to explain why Tate became such an appealing figure to Republican politicians and influencers in the first place, and what his current predicament says about the durability of those alliances:

“The Tate brothers have friends on Capitol Hill,” Jared Holt, senior researcher at Open Measures, tells NPR. “There’s people in the Trump administration that have cozied up to them before, people in the MAGA movement that have cozied up to them before, certainly.”

Holt also pointed to the transactional logic behind that support:

To Trump and other politicians, Holt says, Tate is a compelling figure because he offers access to a massive and energetic fanbase dominated by a desirable demographic: young men. And, Holt adds, some of the views Tate expresses align with Trump and his camp.

“It’s like, here’s a couple guys who are promoting the kind of ideals of hypermasculinity and machismo that we would like to promote,” Holt says. “And they seem politically friendly, politically supportive of us. And they have this massive online audience.”

Check out the full article and listen to the segment, here:

NPR

4chan, an imageboard platform where users are anonymous, opened its “Adult Requests” board (also referred to by its URL suffix, “r”) in 2004 as a venue for its users to discuss pornography and request help identifying the sources of sexually explicit images they shared. But in recent years, users on the board grew almost singularly focused on producing and trading synthetic, non-consensual intimate imagery (NCII) created by self-described “wizards” using generative artificial intelligence software.

Subscribe now

Earlier this year, Open Measures published new research exposing the severity of abuse taking place on Adult Requests as the forum was becoming one of the most-active online venues for synthetic NCII – colloquially known as “deepfake porn.” Our findings drove broader recognition of the imageboard’s as a major node in the online ecosystem surrounding NCII abuse and raised questions about how laws against such content could be enforced on smaller platforms like 4chan.

4chan’s site administrators quietly shut down Adult Requests on May 21. Since then, its URL has returned an error page reading: “File not found.” As far as we’re aware, 4chan staff have not publicly explained why they closed Adult Requests or said whether they ever intend to reopen the board.

Adult Requests went dark the same day WIRED published an article highlighting the prevalence of AI-generated nude imagery on the board, and two days after the TAKE IT DOWN Act took effect in the United States – where 4chan is based – criminalizing the publication of NCII and imposing financial penalties on platforms that fail to remove it within 48 hours of receiving a takedown request.

‘It’s Only Fair’: 4chan Users Question Removal of ‘Adult Requests’ and Seek Refuge on Other Boards

The sudden disappearance of Adult Requests has gone mostly unnoticed by 4chan users, but some have shared posts questioning the board’s removal, expressing their desire to migrate their activities onto the site’s other boards.

On May 23, two days after Adult Request vanished, a user posted a thread on the site’s “Very Important Posts” (“vip”) board, where only users who pay for an annual “4chan Pass” can post, asking what happened. The thread only elicited a handful of replies, including a June 17 post that read, in part:

4chan follows US law, and legislation has made AI pornography edits (which was like 90%) of /r/ illegal. There was also a news article highlighting this. And it was taken down shortly after.

On the site’s “Adult GIF” (“gif”) board, which is dedicated to sexually explicit animated images and short videos, users expressed confusion about where the community that frequented Adult Requests had gone. A July 7 post on the Adult GIF board read:

Adult requests board used to be good with new content. No idea where everyone went now

Another post, shared on July 8, read:

kinda unrelated but, since this is an AI thread: what the ever loving fuck happened to the adult requests board? Was there any legal problems with it? Last I checked there were a lot of guys doing threads of AIs nudes of just about any chick they had a photo of. Was [its removal] because of it? Have these threads moved to another board/site?

Another post to Adult GIF, shared on July 9, argued that 4chan users should be able to solicit synthetic NCII on other boards since Adult Requests was unavailable:

Due to the fact that /r/ is gone, I feel like it’s only fair that we’re allowed to make requests on other boards, since we don’t have a dedicated Adult Requests board anymore.

On June 2, a user posting on 4chan’s “Worksafe Requests” (“wsr”) board – a non-explicit version of Adult Requests – said that requests for AI deepfakes should be directed to the site’s “Random” (“b”) board. The Random board has long been saturated with pornography and 4chan lists it among the “NSFW” (not safe for work) boards in its site directory.

Searching for Adult Requests’ ‘Wizards’ on Other Boards

In its final years, most activity on Adult Requests revolved around threads where users submitted images of other individuals (mostly women and girls) and requested synthetic NCII that depicted them. The board’s users adoringly referred to those who fulfilled requests as “wizards.”

That call-and-response dynamic effectively systematized the production of synthetic NCII on Adult Requests, setting it apart from other 4chan boards we observed that contained some similar material.

To assess whether this style of exchange migrated to another part of 4chan after Adult Requests closed on May 21, Open Measures searched for posts that mentioned a variation of “wizard” and at least one variation of a word signaling a request (like “please” or “help”) or a term associated with AI deepfakes (like “nudify”). We limited our search to 4chan’s 18 NSFW boards.

More than 1,100 posts shared on 4chan’s NSFW boards since Adult Requests closed matched our search query. Using our Activity tool to count how many appeared on each of the 18 boards, we saw that more than half appeared on Random (“b”) – a board that is ostensibly open to all kinds of content, but which is mostly saturated with pornography.

Requests for Synthetic NCII on 4chan’s ‘Random’ and ‘Cams & Meetups’ Boards

We used our platform’s Discover tool to take a closer look at the posts our search identified on Random, and found hundreds of posts that appeared to mirror the sorts of requests we previously observed on Adult Requests, as seen in this July 27 post to the board:

Can any wiz help me nudify this whore? She’s got big fat titties that I’ve been itching to see like you wouldn’t believe.

The second-highest concentration of posts matching our query appeared on 4chan’s “Cams & Meetups” (“soc”) board, which serves as a venue for users to seek in-person and online connections related to sex. Similar to posts we identified on the Random board, we saw users on Cams & Meetups seeking to connect with “wizards” who could produce synthetic NCII. We also identified posts from self-identified “wizards” offering to create such material for others, as in this July 28 post to the board:

Comfyui ai wizard. Send a pic of your mom, sister, daughter 18+ and a clip for a face swap.

Many of the posts matching our query on other NSFW boards were false positives, reflecting the fact that communities on 4chan assign non-NCII related meaning to the term “wizard.”

4chan Moderators May Have Increased Enforcement Against Synthetic NCII

Threads on 4chan are automatically deleted to make way for new ones, meaning content on the site is inherently temporary – and especially so on boards that see higher volumes of activity. But in several instances during our research, we identified requests for synthetic NCII in active threads on the site that suddenly became unavailable – sometimes minutes after the requesting posts were made.

Using our platform’s Timeline tool to compare the number of posts matching our search query on Adult Requests, Random, and Cams & Meetups since Feb. 5, we did not see a meaningful shift in activity on Random or Cams & Meetups after the removal of Adult Requests. In fact, the daily volume of posts requesting synthetic NCII from “wizards” on Random and Cams & Meetups actually appeared to decrease, aside from a few days of isolated activity spikes.

This might suggest that 4chan’s moderators are taking down threads requesting synthetic NCII at a higher rate than before they closed Adult Requests, signaling a possible shift in the site’s approach to the issue.

Our Take

Adult Requests was just one of a growing number of online venues for requesting, producing, and trading AI-generated NCII. As regulators around the world enact laws criminalizing the publication of NCII, it appears 4chan may be shifting its approach to policing such content.

While our findings signal that at least some amount of the abuse Adult Request became notable for has also appeared on other 4chan boards, they do not suggest that users of the board have simply relocated to another spot on the site. It’s likely that former Adult Request users, including the “wizards,” have migrated to communities beyond 4chan. Open Measures will continue looking for signals of where they may be headed next.

Additionally, if you can help us understand what might be going on with this keffiyeh-wrapped Cybertruck we saw in the city, please reach out. We can’t stop thinking about it.

Anyway… here’s a look back at the research we published in July.

What We’re Reading:

• The MAGA Media Machine Is Fracturing (The New York Times)

• Hostility Against Local Officials Is Continuing at Elevated Levels in 2026, Disproportionately Impacting Women, Minority, and New Officeholders (Bridging Divides Initiative)

• Instant Access to Trump’s Thoughts Now Costs $100,000 a Month (Mother Jones)

• Google Earth’s New AI Lets Anyone Fabricate Completely Bullshit Satellite Images (404 Media)

Before you go…

• Recent news reports about MAGA figures (including a teleprompter operator) placing wagers on “prediction market” platforms has us thinking about this piece we ran in March.

Subscribe now

Open Measures found that users on Soyjak Party, an anonymous imageboard known for its proximity to extremist and violence-obsessed online subcultures, have discussed the development of at least three AI-powered doxing tools since October 2025. The tools work by performing automated searches across online databases, including those containing breached account information, for the names of individuals that their users submit and compiling any information they find into “dox packages” for users to review.

The tools we found were still online and operational at the time of writing. To minimize their reach, Open Measures has opted not to name them in this article and to redact URLs that appeared in the posts that appear quoted throughout.

Posts discussing these tools first appeared in Soyjak Party’s “/raid/” board, which serves as a dedicated venue for users to solicit others’ help in doxing, harassing, and threatening individuals and entities they identify in their posts. The board’s users disproportionately target individuals and entities associated with minority communities – like Jewish social media influencers and transgender graphic artists – and the threads where they discuss their efforts reliably contain hateful and violent rhetoric about their subjects.

On Oct. 13, 2025, a Soyjak Party user shared a post on the board announcing the release of a specialized doxing tool that used AI to query a third-party database of compromised web account data. In the post, which contained a litany of slurs against minority groups, the user said they built the tool to enable batch searching, source filtering, IP geolocation, DDOS protection, and more.

The post went on to describe an automated browser-based tool for querying breach databases to surface leaked information or credentials for a target individual. The post’s anonymous author explained that they designed the tool to work off a pre-existing API and added functions that enabled batch searching, source filtering, IP geolocation, and other functionalities to assist in doxing efforts.

The post author asked other Soyjak Party users to share “feedback on what to improve” and to use the tool “sparingly” to avoid being noticed by the operators of the third-party dataset it was built on. The board’s users obliged, replying with dozens of posts showing them testing the tool and suggesting improvements, many of which appeared to have been incorporated by the tool’s anonymous developer.

On Nov. 2, 2025, the tool’s creator appeared to spam Soyjak Party’s “/soy/” board, the site’s main discussion board, with posts encouraging its use. The following message appeared 115 times across 31 unique threads we identified:

[TOOL NAME REDACTED] dev here. I am DEFINITELY NOT datamining all requests to the site and sending them to mossad

fr doe you can check the source code yourself if you want and even run locally on your machine. It’s just a wrapper for the [URL REDACTED] API so if you trust that site you can trust [TOOL NAME REDACTED]

Months later, a new AI-powered doxing tool appeared on Soyjak Party. In a post to the /raid/ board on March 6, 2026, a user debuted a “full autonomous, and FREE doxxing AI agent” that was able to “fully dox some people in minutes, with little human intervention.” In a post made seven minutes later, the same tool was also promoted on the site’s /soy/ board:

fully autonomous AI based doxxing is now a thing

what can I add to the prompt to make it act more like a ‘teen

The post included a screenshot of the tool, displaying a system prompt instructing an LLM to surface identifying information on user-provided targets by taking on the role of a “professional private investigator.” The author of the original post claimed in a reply that they had used the tool to produce a complete dox profile on a target “in one prompt” – demonstrating the new tool’s significant capabilities.

Open Measures determined through additional searches that this particular tool was an AI-powered rebrand of an earlier, since-defunct tool that came online in June 2025, per its domain records. (The earliest mention of the now-defunct tool we identified on Soyjak Party appeared in a post shared on the /raid/ board on Sept. 17, 2025).

In the hours that followed, Soyjak Party users shared their excitement about the tool and offered detailed suggestions for improving its user interface and search functionality, as seen in the following replies to the March 6 post:

use rag [retrieval-augmented generation] and give it a pdf of soyspeak. tell it to imitate the slang found in the document

be wary though, ai loves to hallucinate. btw what model are you using? this is definitely gonna get taken down eventually, so make an app version that can use apis to talk to [URL REDACTED] servers

I would suggest an interface improvement. It’s not clear from the landing page that you are sending a prompt to an AI, not conducting a search of database breaches yourself

Our researchers also observed posts that included full dox reports on four private individuals that users said were produced using the tool, all of which were still live on the imageboard at the time of writing.

We also identified a handful of posts on Kiwi Farms – another online forum known for spawning coordinated harassment campaigns – and in a Discord channel that referenced the tools we identified, showing they are also being used by malevolent communities beyond Soyjak Party.

LLM-powered doxing tools represent a major escalation in the online threat landscape. Malicious doxing often intends to intimidate its targets, and the information it turns up can intensify harassment campaigns and drive serious threats like swatting attacks.

When we published our whitepaper on emerging AI threats in May 2026, we noted that agentic tools were advancing quickly enough that tools for automating coordinated harassment campaigns could soon be built and commoditized. The tools our researchers observed on Soyjak Party show this threat is no longer theoretical.

Open Measures will continue to monitor and report on new developments related to online doxing campaigns. Organizations can contact our research team for additional information.

A new article from WIRED examines Laura Loomer's abrupt pivot to championing Ukraine — a country the far-right social media personality previously claimed was "full of Nazi apologists." The reversal rattled some of her own online supporters and raised eyebrows across Trump's online base, irritating existing fractures that have emerged in MAGA media over the last year.

WIRED featured insight from Open Measures senior researcher Jared Holt, who has followed Loomer’s rise in MAGA media for more than a decade. He offered context for understanding her sudden turnabout on Ukraine:

“The primary driver of Loomer’s political posturing is her unwavering adoration of Trump, not a rigid set of ideological beliefs,” Jared Holt, senior researcher at Open Measures, tells WIRED. “While she maintains some core attitudes, including anti-Muslim and anti-immigrant beliefs, she has repeatedly shown a willingness to shift her positions if she believes it will help the president. Trump calls the tune, and Loomer follows his lead.”

Check out the full article, here:

WIRED

Subscribe now

Subscribe now

Folarin Balogun received a straight red card in the United States’ match against Bosnia and Herzegovina on July 1 after referees reviewed slow-motion footage and determined he committed a “serious foul.” The penalty carried a one-game suspension for Balogun, meaning he would not be allowed to play for the U.S. team’s round-of-16 match against Belgium on July 6.

Four days later, on July 5, tournament officials overturned the suspension and confirmed Balogun would be eligible to play against Belgium. Subsequent news reports revealed that the highly unusual decision came after President Donald Trump personally intervened in the matter, asking FIFA president Gianni Infantino to have officials reconsider Balogun’s suspension.

The ruling was met with outcry across the international soccer community, even after Belgium eliminated the United States with a 4-1 victory, resurfacing longstanding concerns over the FIFA president’s extraordinary efforts to satiate Trump ahead of the 2026 World Cup and FIFA officials’ history of corruption. Some have even called for outside investigations into Infantino’s role in reversing the suspension.

Alternative Platform Activity After Balogun’s Reversed Suspension

Open Measures sought to assess how FIFA’s decision to reverse Balogun’s suspension impacted online discussion of the 2026 World Cup and FIFA officials on platforms we monitor ahead of the final match on July 19. While the FIFA World Cup draws a global audience of fans who speak a variety of languages, we limited our analysis to English-language posts, which we surfaced using the following search query:

(FIFA OR “World Cup”) AND (corrupt* OR rigg* OR brib* OR fix* OR scandal* OR fraud* OR “match-fixing” OR “predetermined”)

Our query surfaced posts on nearly every platform we monitor, but the highest numbers of results appeared on Bluesky, Fediverse platforms, Disqus, 4chan, and Telegram. Together, users on those five platforms shared more than 38,000 posts doubting the integrity of FIFA and the World Cup since the tournament began on June 11.

Using our platform’s Timeline tool, we visualized those 38,000 posts since June 11 by daily volume across all five platforms mentioned above. Viewed over time, we were able to observe an activity surge across platforms that followed news reports of Trump’s involvement in the decision to overturn Balogun’s suspension.

Shifting Online Narratives Ahead of 2026 World Cup Final

We used Research Assistant to summarize prominent narratives across the posts we identified between July 8 – two days after the US match against Belgium – and July 15, the date of our analysis. As the discussion about Balogun’s reinstatement controversy subsided, we saw users on platforms we analyzed extend their claims of match-rigging and corruption onto subsequent matches.

As the World Cup moved on, the users we reviewed expressed their beliefs that FIFA was rigging matches to favor Argentina, citing specific video assistant referee decisions, favorable draws, and on-field penalty rulings. Multiple posts referenced the 2015 indictment of FIFA officials on corruption charges.

On the platforms we reviewed, some users also commented that online accusations of match-rigging in the World Cup seemed more pervasive in 2026 than they had in years prior.

What We’re Watching

The World Cup, of course.

FIFA’s unusual decision to reverse the suspension of a United States player after Trump asked the organization’s president to intervene breathed life into longstanding skepticism about the integrity of the World Cup and of FIFA’s leadership. Open Measures will continue to monitor for similar narratives as they evolve across platforms.