BANNER: A damaged press vehicle at the site of an Israeli strike that killed three journalists and wounded several others as they slept in guesthouses used by media in Hasbaya in southern Lebanon, October 25, 2024. (Source: Reuters)

This piece is a collaboration between the DFRLab and the Samir Kassir Foundation.

One year ago this month, pro-Hezbollah accounts orchestrated a likely coordinated smear campaign to discredit four Lebanese journalists: Dima Sadek, Layal Alekhtiar, Rami Naim, Nadim Koteich, and head of the Lebanese Forces Media and Communication Authority Charles Jabbour. The November 2023 campaign directly attacked the media workers by mass replying to their X accounts, often using similar graphics to portray them as traitors and partners of Israel. It was launched after an Israeli air attack in south Lebanon that killed four civilians, including three children. It sought to tarnish the journalists’ reputations by claiming they shared the blame for the deaths. Journalist Dima Sadek, specifically, received the largest share of attacks, along with being the target of gender-based violence that included misogynistic slurs and sexually explicit replies. The journalist also received at least one death threat during the harassment campaign.

Following the two-year presidential vacuum in Lebanon, preceded by Prime Minister Najib Mikati’s failure to form a new government after the 2022 Lebanese parliamentary elections, the country remains mired in financial hardship, political paralysis, and public anguish. Lebanese politicians’ persistent failure to meet local and international obligations underscores an unwavering refusal to compromise on personal interests or dismantle entrenched power structures. Negotiations for a comprehensive and consensual resolution to these crises remain opaque as politicians continue to deploy hate campaigns against vulnerable segments of society, such as activists, journalists, and marginalized groups.

Beginning on October 8, 2023, Israel and Hezbollah engaged in strikes across Lebanon’s southern and Israel’s northern border. In September 2024, the conflict escalated as Israel began an aerial campaign in Lebanon, and Hezbollah responded by striking deeper into Israeli territory. Hezbollah’s prominence and ability to influence online narratives increased as a consequence of the war, particularly among its supporter base and pro-resistance leftist groups. The group used its influence as a weapon to demonize its local political rivals and further the interests of its members and allies.

In the summer of 2023, Lebanon experienced a severe crackdown on freedom of speech, particularly targeting LGBTQAI+ communities, erupting in a violent attack on the March of Liberties in Beirut on September 30, 2023. The Samir Kassir Foundation (SKF) monitored these events and noted a pattern of politicians sharing doctored media to incite public outrage and violence against artists and journalists. These included attacks on comedian Nour Hajjar and Murr TV.

SKF’s findings revealed a recurring pattern used by Lebanese politicians to stifle public debate and reinforce its grip on power. This pattern typically begins with the leaking of doctored or out-of-context clips or interviews on social media, which are then framed as deliberate Western-backed affronts to socio-political norms and values. This, in turn, incites public denunciations and provokes on-the-ground movements that can escalate into violent attacks and security threats against those who challenge the prevailing narrative. Religious figures and institutions can further exacerbate the situation by initiating legal action against the targeted individuals and pressuring the judiciary and security forces to enforce disciplinary measures. Consequently, violence against the victims and their supporters, including alternative political groups, civil society organizations, and human rights organizations, becomes normalized amid extreme intimidation tactics.

Each month, SKF analyzes a case involving violations of freedom of expression in Lebanon and monitors ensuing online discourse to gauge responses and support for freedom of expression. SKF found that public sentiment is generally more tolerant of diverse opinions and constructive debate when the above-mentioned intimidation tactics are not used. However, in cases where the tactics are utilized, SKF found that instances of hate speech rise significantly. SKF’s previous work also uncovered the intersection of parties like Hezbollah and factions endorsing political Islam in several hate campaigns and attacks against freedom of expression. This intersection is a critical factor in understanding the hate speech campaign examined in this report.

On November 5, 2023, Israel struck a car carrying a family in southern Lebanon, killing three girls aged between ten and fourteen and their grandmother. In the aftermath of the attack, an online campaign was launched against the five identified media workers, attempting to indirectly implicate them in the attack. The campaign relied on a set of similar graphics that included a picture of each individual with a red Star of David on their face, blood stains, and text that said, شركاء قتلة الأطفال (“Accomplices of children killers”); the graphics intended to depict the journalists as allies of Israel. The attacks followed the same pattern in which the accounts used the graphics to reply to posts made by the media workers on X (the platform formerly known as Twitter).

Screencaps of three replies using the campaign’s graphics published minutes and seconds apart on November 7, 2023, by different accounts, including two now-suspended accounts. (Sources: @abohadimhamed, left; @Ali385875451488, center; @SamarJalloul4, right)

While most of the attacks came through direct replies to their tweets, some of the identified accounts also engaged users with large followings who posted in defense of the media workers or replied to other accounts that attacked them. For example, on November 9, 2023, a post by the account @allouush, with more than 80,000 followers, attacked Sadek and was viewed more than 40,000 times, with many replies containing the graphic featuring the journalist’s image.

According to data gathered from the social media monitoring tool Meltwater Explore, between November 5 and November 10, 2023, the accounts of Sadek, Alekhtiar, Naim, Koteich, and Jabbour received more than 40,000 combined replies and mentions on X. The DFRLab and SKF filtered this dataset to show only replies containing links and images. This filtering enabled researchers to determine the number of replies that included the campaign’s graphics.

The data gathered from Meltwater Explore was also refined to exclude a limited number of accounts that engaged in the campaign by condemning the attacks against the journalists and using the graphics to highlight the negative aspects of the campaign; such accounts were not labeled as part of the attacks. This refinement is crucial as false positives are an inherent challenge when utilizing automated techniques to collect data.

While all the targets received similar attacks using the graphics, the number of attacks in replies to their posts varied. Sadek received the greatest number of replies during the campaign, with at least 837 replies, followed by Naim, who received over 500 replies, and Alekhtiar, with over 400 replies. Koteich and Jabbour both received less than 100 replies.

A flourish table shows the number of replies each figure received that contained the campaign’s graphics. (Sources: DFRLab and SK Eyes via Flourish)

In addition to receiving the greatest number of attacks, Sadek also received many replies that included a low-quality picture of her and the former US Ambassador to Lebanon, Dorothy Shea. Sadek previously commented on the photo with Shea. Accounts circulated the picture in an attempt to link Sadek to the US administration, intended to smear her as an agent working against the interests of Lebanon. Notably, one of the accounts that posted the photo in reply to Sadek was journalist Fatima Ftouni from the pro-Iran Al Mayadeen news outlet. The reply received almost 60,000 views.

Screencaps of four replies to Sadek by different accounts using the same picture of the journalist with the former US Ambassador to Lebanon Dorothy Shea. (Sources, left to right: @EqbzyveETfzSPg0;  @ftounifatima; @ad_ahm3; @EmAli116)

The attacks against the journalists and Jabbour appear to have started on the same day during similar times. According to Meltwater Explore, one of the first replies including the campaign’s graphic was sent to Sadek at 9:25 PM local time on November 5, 2023, by @Sr7578281268804, a two-day-old account at the time. One minute later, the account replied to the same post by Sadek but used the campaign’s graphic for Koteich. The account’s very first X post was a reply to Sadek that included an insult. The second journalist who received a reply with the campaign’s graphic was Naim, one minute after Sadek, at 9:36 PM, by the now unavailable account @dana_ayyoub. This account also made similar replies to Jabbour and Koteich one minute later.

One of the first accounts to reply to multiple accounts with the campaign’s graphics was @aflaton13812042. The account’s first reply was directed at Sadek and only included the graphic, sent at 9:41 PM on November 5, 2023. One minute later, the account posted another reply to Sadek, calling the journalist “the biggest Zionist.” One minute later, the campaign’s graphic for Jabbour was used to reply to one of Jabbour’s posts while referring to him as a “Zionist by excellence.” Two minutes after the reply to Jabbour, the account posted the campaign’s graphic in a reply to Naim, calling him a “Zionist.”

Screencaps of three replies from the same account that were sent minutes apart. (Sources: @aflaton13812042, left; @aflaton13812042, center; @aflaton13812042, right)

Many of the replies the media workers received were posted minutes and often seconds apart. This was especially true for the journalists who received the most replies: Sadek, Naim, and Alekhtiar. For example, on November 8, Naim received seventeen replies between 11:16 AM and 11:56 AM. Three were posted in the same minute at 11:38 AM by different accounts. From 12:00 PM to 12:57 PM, Naim received thirteen replies, three replies were posted in the same minute at 12:57 PM by three different accounts.

Screencaps of three replies by three different accounts using the same graphic were posted within the same minute in replies to the same tweet by Naim. (Sources: left to right: @AbouKam86090651; @qiyam110; @zein313zein313)

The pattern of high posting rates was consistent on November 6, 7, and 9 and was most present in replies to Sadek’s posts.

Screencaps of two replies by two different accounts, sharing the same graphic in the same minute in replies to different tweets by Sadek. (Source: @Raphael66988593, left, @hadi81mansour, right)

Many accounts harassed the journalists via bulk replies featuring the campaign’s graphics, with certain accounts spamming more than one journalist. For example, the account @fadelmoussa99 replied to Alekhtiar with the graphic depicting her a total of thirty-seven times, with almost all the replies posted in less than ten minutes on November 10. The same account replied to Koteich thirty-five times in less than ten minutes on November 8. In another example, on November 6, @Adam_Abou_Hamad posted twenty replies to Naim using the campaign’s graphic; most of the replies were posted within five minutes.

Screencaps of four replies from the same account, seconds apart, to the same post by Alekhtiar. (Sources, left to right: @fadelmoussa99;  @fadelmoussa99; @fadelmoussa99; @fadelmoussa99)

Analyzing replies also revealed the use of gender-based violence, specifically against Sadek and, in one case, against Koteich’s wife, in which sexist slurs and graphics were posted. In addition, Sadek received one reply that included a direct death threat saying that her days were numbered. In the case of gender-based violence against Sadek, the DFRLab and SKF counted at least fifty replies that used similar pictures of the journalist alongside misogynistic slurs and sexual insinuations. One account maliciously used an altered image of Sadek by editing her face onto a sexually explicit image and sharing it in replies to her posts. The same account used the same tactic in replies to Koteich but targeted the journalist’s wife with a similarly altered image. The DFRLab and SKF chose not to republish the images from these attacks to protect the victims.

Meltwater Explore queries revealed that different types of accounts took part in the campaign using replies, likes, reposts, and original posts, with the majority showing indicators of being pro-Hezbollah through their profiles and promoted posts.

Many accounts shared content supportive of Hezbollah or the Amal Movement, a Lebanese political party and former militia that allies with Hezbollah. Pro-Hezbollah accounts often indicate their support for the group via indicators such as yellow hearts in their bios and display names, while Amal supporters tend to use green heart emojis. Other indicators include posting pictures of prominent political figures affiliated with Hezbollah or the Iranian regime.

Our review showed many accounts used avatars and header photos of Hezbollah and Iranian leaders, such as Hezbollah’s late secretary-general Hassan Nasrallah, Supreme Leader of Iran Ali Khamenei, former Supreme Leader of Iran Ruhollah Khomeini, late Iranian General Qasem Soleimani, and former Hezbollah military leader Imad Mughniyeh.

Screencaps of four accounts using pictures of Nasrallah. One account used a picture of Nasrallah with Soleimani (top right), and another included a picture of Soleimani as the header photo (bottom left). One account (bottom right) used Khomeini’s picture as a header photo. (Source: @HoussamAlkhesh1, top left; @abdallah3089,top  right; @YaghiMirna, bottom left; @ZeinabHusen, bottom right)

Several accounts used seemingly auto-generated alphanumeric characters for their handles. For example, accounts such as @KarramLeil90368, @aflaton13812042, and @Albert938671691 used a combination of letters and words seemingly auto-generated by X. While alphanumeric handles do not confirm suspicious activities, accounts created to participate in such campaigns and activities often use handles such as this.

Though most accounts exhibited a range of posting activities on X, a handful of accounts raised additional suspicions given their activity was limited to only a few posts, the majority of which were replies to the journalists, suggesting that these accounts may have been used specifically to take part in the campaign. For example, the accounts @7medIl70654 and @kaddouh_ali each posted a single tweet during the examination period, a reply to Sadek using the campaign’s visuals. Similarly, the account @story60555, created in November 2023, had only four posts, all of which were replies to Sadek.

In addition to pro-Hezbollah accounts that spread the campaign’s visuals through replies, reposts, and likes, other accounts promoted the campaign through original posts. These accounts can be considered key spreaders and include influencers or politically connected individuals who amplified the campaign, taking advantage of their large following and status to create original content and commentary that drove widespread engagement and shaped the narrative. An example of this is the now-suspended account belonging to the Head of the Ghobeiry Municipality Maan Khalil. While Ghobeiry is associated with an area generally believed to be under Hezbollah control, the activity indicates that an elected civil servant supported, if not enabled, the vilification of local journalists. For instance, on November 9, 2023, Khalil replied to a post by Alekhtiar using the campaign’s graphic. He also published an original post two days later with a picture that included the faces of several politicians and media personalities, including the five media workers, calling them “the abnormal voices.”

Screencaps showing the participation of Maan Khalil, head of the Ghobeiry Municipality Council, in attacks against the media workers and others through an original post (left) and reply to journalist Alekhtiar using the campaign’s graphic (right). (Source:  @MaanKhalil71, left,  @MaanKhalil71, right)

The campaign investigated in this report is not an isolated incident but rather part of a broader pattern of intimidation and violence, a pattern that has been utilized repeatedly by those who seek to control narratives, silence dissent, and manipulate public perception. While our investigation focused on the period in which the attacks appeared most prevalent, we observed that the campaign continued at a reduced level beyond the research period.   

This investigation underscores the escalating risks to journalists amid the ongoing conflict in Gaza, affecting not only those within the besieged area, where over 100 journalists have been killed, but also those in neighboring areas. As of October 25, 2024, eight journalists and media personnel in Lebanon had lost their lives in Israeli airstrikes.

Editor’s note: Ali Chenrose is a pen name used by the DFRLab in certain circumstances for safety reasons.

Jad Hani is a Media Monitoring Researcher at the Samir Kassir Foundation focusing on sentiment analysis of social media interactions and hate speech campaigns against journalists, artists, and activists.

Jad Safwan is a Research Coordinator at the Samir Kassir Foundation. His research blends quantitative and qualitative approaches, focusing on media development and social media monitoring. Drawing on his expertise in machine learning and data visualization, he has worked extensively on sentiment analysis and digital transformation projects. He is currently pursuing an MSc in Business Analytics at the American University of Beirut.

Ali Chenrose, Jad Hani, and Jad Safwan, “Pro-Hezbollah accounts orchestrated digital smear campaign against Lebanese journalists,” Digital Forensic Research Lab (DFRLab) and the Samir Kassir Foundation, November 14, 2024, https://dfrlab.org/2024/11/14/pro-hezbollah-accounts-orchestrated-digital-smear-campaign-against-lebanese-journalists.