Hidden Networks

It all started with a single sentence posted by an anonymous account commenting on a political news story. But the same phrase then reappeared dozens of times under different names and with different images. This led to the discovery of an online network that holds bogus “discussions” and gives prominence to certain content against a background of manufactured noise. The result is not a genuine political debate on Facebook, but a system operating as a silent electoral machine.

Our investigation monitored and tracked a huge amount of data over several months to lay bare the activity of a network of more than 140 accounts claiming to belong to Moroccan citizens, but which are for the most part fake. We show how the accounts on this network run coordinated campaigns on Facebook to influence elections and circulate disinformation. They also target political opponents, and amplify narratives supportive of the majority party in the Moroccan government by creating spurious public opinion and impersonating real people and using their photos.

A Network of Accounts Promoting the Majority Party's Narrative

One of the accounts involved in disseminating the edited video during the election campaign in the southern district of Fez was that of Nawfal Aytdouch. His profile picture shows a young man in his twenties with black hair, and his account information shows him living in the northern Moroccan city of Tetouan and employed in commerce. His list of friends includes only 63 people, some from Asia and Egypt.

Even though this account has been active since 2023, it features no personal activity or daily postings, except for four photos taken from the internet - posted between January and April 2023, and one in May 2025r - along with the edited clip of the speech by the PJD secretary-general. On the other hand, by monitoring how this account features posts related to the ruling party and to its members' activities and election campaigns, we were able to see how intensely it comments almost daily on the government’s achievements and activities, repeating texts word-for-word. These include criticism of the teachers' strike and of the investigation into the fuel price issue, as well as support for coordinated campaigns against political opponents.

We followed the digital footprint of the texts that Nawfal reposts in comments and found that there was a whole network of fake accounts sharing the same content, one of the most prominent of which is Fatine Sabrine. It was clear that the texts in the comments had been copied and -pasted, some reposted over a period of four years.

Between January 2022 and August 2025, we tracked a set of texts being repeated word-for-word across 529 different posts, revealing a network of 143 accounts working in coordination to promote the narrative of the majority political party. They did this using so-called “computational propaganda” – placing pre-prepared propaganda posts on the webpages of the party and media outlets.

When we looked into the identity and authenticity of these accounts, we found substantial evidence that most were using fabricated online identities. We were able to source most of their profile pictures, and found that they had been stolen either from the internet, from clothing websites, or were photos of celebrities, or simply for foreign people. We also showed that all the accounts in this network behaved in exactly the same way, with no normal activity or variety of interests. All they had were coordinated propaganda posts backing the majority party narrative.

One of the accounts that shared the misleading video of PJD leader Abdelilah Benkirane and was heavily involved in the coordinated activity on this network goes by the name of Issam Lbhri. Using a reverse image search, we were able to identify the source of the profile picture used by this account – its avatar. It belongs in fact to Walid Shro, an activist and researcher in media and communications based in Beni Mellal.

When we spoke to Walid Shro, he said he was shocked to find that someone else was using his image to promote causes and opinions he might disagree with. He said this could create enemies for him and threaten his professional future, without him being able to do anything about it.

Walid said, “I wondered how it could be that my image was being used when I was so far away. When I started reading the comments and posts this account was putting out, I just couldn’t think straight. I couldn’t sleep that night, and I laid awake thinking about what I needed to do to protect myself.”

Walid said he has no political affiliation and voted for the first and last time in the 2016 elections. As for what he had done about this identity theft, he said, “I’ve already reported it to Meta, and I asked friends to report it too. But it was no good, because they just said my original Facebook account was not verified.”

Walid Shro thinks that having this kind of online identity will continue to create problems, and that legal intervention is needed to regulate the way social media platforms operate in Morocco to protect individuals.

Five Years In: How Does the Operation Work?

A sample of data we were able to document and analyze showed a method of posting that would be difficult for the average user to follow. After we had looked at some 598 posts, it became clear that a group of accounts was able to achieve an extremely rapid rate of posting. For example, a single account posted the same text in comments on four posts on a variety of pages in just one minute.

When we looked deeper into the coordination between accounts, it became clear that the network had the form of a cluster, with each node made up of several accounts. These accounts take turns posting a list of specific texts so that the same text does not appear in a single post from two different accounts.

We presented our findings to Mohamed El Ghalousi, a lawyer with the Marrakech Bar Association and president of the Moroccan Association for the Protection of Public Funds. In a phone call he explained that political parties had been exploiting the legislative vacuum in this area since the 2021 elections by sponsoring fake accounts to promote their electoral programmes.

“This is a new phenomenon, and there is no regulation of how public opinion in Morocco is influenced,” said El Ghalousi, adding that Moroccan law “does not prosecute fake accounts. Instead it focuses on what accounts promote and publish, rather than who the owner of the account is.” He explained that the public prosecutor and the judiciary intervene when “an accounts does something illegal, but creating a fake account or launching an advertising campaign to back a particular MP, community leader or a candidate.. that’s not something where the law gets involved.”

Lawyer Mohamed Al-Ghalousi offers a different perspective. He argues that concerns about fake accounts influencing public opinion during Moroccan elections are somewhat beside the point. Traditional forms of vote-buying, cash payments and lavish meals for voters, remain so widespread that they overshadow digital manipulation tactics.

Loophole, Facts, and Figures

While we were preparing this report, the Government Council approved draft bill 53.25, on October 20, 2025, to amend and “supplement” Organic Law No. 27.11, dealing with the House of Representatives. Article 40 stipulates that “any person who publishes sponsored political advertisements or election campaign material on foreign platforms or websites” will face a fine of 50,000-100,000 dirhams (approximately $5,400 to $10,800).

Draft law 53.25 also includes social media networks and artificial intelligence (AI) tools in its Article 115 definition of opinion polling. It stipulates that their use is prohibited during the last 15 days of the election campaign leading up to polling day.

With the exception of the new amendment to Article 40 of the draft law, covering the use of paid advertizing on foreign platforms and websites - and the provisions of Article 51, relating to the use of social media platforms, AI tools and information systems to disseminate misinformation or use other forms of deception to influence voters or deter them from voting - there is no law to stop private companies or networks of fake accounts running coordinated campaigns to amplify posts, conduct computational propaganda, or promote disinformation to favour particular political actors.

According to the 2020 “Global Inventory of Organised Social Media Manipulation” report by the Oxford Internet Institute, more than 65 companies have emerged since 2018 offering to carry out information manipulation as a commercial service to political actors.

The report looks into the activities of these “cyber forces” in 81 countries, where they work to disseminate political propaganda online for a diverse range of political actors.

The report explains how online operations to exert political influence have become institutionalized and systematic, and how they are managed by specialized teams funded by governments or political parties to target elections, political crises, public protests and sometimes international relations. They rely on both automated and human online accounts, real and fake, to amplify certain narratives while simultaneously working to drown out and weaken other narratives.

According to a 2021 Meta report, 385 accounts and six Facebook pages have been deleted. These accounts were for the most part in Morocco, aimed at a local audience, where they sought to mislead people by using fake accounts.