Note: All accounts and channels surfaced for this Dispatch were flagged using platform reporting mechanisms.

Executive summary: Local is global

As ceremonies at the World Trade Center, Pentagon and the crash site in Pennsylvania, were underway 25 years after the largest terrorist attack on United States soil, a slew of pro-al-Qaeda accounts were posting snippets from a newly-released al-Qaeda video commemorating the attacks as their crowning achievement. The accounts lionized “our sheikh,” Osama bin Laden, his deputy, Aymenn al-Zawahiri, even using AI-generated versions of al-Zawahiri to pay homage to him.

The pro-al-Qaeda ecosystem—spread across mainstream platforms, fringe and niche sites, and messaging services—had been anticipating the anniversary all year, preparing content and organizing across messaging services as part of a practice they have pursued for more than a quarter-century: exploiting the internet.

The al-Qaeda digital ecosystem has sustained itself online for decades. With the 25th anniversary of the 9/11 attacks this year, ISD set out to understand the current state of networked support for al-Qaeda across platforms, websites and messaging services.

At its online pinnacle in 2008, al-Qaeda operated 5,600 websites, with 900 new ones appearing each year, according to terrorism researchers and academics. While the number is significantly diminished, the group has sustained its presence across the open web through its ‘decentralized network of networks’ model. Through multiple generations of leaders, and across numerous conflicts in South Asia to West Africa, al-Qaeda has maintained a network of affiliates, influencers and propaganda outlets. Globally, the group has thrived through local affiliates rather than centralized control, built out tactical alliances, and continued government counterterrorism operations.

In parallel, al-Qaeda’s online presence has similarly survived through strategic use of decentralization and adapted from the age of message boards to the era of artificial intelligence. This report details what this ecosystem looks like online today, and how its outlets and supporters frame it at this current juncture, two decades and half after its most consequential attacks. The digital ecosystem supporting al-Qaeda and its affiliates continues to draw on the legacy of deceased ideologues to inspire global support, while leaning on its network of powerful affiliates in the Sahel and East Africa. Its supporters’ core messaging strategy remains focused on harkening back to al-Qaeda’s past successes, celebrating current military gains, and, in particular, emphasizing its decades-old ability to commit attacks in the West.

The 9/11 attacks remain a central reference point for al-Qaeda’s digital ecosystem. Rivals such as the Islamic State (IS) have also paid deference to Osama bin Laden for the attacks, bolstering al-Qaeda’s global brand. Almost like clockwork, al-Qaeda outlets and supporters, which form the backbone of the ecosystem, flood platforms with images and videos of the attack on each recent anniversary. This is deliberate. al-Qaeda’s digital ecosystem seeks to remind its followers of both its Salafi-jihadist bona fides and its ideological strengths. This aspect of its messaging can often come across as stodgy, with a longstanding preference for long speeches, pamphlets, and books to communicate with its audience, supplemented with videos of pitched battles with adversaries.

Four primary insights from this landscape are key to understanding the al-Qaeda ecosystem in 2026

First, the group’s network of affiliates effectively operates its own autonomous digital ecosystems, allowing them to tailor messaging to local populations without strong central control. This autonomy and adaptability have helped affiliates develop tactics to evade content moderation.

Second, al-Qaeda has maintained its foothold online, buoyed by standalone platforms and social media operations across the world. Its supporters use platforms such as TikTok and Signal as part of their strategy, adapting to changing platforms and user preferences. While analysts and researchers debate whether al-Qaeda has been defeated, its online ecosystem continues to incite violence online.

Third, al-Qaeda is fighting for its relevance globally with the IS online. al-Qaeda supporters and support outlets are reporting IS accounts and channels for takedowns, while seeking to produce content that can compete with their rival’s calls for violence.

Fourth, al-Qaeda in the Arabian Peninsula (AQAP) is attempting to inspire audiences in the West through calls for violence. This is a part of a quest for relevancy in the wider Salafi-jihadist ecosystem. Over the past two years, it has produced a glut of content under its age-old media brands specifically geared toward calling for attacks in Europe and the United States[1].

Key findings

The Contours of the al-Qaeda Online Ecosystem in 2026

• ISD analysts identified 500 pro-al-Qaeda and al-Qaeda-linked accounts across multiple platforms and messaging applications using simple keyword searches. Twenty-five years after 9/11, their content is generating hundreds of thousands of views, with speeches featuring deceased ideologues receiving the highest levels of engagement[2].
• A polyglot al-Qaeda digital ecosystem of supporters and outlets continues to message online using a strategy described best as glocalization, where local conflicts are reflective of the group’s greater global ambitions. Updates from the frontlines in West Africa, Somalia, or Yemen spread to both local audiences but are also part of a messaging strategy that showcases al-Qaeda’s global reach[3].
• The 9/11 anniversary provides an opportunity for al-Qaeda supporters to celebrate the group’s past success and troll other online communities through memes. ISD has previously documented how jihadist ‘shitposters’ use the anniversary to mock victims and glorify the attacks. In one example, an Arabic language meme posted by a jihadist “shitposter” featuring bin Laden as a GigaChad received 780,000 views on X.”
• Supporters for al-Qaeda also extends beyond its own ecosystem, with supporters of militant Islamist groups such as the Taliban amplifying its content in support of a global ‘jihad.’[4] This is particularly visible around the 9/11 anniversary, with analysts identifying Taliban supporters and a Pashto-language outlet celebrating bin Laden’s ‘jihad.’
• Legacy ideologues remain central to al-Qaeda’s online ecosystem[5], with content featuring al-Awlaki and bin Laden appearing most frequently across platforms. [6]One video supporting bin Laden generated more than 133,000 views, illustrating the continued reach of content centered on deceased al-Qaeda figures.
• Bin Laden has cross-spectrum appeal across terrorist, extremist, conspiracy and trolling communities online, where he is invoked to support attacks on the US, promote violent antisemitism, advance ‘deep state’ conspiracies and troll other users through memes. Meanwhile, al–Awlaki is particularly revered for helping establish al-Qaeda in the Arabian Peninsula (AQAP) as a global brand and his sermon series.
• Lone actors-linked to al-Qaeda or inspired by the group’s content, such as Nidal Hasan and Dzhokhar and Tamerlan Tsarnaev, have been absorbed into online fandoms that extend beyond traditional jihadist networks. Content glorifying the attackers generated hundreds of thousands of views collectively and circulated among diverse online communities, including a subset of users belonging to the True Crime Community (TCC) (a subculture centered on nihilistic violence). Notably, a single TikTok video supportive of the Tsarnaev brothers generated 100,000 views.
• AQAP continues to attempt goad foreign audiences into violent action. Over the past two years, the ‘Inspire Guide’ series has focused on recent attacks and incidents, including the Washington, DC, shootings of two Israeli Embassy staffers, the attack on a Jewish march in Colorado, the car-ramming and stabbing attack at a synagogue in Manchester (UK), and the mass casualty attack at Bondi Beach in Australia on the first day of Chanukah.

Platform specifics of the al-Qaeda ecosystem in 2026

• al-Qaeda and affiliates use a mix of open-source and mainstream platforms, messaging services, and even websites posing as news brands. On Facebook, the group’s largest contingents appear to communicate in Somali, Arabic, Urdu, Pashto and Bengali. On TikTok, al-Qaeda ideologues and attackers are venerated by a cross-spectrum of extremists includes subsets of the TCC. The al-Qaeda ecosystem also uses open-source software to host its propaganda archives, much like the IS ecosystem.
• Analysts found al-Qaeda accounts using Professional Mode on Facebook, which allows users to potentially monetize their accounts. Of the 200 al-Qaeda Facebook accounts assessed by analysts, 80 were using the Professional Mode feature, and collectively had 322,632 followers. The accounts labelled themselves as either writers, digital creators, bloggers or authors. ISD could not verify if the accounts were monetizing content.
• al-Qaeda supporters used the ‘promotional content’ tags on TikTok in an attempt to boost accounts sharing terrorist content on the platform. ISD analysts found three accounts using the “promotional content” tags for at least 29 different al-Qaeda-related videos. The videos tagged as “promotional content” included speeches by the late AQAP leader Khalid al-Batrafi, the late cleric Abu Ammar al-Hadrami, and senior group Shiekh Khubayb al-Sudani. The platform clearly states that users disclosing promotional content must adhere to the community guidelines which includes prohibitions on “violent and hateful individuals and organizations.”[6]
• ISD found 15 channels (6,400 subscribers) on the encrypted messaging application Signal, pointing to an alternative interconnected system of al-Qaeda media outlets and supporters. With constant takedowns happening across Telegram and other messaging applications, al-Qaeda supporters and outlets have created an alternate distribution system to share new and older content on the messaging application.
• al-Qaeda supporters plan and coordinate takedowns of Islamic State accounts across platforms. ISD analysts found al-Qaeda supporters sharing Arabic and English templates to report IS channels to Telegram to get them banned from the messaging application. This type of retaliatory action is part of a greater campaign online to limit the reach of IS and stifle its recruitment efforts.
• al-Qaeda support outlets on X openly share content in support of the group and its key ideologues. Analysts found 50 accounts on X that were celebrating fighters travelling to Somalia, as well as the 9/11 attackers and ideologues such as Osama bin Laden. X appeared to be suspending violative accounts within the first 72 hours, but 10 were still functional at the time of this report including an outlet that functioned across platforms spreading news from al-Qaeda’s affiliates across Signal, Facebook, X, and WhatsApp.
• Web traffic data suggests the al-Shabaab ecosystem of stand-alone websites was the most visited among a wider constellation of al-Qaeda sites. Central al-Qaeda website visitor counts pale in comparison to those visiting IS websites. Using the tool SimilarWeb, researchers found that visitors to websites supportive of IS outnumbered those to similar al-Qaeda support websites 10 to one.

Approach

For four months in 2026 leading up to the 9/11 attack anniversary, ISD analysts immersed themselves in the al-Qaeda support ecosystem online to understand its contours, messaging and continued exploitation of platforms. Researchers monitored social media platforms, fringe and niche websites, and messaging services across the open web. This included mainstream platforms such as Facebook, TikTok, X, as well as fringe and niche platforms linked to various pro-al-Qaeda groups and affiliates, and messaging services such as WhatsApp, Telegram, Threema, Element, Rocket.Chat, SimpleX and Signal. Analysts chose a selection of these platforms, sites and messaging services, as a sample, representing mainstream social media, fringe and niche platforms, as well as messaging services. Building on a methodology developed to map the IS online ecosystem, this landscape is rooted in analysis of a sample of 500 pro-al-Qaeda and al-Qaeda-linked social media accounts (using reporting tools to flag violative accounts), messaging channels and stand-alone websites. Central to this analysis is understanding how al-Qaeda affiliate system (the so-called network of networks) is angling to sustain itself for decades to come while exploiting local military successes for global notoriety.

The accounts, channels and content examined for this landscape analysis paints a picture of a persistent, multidimensional threat, which is capitalizing on alliances and the successes of local affiliates in the Sahel and East Africa, as well as in Yemen and South Asia. Analysts focused on the following platforms, websites, and messaging services[7]:

Mainstream social media platforms: 200 pro-al-Qaeda accounts and page on Facebook, 50 accounts on Instagram, 100 accounts on TikTok, and 55 accounts on X

Fringe: 50 accounts on Chirpwire[8]

Messaging services: 15 channels on Signal, 10 channels on Telegram, and 10 channels on WhatsApp

Stand-alone websites: 10 linked to the al-Qaeda support ecosystem and affiliates[9]; researchers primarily analyzed traffic patterns using SimilarWeb, as well as verified content linked to other platforms and messaging services.

Researchers used platform reporting mechanisms to report the sample accounts as well as others found during the observation period. All of the accounts were taken down in three to five days after analysts had flagged to platforms. However, prior to ISD’s analysis, many of the accounts survived for months on these platforms, posting regularly, and sometimes using platform features that could enhance their ability to spread content. On Facebook, analysts found accounts using a feature intended for influencers seeking to grow their audiences and potentially monetize. Additionally, a handful of TikTok accounts used the platform’s “promotional content” and “paid partnership” feature to tag videos of al-Qaeda leaders. In other instances, platform-embedded AI, such as Grok on X, would rightfully identify live al-Qaeda content as terrorist material.

The goal of this research is not just to highlight the narratives and content of al-Qaeda and its supporters circulating online, but also to provide policymakers, practitioners and platforms with an understanding of how the ecosystem has sustained itself for decades, despite pressure by governments and platforms. The following case studies provide deeper insights into these networks of al-Qaeda support, and their ability to withstand takedowns as well as continue to share ideological and violent material.

Facebook: A base of support for al-Qaeda affiliates and supporters

Just as Facebook serves as a hub for support for the IS ecosystem, al-Qaeda supporters use the platform to engage with local audiences in places such as Yemen, Bangladesh and the Sahel. ISD researchers found 200 al-Qaeda supporters and support outlets across the platform.

They used similar techniques as IS supporters and outlets to avoid platform bans. These included obfuscating branding from official media outlets connected to the group to avoid AI moderation, breaking up words with irregular punctuation and replacing sensitive terms such as ‘car bomb’ or ‘killing’ with emojis. Other shared tactics included the creation of media personalities or outlets that could be used to recreate official news or propaganda but under different branding.

On Facebook, al-Qaeda support pages in Bangladesh, for instance, branded themselves as media outlets and created new material from older al-Qaeda content to evade banning and reach new audiences. One user who posted in Bengali created two pages:

1. A ‘video creator’ with more than 20,000 followers which shared ideological material and sermons supportive of al-Qaeda’s leaders and actions,
2. An ‘editor’ with 16,000 followers which shared similar content.

The page with more than 20,000 followers produced eight highly stylized videos supportive of bin Laden, al-Awlaki and Bengali al-Qaeda fighters that reportedly “fought the Americans in Afghanistan.” The videos collectively generated 203,000 views, with the video eulogizing the fighters proving most popular.

In early September, the pages created a 90s style video celebrating bin Laden, al-Awlaki and the Taliban’s Mullah Omar. The video generated more than 14,000 views and more than 1,800 likes. Another video features a voiceover repeating “blood for blood, destruction for destruction” as bin Laden appears juxtaposed with scenes of the 9/11 attacks. The video generated 35,000 views and 1,600 likes; comments included: “We will do it again, Insha’Allah. This will be more powerful than the previous one. Now Muslims need another Osama.”

Analysts similarly found another Bengali Facebook page, which was posting videos and stylized quote cards featuring bin Laden quotes that generated tens of thousands of views. The page had more than 16,000 followers, and posted five different bin Laden edit videos, featuring his speeches and other calls for jihad. The five videos generated 152,000 views. The page presented itself as ‘reel creator’ and had a multiplatform presence at one point, cutting across Telegram and Instagram. One of the tactics the page used to avoid takedowns was to provide a disclaimer stating it was for “journalistic purposes.” The group’s content, however, clearly venerated waging bin Laden-style jihad. The Facebook page was also following other Bengali pages that celebrated the 9/11 attacks.

One of those pages, which appeared to be a part of a network—linked to other pages sharing the same branding, posts and material—had more than 75,000 followers. The page similarly posted a celebratory post in response to the 9/11 attacks, which ended with an ominous threat about similar attacks, “from Khaybar to Nineveh, it will come back again and again.”  The page appeared to be connected to a network of pages functioning as media outlets supportive of al-Qaeda in the Indian Subcontinent (AQIS) and a rogue cleric who has been allegedly tied to al-Qaeda. The network appeared to be operating freely across the platform, sharing material in support of al-Qaeda and deceased ideologues.

Within this Bengali language dataset of accounts, analysts also found two users with verified badges on Facebook. One of the accounts had 10,000 followers and posted a hand painting-like AI image stripped from the al-Qaeda video commemorating the 9/11 attacks of al-Zawahiri. The account wrote “our imam, our leader, the ruler of the ummah Shiekh Aymann al-Zawahiri (may God have mercy on his soul” alongside the AI image of al-Zawahiri. The account also posted an edit video of bin Laden that read “our imam, our leader and our pride!” Meta notes that “accounts with a verified badge have been authenticated and can be Meta Verified subscribers or notable persons or brands.” The other verified account found by analysts had 5,200 followers and posted a recitation of a Quranic verse by one of the 9/11 hijackers Mohammad Atta, with a post that read “the commander of the 9/11 invasion that broke America’s might.” The account also reposted the full 52-minute version of the al-Qaeda video commemorating the 9/11 attacks and told followers to “watch it before its taken down.”

Just as in 2022, ISD researchers found a large subset of al-Qaeda-affiliated supporters were spreading Harakat al-Shabaab al-Mujahideen (al-Shabaab) propaganda in Somali. Analysts found multiple versions of digital versions of al-Shabaab’s Radio Andalus programming on Facebook, often highlighting the latest military successes and the ideological teachings of the East African affiliate of the group. al-Shabaab radio programming was shared daily as the “morning news” of its supporters.

al-Shabaab accounts created and shared videos featuring other al-Shabaab supporters’ profiles in order to signpost to new accounts to follow. Researchers found new al-Shabaab accounts whose profiles were flashed on screen during videos. By following these profiles, analysts found linkages to AQAP supporters on the platform, all of whom claimed to be in Yemen. Much like IS accounts on Facebook, this subset of al-Qaeda supporters was found to be using ‘Professional Mode,’ a platform function that enables monetization and offers greater ability to target posts.

ISD found 50 ‘Professional Mode’ Facebook accounts during this analysis. One self-described ‘writer’ with more than 5,000 followers posted a montage video of bin Laden and another montage video al-Qaeda fighters that generated 82,000 views collectively. In other posts, the account referenced bin Laden quotes about US descending into “incest” and lionized al-Awlaki. The user similarly linked to a Telegram channel peddling al-Qaeda material from other channels and their own branded al-Qaeda support content.

These users were not just supportive of al-Qaeda ideologues and attacks on the US: they represented a potentially much larger ecosystem of al-Qaeda support on the platform. Although this takes many forms, a consistent aspect of this ecosystem is that it is representative of al-Qaeda’s affiliates, whether in South Asia, East Africa or Yemen.

TikTok: The terrorist boomers on a ‘zoomers’ platform

Most of the content associated with al-Qaeda and its affiliates was not built for short-form video formats. But its supporters, communities of trolls and a subset of the TCC community are keeping it alive on the platform. ISD analysts found 100 TikTok accounts supporting al-Qaeda and al-Qaeda ideologues, as well as attackers. While bin Laden and al-Awlaki were most popular figures among supporters, analysts also found users posting speeches by al-Zawahiri, and both former and current leadership of AQAP.

One account claimed to be from Syria and posted three al-Zawahiri speech videos in a row, generating more than 94,000 views. The most viewed video out of the set of three videos generated 80,600 views on its own.

Connected to this user was an AQAP account that used a kunya (a name that denotes where a person might be from that is not their family name) which indicated they were from Hadramout, where bin Laden traced his own lineage.

Analyst noted that this AQAP-supportive user posted 29 different videos featuring various AQAP spiritual and organizational leaders, both dead and alive, that were tagged as ‘promotional content.’ According to TikTok, ‘promotional content’ typically refers to content that can be used to promote a user’s account on the platform[10]”When posting content that promotes a brand, product, or service on TikTok, you must turn on the content disclosure setting,” TikTok notes on a support page. The promotional content disclosures appeared on content shared by AQAP accounts, such as group leaders like Ibrahim al-Qosi, who is wanted by the US government and has repeatedly called for “individual jihad” in the US.

In a similar vein, ISD also found one user who posted seven different speeches of an AQAP leader tagged as a ‘paid partnership.’ The videos were snippets of speeches by the now-deceased former senior cleric for AQAP Ibrahim al-Rubaish, who was killed in a US drone strike in 2015. The content of the videos focused on the importance of jihad above all other Islamic principles. The videos collectively generated 469,500. The partnership tag can unlock features for a user on TikTok to use ads to promote the content, but it was unclear if the user had in fact launched ads to promote the content, following an ISD review of the TikTok Ad Library.

Analysts also found subsets of TCC posting videos that were homages to al-Qaeda leaders and inspired attackers. This included the 9/11 hijacker of American Airlines Flight 11 Mohammed Atta, and the 2013 Boston Marathon bombers, Tamerlan Tsarnaev and Dzhokhar Tsarnaev. One user, a member of a subset of TCC, created fan fiction that sexualized the Tsarnaev brothers alongside video edits professing adoration. Another user created three different videos as a dedication to Atta, set to nasheeds (Islamic music that does not use instruments); these generated more than 19,300 views collectively.

These vignettes clearly show how al-Qaeda supporters have expanded their reach beyond their ‘traditional’ platforms. Ideologues (particularly attackers) have also developed an appeal that cuts across a spectrum of supporters of mass violence.

X: Surviving just long enough to post

Accounts supportive of al-Qaeda and/or its dead ideologues fanned out on X on the eve of the 9/11 attacks anniversary. ISD analysts identified these accounts using simple keywords linked to al-Qaeda. ISD pinpointed 55 accounts supportive of al-Qaeda on the platform during this observation period. These ranged from supporters of JNIM (Jama’at Nusrat al-Islam wal-Muslimin) in the Sahel, to al-Shabaab in East Africa, to accounts that expressed explicit support for bin Laden or other al-Qaeda ideologues.

Among these was an English-language account sharing archival material from al-Qaeda affiliates and another English-language account that shared stories of those who had gone to fight in Somalia for al-Shabaab. While these accounts had small followings, the intention was to highlight the legacy of Salafi-jihadism and the core concepts that have been espoused by al-Qaeda since its founding. One of the accounts ISD tracked posted a video of bin Laden, praising him in Arabic the day after the anniversary; it generated 151,000 views. The same account had previously posted another bin Laden video praising him in July 2026; it generated 15,000 views. ISD researchers similarly observed an Urdu al-Qaeda support outlet with a presence across Facebook, X, WhatsApp and Signal, which provided news updates from al-Qaeda affiliates globally. The account, which was based out of Afghanistan according to X, visible in its bio, tagged officials from the Taliban government in an image from al-Qaeda central whose branding had been blurred. The instance demonstrated how al-Qaeda support accounts interact with Taliban official accounts online.

An analyst asked X’s chatbot Grok to explain a post by the account with an official statement from al-Shabaab; Grok rightly noted the account “operates as a publisher of ‘Saif al-Islam Frontlines’ materials, distributing Al-Shabaab and al-Qaeda-linked content in Persian to highlight operations by the group in East Africa.” Grok also translated the Urdu text in the post correctly. It was unclear why the account was not taken down if Grok was able to rightly recognize that the account was a purveyor of al-Qaeda content.

The X account also posted a short, pro-AQAP video by the outlet Shahed commemorating the 9/11 attacks, featuring an interview with one of the 9/11 hijackers, Ziad Jarrah. The video had been updated and featured scenes from Gaza, US President Joe Biden and pro-Palestine protests. In the video Jarrah claims that the 9/11 attacks were retribution for the suffering of Muslims and Palestinians specifically. Grok was able to explain this post, synthesizing the 2-minute video and providing a synopsis.

Signal, Telegram and WhatsApp: An encrypted haven for al-Qaeda and its affiliates

Signal is becoming a central messaging service for al-Qaeda-linked group chats and one-way channels, with ISD researchers identifying 12 such groups and channels. Collectively, the channels and group chats had more than 6,000 members (though this was likely duplicative). Some of the channels observed during this period included the primary media outlets for al-Qaeda affiliates such as AQIS, al-Shabaab and JNIM. Analysts were also able to observe group chats with hundreds of supporters as they planned how to commemorate the 9/11 attacks.

Signal is heralded for its privacy features and has become increasingly appealing to terrorist groups such as al-Qaeda, its affiliates and their supporters, in the wake of a range of issues that have arisen around Telegram’s safety and privacy. Europol has also conducted numerous operations targeting terrorist accounts on Telegram.

Analysts found one-way channels for the official media outlets of al-Qaeda affiliates on the messaging service. These would sync delivery of messages through dedicated accounts sharing news bulletins and other materials. Supporters also built archive channels that contained material as far back as the founding of the group. Researchers additionally found that al-Qaeda supporters had created Arabic and English templates to report IS accounts and channels on Telegram for take downs. The discussions around using the templates illustrated the real-world animosity between the groups and how al-Qaeda supporters sought to undercut the ability of IS to spread propaganda on other platforms.

Analysts also found a number of Telegram channels connected to the Signal ecosystem, which included bot channels that provided users with archival material linked to legacy and newer al-Qaeda content. The Telegram accounts did not have audiences as large as the Signal ecosystem of accounts. This copycat ecosystem has long existed before the Signal group chats and channels and included channels that were connected to Facebook profiles or Instagram accounts, highlighting cross-platform exploitation. Similar dynamics were also observed with al-Qaeda channels on WhatsApp that were functioning as mirrors and extensions of the identified Signal groups and channels.

Some of the channels observed on WhatsApp were positioning themselves as media outlets pushing out daily updates from the ‘frontlines’, as well as new releases from al-Qaeda’s affiliate outlets. One of those channels claimed to be an official purveyor of news and content for pro-AQIS communities. The channel had 1,958 followers on WhatsApp and was sharing links to its footprint on X, Telegram, Signal, Facebook and other websites linked specifically to the AQIS ecosystem of websites.

Recommendations and conclusion: Staying in power

One of the videos circulated by al-Qaeda supporters on the day Americans mourned the deaths of the 2,977 people killed on September 11, 2001, was that of al-Zawahiri outlining the principles of the ‘media jihad.’ In the video, al-Zawahiri implored the brothers in “jihadi media” to unite rather than fight one another.

The video was emblematic of much of the ethos that runs through the al-Qaeda digital ecosystem where affiliated movements and groups are welcomed as part of the ‘big tent’ jihad the group has always sought to cultivate. The persistence of the online al-Qaeda ecosystem and its interconnected nature highlight how it has survived for so long. ISD has consistently made recommendations for platforms and messaging services to address this challenge sustainably, which are as salient now as ever:

The digital ecosystem around al-Qaeda and its affiliates illustrates al-Qaeda’s persistence, and new modes for disruption are needed. The al-Qaeda ecosystem may rely on outdated and primarily dead ideologues, however, it is still able to promote the idea of a global jihad against ‘tyranny.’ This ability is of course supported through its adept and adaptable use of social media platforms, but also that the 9/11 attacks continue to draw in even rivals, who view the attacks and attackers with admiration. While there continues to be a focus on if al-Qaeda can launch an attack in the West, a more pressing need is developing strategic communications that can disrupt and degrade its ability to seed its content and spread its ideology from West Africa to South Asia online.

There is a clear need for more expert moderation, human-led tracking and removal of accounts and channels. This should include greater investments in trust and safety divisions, especially in smaller or less profitable markets and languages, with an increased focus on strategies to combat account recidivism. Analysts found al-Qaeda content that was clearly branded being circulated online. Training AI systems to find this branded content, supported by expert review, would enhance the capacity of platforms to target these ecosystems.

A model of cross-platform network coordination should replace piecemeal takedowns that focus on single actor or account behaviors online. Europol demonstrated this ability in 2019 and again in 2026. While much of the attention has been on IS and its footprint online, al-Qaeda accounts and channels are coordinating across platforms, with singular pro-al-Qaeda outlets having multiplatform footprints and coordinating releases.

The pro-al-Qaeda system is experimenting with the use of platform functions that support their ability to enhance targeting messages and spread content further. The tactical toolbox used by al-Qaeda supporters and outlets and groups to exploit platforms now includes the use of ‘promotional content’ tags and ‘professional mode.’ These tactics are intended to broaden the reach of content and narratives to new audiences online. Analysts similarly found content tagged ‘artificial intelligence generated’ when it was clearly from videos produced by al-Qaeda groups in what appears to be a means by which they were attempting to circumvent moderation.

Pro-al-Qaeda outlets and groups provide a narrative bank that should be leveraged by national governments for enhancing strategic communications and building engagement programming globally. The strategy of these influencers, outlets and groups remains to create a rift between Muslim populations and governments. They similarly highlight global injustices faced by Muslims across Africa and Asia and provide solutions that can only be attained by joining and fighting for al-Qaeda. Strategic communications campaigns should address these issues and combat them using concrete actions.

Affiliates and supporters of al-Qaeda online demonstrate that they are capable of withstanding shocks to their leadership through their “network of networks” model of operation. This makes al-Qaeda’s exploitation of the internet a long-term problem. The group’s evolving propaganda is part of the story of the post-9/11 reality and an apt example of it: modern moderation systems still seem to have gaps in recognizing one of the oldest brands of Salafi-jihadism. Part of this problem is that support outlets and supporters continue to produce new material or reframe old material, requiring the continued adaptations by systems and expertise in how terrorist groups operate online.

Governments and platforms have had to reckon with how established foreign terrorist organizations have gained footholds on platforms through direct presence, proxy brands or supportive communities that revel in their content.

While the past 25 years have been punctuated with strategic successes offline against al-Qaeda (including targeted assassinations and arrests), the coming period may soon test those global wins. The strategic effort to limit al-Qaeda’s influence online for the past two and half decade’s calls into question the need to find new modes to disrupt and ultimate degrade the group further.

End Notes

[1] These included a speech by AQAP leader Saad bin Atef al-Awlaki calling for the assassinations of the US President Donald Trump along high-profile supporters such as Elon Musk for their roles in supporting the war on Gaza.

[2] Researchers separated content by support for ideologues versus support for groups.

[4] As the United Nations Monitoring Team and analysts noted in 2024, al-Qaeda reconstituted training camps across Afghanistan, after the Taliban’s takeover of the country

[5] Their lectures, speeches and the manner in which they died have become symbolic of a wider “jihad” to online audiences supportive of al-Qaeda

[6] According to the platform,  users must “adhere to our Terms of Service, Community Guidelines, Branded Content Policy (if applicable), and all applicable laws and regulations,” when using promotional content tags.

[7] ISD researchers selected these platforms because of the variety of content available on them. Open-source messaging services such as Rocket.Chat, as well as Threema, and Element are also key to the al-Qaeda ecosystem. However, there is little variations between the types of content found on these messaging applications and the one’s selction. The focus on Signal, which is also now being used by IS, provides an understanding on how al-Qaeda supporters and support outlets exploit new messaging applications.

[8] Chirpwire is niche microblogging site with similar functionality as X. The site has been a haven for al-Qaeda support outlets and supporters for years. The primary analysis of Chirpwire was that it functioned much like messaging services, providing much of the same material only on a platform without the same levels of moderation as mainstream social media, making it useful for supporters and outlets seeking consistency. The platform itself suffers from technical glitches at times, making it less than ideal.

[9] The ecosystem of stand-alone websites linked to al-Qaeda and its affiliates is much larger than just these 10 sites. ISD analysts focused on 10 because they represented the geographic spread of the group.

[10] According to TikTok’s Digital Service Acts reporting, “ads are reviewed against the Advertising Policies through a combination of automated and human moderation. Prior to being made available to users on the Platform, all ads are subject to technology-based automated review, designed to flag ads that may violate TikTok’s Advertising Policies.”