It was a verified Twitter account in the name of a World Health Organization official, and it had a wild story to sell. The account in the name of WHO assistant director-general Dr. Jaouad Mahjour alleged a secret Trump administration plot to test a coronavirus vaccine on Black Americans without their knowledge or consent.
The account and its vaccine conspiracy story were fakes. According to Twitter, they were verified thanks to a mistake by a partner organization. Experts say the hoax bears a strong resemblance to tactics used by an “Iran-aligned network of inauthentic websites and online personas,” known as Endless Mayfly. And the WHO stunt isn’t the only content that appears to connect to Endless Mayfly. At least one account linked to a similar hoax attacked Hisham al-Hashimi, an Iraqi expert on militant groups, a few days before he was assassinated. So what is Endless Mayfly and how could it be connected to a recent string of pro-Iran trolling?
Welcome to Rabbit Hole, where we dive deep on the biggest story. It’s for Beast Inside members only. Join up today.
ADVERTISEMENT
In May, a verified Twitter account in the name of Mahjour, WHO’s assistant director-general for emergency preparedness, surfaced and began tweeting criticism of the Trump administration’s handling of the coronavirus pandemic.
Despite the verification, the Mahjour account was a fake. The account owner apparently submitted false information in its verification application to Twitter in order to get its blue check mark in the name Dr. Mahjour. A Twitter spokesperson told The Daily Beast that the company verified and then reversed course and suspended the account after it got the wrong information from a partner organization.
Narrative jiu jitsu: The fake Mahjour account was apparently trying to discredit U.S. vaccine research with a conspiracy narrative reminiscent of the all too real and dark history of the Tuskegee experiment, when racist doctors at the U.S. Public Health Service experimented on unwitting Black men.
“Recall your racist and secretive offer to WHO for coronavirus vaccine to be tested on poor Americans, black people of Birmingham, Alabama; prisoners and immigrants! WHO has flatly rejected the offer, and firmly stated that clinical trials would only apply to volunteers,” the account tweeted.
The fairly quick suspension of the fake WHO account wasn’t a bug for the person running it; it was a feature. The fake Mahjour fully expected to be suspended and tried to use that as evidence of a fake cover-up to make its narrative of a vaccine experiment conspiracy seem that much more secret and explosive.
“It is likely that some will claim that this official account was hacked or even worse when I’ll be forced to deny myself as the Director General was on many occasions, and even received online death threats,” the account predicted in its first tweets
Once the inevitable suspension took place, another fake account started amplifying the confusion left in its wake. @KellyJournalist, a fake Twitter account impersonating a France24 reporter, began to retweet legitimate users confused by the bizarre tweets from a verified account and tried to tamp down claims that the account was fake.
Endless Mayfly: The fake WHO official’s account, along with another group of Twitter accounts previously identified by The Daily Beast, mirror those from a disinformation campaign known as “Endless Mayfly.”
“The tactics look really similar,” Gabrielle Lim, a fellow at the University of Toronto’s Citizen Lab, which first first identified documented Endless Mayfly’s work in a May 2019 report, told The Daily Beast.
Mayfly, Citizen Lab wrote, is an “Iran-aligned network of inauthentic websites and online personas” that targets the U.S., Israel, and Saudi Arabia with disinformation.
Mayfly used fake websites registered through typosquatting (registering a version of a real website with one letter off in the URL) or at a different top level domains than the websites they copied (registering the same name for a website at .org instead of .com) to publish fake stories stories “critical of Saudi Arabia, the United States, and Israel.” All told, Lim and Citizen Lab identified 72 different spoofed domains including The Guardian, Le Soir, Bloomberg, the Huffington Post, CNN, The Independent, Harvard’s Belfer Center and other legitimate outlets.
Mayfly operators then used short-lived Twitter accounts to amplify the spoofed news outlets and tweet their links at journalists in an (often vain) attempt to get others to fall for the hoaxes.
That’s consistent with the tactics used by the @KellyJournalist account identified by The Daily Beast. The account not only amplified the WHO vaccine hoax but also published a forged letter from Sen. Tammy Duckworth’s office, which sought to blame an accidental fire aboard a US Navy ship in July on a group of “Black separatists” within the military. Together with another fake account impersonating an Israeli special operations veteran and politician, the two tweeted out copycat websites from French and Israeli news organizations that sought to convince readers that the Mossad was supporting an Iranian dissident group and that Saudi Arabia and the U.K. had secretly coopted Iraq’s Prime Minister.
Attacking a critic: In May, another group of fake accounts pulled off a Mayfly-like propaganda stunt attacking a different series of targets. The propaganda was textbook Mayfly tactics, but the amplification surrounding it has taken on a darker tone.
The trolls registered a fake version of Arutz Sheva, a legitimate Israeli news outlet, at a .net domain to mimic the real one hosted at .com. The story—another fake interview with an Israeli official about covert operations—claimed that the CIA and Mossad were collaborating on a plot to either kill or overthrow Venezuelan President Nicolás Maduro and his government just as Iranian tankers arrived in Venezuela to trade much-needed oil for gold.
A series of phoney twitter accounts, pretending to be supporters of Iraq’s Iranian-backed Popular Mobilization Forces militias, amplified the fake story by endlessly tweeting it at legitimate news outlets like CNN, Al Jazeera, and al Arabiya.
The cybersecurity company FireEye independently tracked the fake Venezuela story and found the same amplification accounts identified by The Daily Beast.
“We observed at least one inauthentic persona that had amplified the account impersonating a WHO official also promoted an article published on a domain mimicking that of Israel National News,” said Lee Foster, FireEye’s senior manager for information operations intelligence analysis at FireEye.
“This type of use of sites spoofing genuine media outlets and other organizations to post divisive or fabricated content, and the amplification of that content using inauthentic social media personas, bears similarities to the pro-Iran ‘Endless Mayfly’ campaign, which was first publicly reported on by Citizen Lab in 2019,” Foster told The Daily Beast.
The activity ceased as quickly as it began in late May. But one of the apparent amplification accounts, @narjess012, surfaced again in early July to attack Hisham al-Hashimi, an Iraqi scholar of militant groups like ISIS and a critic of Iraq’s Iranian-backed militias.
“Now agitated, the son of shoe! Reality and the positions are for the [Popular Mobilization Forces], and against the wish of those employing you,” @narjess012 tweeted at al-Hashimi on July 2nd.
Four days later, Hashimi was assassinated by unknown gunmen in Baghdad. According to The New York Times, Hashimi told associates that both ISIS and Iranian-backed militias had threatened him shortly before his death.
Twitter suspended the account that attacked Hashimi shortly before The Daily Beast published its story.
Attribution caveats: So who or what is behind Mayfly? As Lim told The Daily Beast, the available evidence isn’t sufficient yet to make conclusions. Citizen Lab assessed that Mayfly is an “Iran-aligned network of inauthentic websites and online personas used to spread false and divisive information primarily targeting Saudi Arabia, the United States, and Israel.”
“Iran-aligned,” in this case, doesn’t necessarily mean that the Iranian government is behind the hoaxes and propaganda but that the group’s activity is consistent with the Iranian government’s interests and previously identified disinformation activity. That evidence is based on the content and behavior, which any actor could theoretically mimic.
The authorship, and whether the Iranian government had a hand in it, remains unproven but the fake WHO criticism of Trump’s handling of the COVID-19 pandemic does come in the context of what intelligence officials say is an active campaign to hurt Trump before the election. Iran, according to a statement from the Trump administration’s top counterintelligence official William Evanina, is “spreading disinformation on social media and recirculating anti-U.S. content” as part of an attempt to “to undermine U.S. democratic institutions, President Trump, and to divide the country in advance of the 2020 elections.”
