Monday , 31 March 2025
As part of ongoing efforts to monitor and expose coordinated defamation and hate campaigns against journalists and media outlets, the Samir Kassir Foundation (SKF) has conducted an investigation into a recent digital smear campaign targeting Megaphone and Daraj Media, two of Lebanon's leading independent digital media platforms.
Context
On Wednesday, March 26, 2025, Lebanon’s Public Prosecutor, Judge Jamal Al-Hajjar, referred a complaint filed by three lawyers against Daraj Media and Megaphone to the Beirut Public Prosecutor's Office of Appeal for investigation. The complaint accuses the two platforms of “undermining the state’s financial standing, eroding trust in the national currency, inciting bank withdrawals, and funding media campaigns intended to harm Lebanon’s economy.”
The complainants—lawyers Eli Shahla, Joseph Zaidan, and Georges Mousalli—further allege that these media outlets are involved in a “conspiracy aimed at weakening national sentiment and trust in the state,” accusing them additionally of receiving “dubious foreign funding.”
This legal action is widely interpreted as part of a broader political, legal, and media-driven campaign targeting outlets critical of certain candidates vying for the position of Governor of Lebanon’s Central Bank, as well as those scrutinizing the state’s financial decisions and appointments. Multiple media and human rights organizations have reported that specific banking interests are financing this coordinated campaign, with the apparent goal of silencing critical voices.
In response, Daraj rejected the allegations as “fabricated, malicious, and legally baseless,” dismissing the accusations outright as a “joke.” Daraj also criticized Lebanese channel MTV’s coverage, arguing that it misleadingly portrays the investigation as a triumph over investigative journalists, who have exposed bank owners accused of withholding citizens’ deposits while facilitating financial transfers for politicians and influential figures.
The case unfolds within a broader national debate on media freedom and judicial independence. Over fifty human rights and media organizations have publicly described the complaint as part of a systematic disinformation effort orchestrated by influential bankers and political figures aiming to evade accountability.
Judicial sources cited by MTV characterized the case as a critical “test of the independence of Lebanon’s judiciary.” Meanwhile, Daraj and Megaphone await the investigation’s outcome from the Beirut Public Prosecutor’s Office of Appeal, headed by Judge Ziad Abu Haidar, and remain prepared to present evidence refuting all allegations.
Methodology
We analyzed posts mentioning Megaphone and Daraj on X (formerly Twitter) dated March 26, 2025, collecting data from the first 40 accounts whose posts appeared in the “latest” category.
Closer examination revealed these accounts had actively disseminated the following hashtags between March 24 and March 27, 2025:
From March 24-27, we observed an alarming pattern across nearly all accounts using these hashtags. Due to limited resources and the urgency of the reporting process, we restricted our sample to 40 accounts. We acknowledge and thank Mr. Hasan Shami, a Lebanon-based data analyst, whose efforts significantly assisted in collecting this sample and reporting suspicious activities to SKF.
Findings
An overwhelming majority of these accounts (39 of 40) were initially created between 2011 and 2016, while the remaining one was created in 2018. Of particular interest, 48 of the analyzed 50 accounts began disseminating content in March 2025—the earliest on March 9 (18 days prior), and the latest on March 21 (8 days prior). Prior to this sudden burst of activity, all 48 accounts had been dormant, without content postings, for periods ranging from 9 to 14 years. Once active, they consistently posted politically charged content with strikingly similar or identical wording.
Suspicion increased further when examining the historical content of the remaining two accounts: one account had exclusively posted and reposted five Portuguese-language posts back in 2013, while the other had reposted content originally posted by seemingly Saudi-based accounts, also dating back to 2013.
The vast majority of the examined accounts had approximately 500 followers; specifically, 49 out of 50 accounts ranged between 470 and 530 followers. Only one account in the sample had just five followers. However, follower count alone should not be considered representative of all accounts spreading these hashtags. Still, the other characteristics outlined previously appear consistent across nearly all accounts using these hashtags, even beyond our selected sample.
Before continuing further with our investigation, we provide below examples of the disseminated content that raised concerns about potential coordinated activity.
We have not yet reached the most concerning findings.
Beyond noting that these accounts disseminate posts in temporal clusters—posting heavily within specific intervals, thus strongly suggesting deliberate efforts to amplify certain narratives—and that their linguistic and thematic alignment indicates premeditated coordination, we have also uncovered evidence suggesting these users are not who they claim to be.
Specifically, we successfully identified and documented at least 13 accounts from our sample using profile pictures previously associated with other accounts—many of which do not appear Lebanese. Some of these images are likely AI-generated, while others have been recycled from unrelated users on X (formerly Twitter) or other platforms. Additionally, we suspect similar deceptive behavior in at least 10 more accounts within our sample. For the remaining accounts, although we found no explicit proof of image recycling, suspicion remains high regarding the use of generative AI for profile pictures.
Evidence
Three accounts @sararizkk, @rrananazer, and @Yasminewehbe1 didn’t even bother to change their common displayed picture (Evidence displayed below).
More evidence.
Lastly, the account operating under the name "Nancy Atallah," whose participation in the coordinated dissemination of content against Megaphone, Daraj, and Kulluna Irada we have previously confirmed, uses a profile picture identical to one associated with a LinkedIn account based in France (see evidence below).
More cross-platform detection:
Update (March 27, 2025), following the appointment of Governor Karim Souaid:
Continuing our investigation, we have documented additional evidence showing mimetic posts celebrating Karim Souaid’s appointment. These posts further substantiate Megaphone and Daraj Media’s assertions that the smear campaign was orchestrated as part of a broader strategy designed to influence and pressure authorities into appointing a specific candidate as Governor of Lebanon’s Central Bank.
Conclusion
The evidence collected strongly indicates that the digital campaign targeting Megaphone and Daraj Media was carefully coordinated, employing deceptive practices designed to artificially amplify specific political narratives. The accounts involved exhibited clear patterns: synchronized posting timelines, strikingly similar content and language, and the suspicious reuse of profile images, some likely AI-generated or appropriated from unrelated online profiles. Moreover, this orchestrated effort aligns closely with messaging recently disseminated by certain Lebanese media outlets, notably MTV and others funded by influential banking interests.
While the exact identities of those behind this campaign cannot be conclusively established from publicly available data alone, the circumstantial evidence points toward deliberate manipulation aimed at discrediting critical independent media platforms and influencing public debate, particularly concerning Lebanon’s financial governance.
SKF strongly recommends further investigation into these accounts, including possible legal avenues to uncover the sources of this coordinated campaign. Collaboration with relevant authorities, digital platforms, and civil society partners will be essential to effectively counter disinformation and ensure accountability.
This report is published with the support of the Norwegian Ministry of Foreign Affairs. The contents of the report are the sole responsibility of the authors and do not necessarily reflect the views of the Norwegian Ministry of Foreign Affairs.
