More than half a billion paid advertising impressions, millions of dollars in suspected influence operations, fabricated social media identities and a coordinated campaign portraying Muslims as a threat to Western civilisation. Behind it all, investigators have uncovered digital traces pointing towards Israel, but the identity of those financing the operation remains a mystery.
An extensive investigation has exposed what researchers describe as one of the largest covert digital influence operations targeting Qatar, Muslim communities and immigrants across Western countries.
Operating between 2023 and 2026, the campaign spread anti-Muslim narratives, promoted far-right conspiracy theories and attempted to turn public opinion against Qatar, particularly as Doha played a central diplomatic role in mediating the war in Gaza.
The investigation, conducted by researchers Marc Owen Jones and Sohan D’Souza and published under the title Manufacturing the Great Replacement, documents an operation that spent more than $1.2 million on Meta advertisements alone by mid-2024.
According to the researchers’ analysis of Meta’s data, the operation ranked among the largest covert influence networks exposed by the technology company.
Its activities subsequently expanded beyond Facebook and Instagram to YouTube, TikTok, Telegram and X, while also reaching physical advertising spaces in major international cities.
The findings raise questions extending beyond the campaign itself: Who was paying for the propaganda, why were Muslims and Qatar targeted, and how did major technology companies allow such an extensive operation to continue?
A Manufactured Grassroots Movement Designed to Turn the West Against Qatar
At the centre of the operation was a tactic known as astroturfing, in which coordinated political or commercial campaigns disguise themselves as spontaneous public movements.
Rather than openly identifying their sponsors, the operators established an elaborate network of fabricated accounts and misleadingly named platforms.
Among them were pages operating under titles such as Qonspiracy and Doha Dirt, which presented themselves as independent voices exposing alleged wrongdoing by Qatar.
The objective was to create the impression of widespread public hostility towards the Gulf state, concealing the coordinated nature of the campaign.
Initially, the operation concentrated on undermining Qatar’s commercial and economic presence in Western countries.
Its messaging sought to portray high-profile Qatari investments and businesses, including Paris Saint-Germain football club, London’s Harrods department store and Qatar Airways, as politically and socially unacceptable.
The timing was particularly relevant.
As Qatar emerged as a central international mediator during the war in Gaza, the campaign was simultaneously attempting to discredit the country among Western audiences.
What began as an anti-Qatar messaging operation soon developed into a much broader campaign built around hostility towards Muslims and immigration.
How an Anti-Qatar Campaign Became a Platform for Islamophobia
One of the investigation’s most troubling findings concerns the campaign’s deliberate embrace of the far-right conspiracy theory known as the Great Replacement.
The racist theory portrays immigration, particularly from Muslim-majority countries, as part of an organised effort to replace Europe’s existing populations and transform its cultural and religious identity.
The influence operation adapted this narrative by presenting Qatar as the supposed secret financier and architect of Europe’s alleged Islamisation.
According to the campaign’s misleading claims, Doha was orchestrating demographic change by facilitating immigration and supporting the expansion of Muslim communities across the continent.
The researchers documented how these accusations were promoted through videos, documentary-style productions and selectively edited footage.
Cities with substantial Muslim populations became recurring targets.
Among the locations featured were Malmö in Sweden and Bradford in the United Kingdom, where selected images and video clips were used to reinforce narratives portraying Muslim communities as evidence of a supposed demographic threat.
The campaign’s messaging also attempted to associate Qatar with Muslim organisations, using these connections to reinforce its broader allegations about political Islam and Western societies.
The investigation presents these narratives as elements of a coordinated disinformation effort rather than substantiated evidence of the conspiracy being promoted.
By combining anti-immigration rhetoric with allegations against Qatar, the operators sought to appeal to audiences already receptive to far-right political messaging.
From Social Media to Times Square and the Republican Convention
The campaign was not confined to anonymous internet accounts.
Investigators documented efforts to carry its messaging into prominent public spaces, entertainment events and American political gatherings.
Large advertising displays appeared in New York’s Times Square, bringing anti-Qatar messaging into one of the world’s most recognisable commercial locations.
In another incident, a video produced by the campaign-linked platform ShameQatar was displayed during the 2024 Republican National Convention, shortly before Donald Trump took the stage.
The campaign also employed unconventional publicity tactics.
Former beauty queens were reportedly recruited to stage protests and perform scripted scenes designed to portray Qatar negatively inside a shopping centre in Atlanta.
In Sweden, the operation produced an anti-Qatar parody song timed to coincide with the Eurovision Song Contest.
The song received substantial amplification from far-right social media accounts, extending the campaign’s reach into audiences already engaged with anti-immigration and anti-Muslim political content.
These activities illustrate the operation’s attempts to move beyond conventional political advertisements.
By blending organised demonstrations, entertainment, public advertising and online amplification, the campaign sought to make its messaging appear more culturally widespread and politically relevant than its underlying network of accounts might suggest.
The Money Trail Leads to Vietnam, Brazil and Anonymous Telegram Accounts
One of the investigation’s central objectives was to identify who financed and operated the campaign.
Using open-source intelligence techniques, researchers examined advertising records, account histories, digital metadata and connections between seemingly unrelated promotional activities.
Their findings revealed an international network involving advertising intermediaries and accounts operating across several countries.
One trail led to LT Media, a media services company based in Vietnam.
According to the investigation, the company’s owner acknowledged receiving advertising requests and payments through an anonymous Telegram account.
The admission provided an insight into how the operation concealed the identity of those commissioning its advertisements.
Rather than dealing directly with a clearly identifiable political organisation or sponsor, advertising services were reportedly purchased through intermediaries communicating with unidentified clients.
The investigation also established technical connections between the anti-Qatar campaign and a parallel influence operation targeting Lebanon.
That campaign used slogans including “Lebanon Does Not Want War” and promoted political messaging that portrayed Israel favourably while blaming Iran for the threat of war.
The researchers identified similarities and connections between the operations, suggesting that their infrastructure was not limited to the campaign against Qatar.
These findings also corresponded with a Meta report documenting more than $1.2 million in advertising expenditure and identifying links between the campaigns directed towards Lebanon and Europe.
The Israeli Connection: What Investigators Actually Found
Among the most consequential findings were technical indicators linking parts of the operation to Israel.
The investigators identified two particularly notable pieces of digital evidence.
The first emerged from a network of fabricated Wikipedia accounts operating under the name TronFactor.
According to the investigation, a technical mistake exposed a static internet protocol address associated with Israel.
The discovery provided a geographic indicator connected to the infrastructure used by the network.
A second set of clues emerged from the forensic examination of videos distributed through Telegram.
Researchers analysed metadata embedded in the files and identified production patterns corresponding to an Israeli working week, running from Sunday to Thursday.
The recorded working hours also aligned with Israeli local time.
In addition, some files contained Hebrew-language labels and markings.
Taken together, these findings suggested that individuals involved in producing or coordinating elements of the campaign may have been operating from Israel.
However, the researchers did not establish the identity of the operation’s ultimate financial sponsor.
The distinction is critical: technical evidence indicating connections to Israel does not, by itself, establish who ordered, financed or authorised the campaign.
Despite the geographical clues, the individuals or organisations ultimately responsible for funding the operation remain unidentified.
A Trump-Linked Adviser and an International Advertising Network
The investigation also examined the involvement of individuals and organisations with connections to American political circles.
One of the names to emerge was Johnny Moore, an evangelical adviser associated with Donald Trump.
According to the researchers, Moore’s public relations company was linked to the influence operation, providing another lead in the effort to understand the campaign’s organisation and political connections.
The investigation did not establish that Moore personally financed the operation.
Further examination of Google’s advertising records uncovered another obscure identity: a person identified as Lilian Kaufman, whose advertising information was associated with Belgium.
The researchers also traced advertising activity to São Paulo, Brazil, where they identified Agência Moll.
According to the investigation, employees of the Brazilian advertising agency had sold access to their advertising accounts to an unknown individual.
Those accounts were subsequently used in the anti-Qatar operation and in channels associated with the parallel campaign targeting Lebanon.
The findings revealed how advertising accounts could be acquired through intermediaries and reused for political influence activities without publicly identifying the ultimate client.
The international structure also made the campaign more difficult to investigate.
Advertising accounts associated with one country could be used to distribute political messaging in another, while the individuals directing the activity remained hidden behind intermediaries and anonymous communication channels.
The Campaign’s Next Phase Targeted European Audiences
By 2025, the operation had expanded its activities on YouTube, concentrating particularly on audiences in the United Kingdom, Germany, Italy and France.
Channels with titles including Qatar’s Behind This and Grand Theft Qatar published dozens of videos promoting allegations against the Gulf state.
The videos accumulated millions of views.
Their content increasingly centred on immigration and the supposed transformation of European societies.
Migrants were portrayed through racially charged narratives, including the description of immigration as a “silent invasion”.
The researchers found that the campaign repeatedly connected these themes to Qatar, attempting to present the country as the hidden force behind demographic and political changes in Europe.
The operation’s timing also coincided with parliamentary elections in Britain and France, raising concerns about the potential political purpose of the advertising activity.
The investigation additionally identified attempts to influence local elections in Birmingham, one of Britain’s largest cities.
These activities suggested that the campaign’s objectives extended beyond damaging Qatar’s international reputation to influencing political debates within Western democracies.
AI-Generated Songs, Fabricated Videos and Attempts to Evade Detection
As the operation evolved, its organisers adopted increasingly sophisticated digital production techniques.
The campaign used artificial intelligence to generate songs, including a parody modelled on music associated with American singer Mariah Carey.
It also produced fabricated videos depicting Qatar’s Emir, Sheikh Tamim bin Hamad Al Thani.
Other prominent figures became targets of its messaging, including the Emir’s mother, Sheikha Moza, and Catherine, Princess of Wales, widely known as Kate Middleton.
These productions allowed the campaign to exploit celebrity recognition, political controversy and entertainment formats to attract audiences beyond those ordinarily interested in geopolitical affairs.
The researchers also documented attempts to avoid automated moderation systems and digital detection tools.
Among the techniques was the deliberate alteration of Qatar’s name in online content.
For example, the network used spellings such as “QXTAR” instead of “QTAR”, an approach intended to interfere with automated recognition and monitoring systems.
Such modifications formed part of a wider strategy designed to keep promotional material circulating despite scrutiny from technology platforms.
The combination of artificial intelligence, fabricated media, misleading identities and advertising-account manipulation demonstrated how the operation adapted its methods as it expanded.
Half a Billion Paid Impressions, but Who Paid for Them?
By the time researchers examined the campaign’s activities between 2023 and 2026, the operation had generated more than 500 million paid advertising impressions.
This figure refers to the number of times advertisements were displayed, rather than the number of unique individuals who encountered them.
Nevertheless, the scale of the advertising activity illustrates the reach that a well-financed and coordinated influence operation can achieve.
The campaign operated across multiple countries, employed various advertising intermediaries and used both digital and physical platforms to distribute its messaging.
Yet the central question remains unanswered.
Despite tracing technical connections to Israel, uncovering advertising links in Vietnam and Brazil, and identifying individuals and organisations associated with American political circles, the investigators could not establish who ultimately financed the operation.
According to the investigation, the refusal of American advertising and political institutions to disclose the identity of the ultimate beneficiary contributed to the difficulty of identifying the sponsor.
The findings raise broader concerns about the role of undisclosed funding in shaping political narratives, fuelling hostility towards religious minorities and influencing public opinion across national borders.
They also expose persistent weaknesses in the ability of major technology platforms to detect and prevent organised, paid campaigns that disseminate hatred and disinformation.
The operation’s financial backers may remain hidden, but its documented methods reveal how anonymous funding, digital advertising infrastructure and coordinated propaganda can be combined to manufacture hostility towards Muslims while presenting that hostility as spontaneous public opinion.
The investigation can be accessed through Manufacturing the Great Replacement.
