In recent years, the proliferation of social media has reshaped the informational landscape. It has created synergies that go well beyond the traditional media-empowered terrorism that dominated the latter half of the 20th century.

Today, violent extremist organizations no longer treat media as merely a publicity tool. Rather, social media has become part of their core strategic infrastructure. By tailoring propaganda, intimidation, and recruitment campaigns to the logic of platform algorithms and the rhythms of online news cycles, these actors can project power far in excess of their real-world capabilities. And the use of shocking imagery broadcast live on social media channels is becoming a standard part of terrorist information strategy. In recent years, we have seen groups like Hamas and ISIS weaponize contemporary social media platforms to shape perceptions, mobilize supporters, and influence state behavior, In the process, they have revealed real, serious vulnerabilities in the global information environment – vulnerabilities that need to be addressed as part of a forward-looking counterterrorism strategy.

The Media/Terror Symbiosis

By its nature, terrorism is an asymmetrical engagement, one in which a weak insurgency seeks to destabilize a powerful status quo. But while terrorists are at a material disadvantage in armed struggle, the information war is a level playing field on which they can be peer competitors, setting narratives, dominating news cycles and commanding public attention.

The modern age of media-driven terrorism was born in September 1970, when members of the Popular Front for the Liberation of Palestine (PFLP) hijacked and blew up three passenger airliners at a desert airstrip near Zarqa, Jordan.[1]Hostages were evacuated from the aircraft, the international press was summoned, and made-for-TV explosions took place. In his pioneering work on the reciprocal relationship between terrorism and the media, the scholar Abraham H. Miller noted that “the uniqueness of contemporary terrorism lies in its need its almost incessant craving for publicity, whether favorable or unfavorable, at whatever cost.” Miller asserted that “terrorism is the media’s stepchild, a stepchild which the media unfortunately can neither completely ignore nor deny.”[2]

There is indeed a durable symbiosis here. Reporters want dramatic stories with striking visuals, and terrorists supply them. Thus, from the 1970s onward, media coverage became a force multiplier for terrorists, amplifying their message and encouraging more spectacular, headline-worthy incidents.

Terrorist groups developed sophisticated media strategies, establishing sympathetic narratives and even courting influential journalists who were interested in their activities. Al-Qaeda, which provided probably the most visually spectacular terrorist attacks in history on September 11, 2001, had recognized the possibilities of web-driven news content early on, and had a well-developed and detailed strategy that sought to exploit both Arab and western media.[3]

But even without sophisticated strategies, media coverage of terrorist attacks can have significant social impact. The October 2002 DC sniper attacks generated a sense of panic simply by their momentum, while the mystery surrounding the attackers and their motives created an amount of coverage that by some measures rivaled 9/11.[4]

In turn, the spread of Internet and World Wide Web access since the 1990s gave terrorists far greater opportunities to distribute messages and images to global audiences. The same dynamics that gave rise to “citizen journalism” and disrupted traditional news practices applied. Terrorists no longer needed to rely on media gatekeepers to spread their messages but could appeal directly to people anywhere in the world. Extremist groups began posting manifestoes and videos in Internet chat groups and on websites and disseminating them via email.

Social Media: The Next Stage

The subsequent advent of social media platforms in the 2000s, coupled with the widespread adoption of smartphones, boosted the power to pursue and achieve narrative dominance exponentially. Social media networks reach people directly, wherever they are, 24 hours a day. Terrorists can supply unlimited, dramatic imagery and messaging on free or low-cost publishing platforms in multiple languages with no requirement to host a server or even a website. These services are all maintained by others, for free, forever, and are relatively (though not entirely) secure for the terrorists themselves. The media dynamic changed from passive distribution to active participation. The result has been an expanding ecosystem of social media, alternative websites, and legacy press outlets, the ultimate target being public opinion and more importantly policymakers.

Violent extremist groups now use a wide variety of interconnected social media and digital platforms, combining mainstream networks, encrypted messaging apps, fringe platforms to maximize reach. Popular platforms such as X, Facebook, Instagram, TikTok, YouTube, Spotify, Soundcloud and Reddit are used for visibility, virality, and agenda-setting, while encrypted and lightly moderated services, especially Telegram but also WhatsApp, Signal, and similar apps, function as primary hubs for official messaging and content control. Access to social media allows for agile and rapid message response, so terrorists can shape narratives in real-time.

Moreover, unlike traditional media, the social media ecosystem has very little curation and editorial gatekeeping. When groups are identified and banned on social outlets, extremists can shape-shift by opening new accounts under different guises or migrate to “alt-tech” platforms like Odysee, Rumble, Gab, Gettr, or BitChute, which offer even more permissive moderation. Gaming and social-interaction platforms such as Discord are used opportunistically to reach younger audiences, and extremists increasingly incorporate emerging tools such as AI-generated media to enhance emotional impact. The result is a layered, redundant communication system in which encrypted platforms anchor the network, websites and file hosts provide durability, and mainstream platforms serve as amplification channels, making extremist messaging difficult to suppress through platform-specific measures alone.

Social media amplifies impact not only by increasing reach but by energizing dispersed supporters, who become part of a widespread online community of ideological fellow-travelers. Social media, by its nature, facilitates creating these dispersed networks of interest through existing friends groups, followers lists, fan communities and related groupings. Its interactive nature, meanwhile, bolsters recruitment, indoctrination and mobilization.

Terrorist groups exploit built-in features that reward engagement and attention. Virality mechanisms such as likes, shares, retweets, and trending topics allow extremist content to travel far beyond its original audience, while recommendation algorithms can inadvertently steer users toward progressively more extreme content clusters once initial engagement occurs. Hashtag hijacking further enables these groups to insert their narratives into mainstream conversations, allowing propaganda to circulate within broader political, humanitarian, or cultural debates that would not otherwise engage with extremist messaging.

Rather than building independent digital infrastructure, terrorist organizations leverage these platform features as force multipliers. At the same time, they adopt adaptive counter-moderation tactics to ensure continuity of messaging, including masking content through filters, emojis, coded language, euphemisms, or visual symbols that evade automated detection.

In this way social media users become casual enablers and amplifiers of extremist narratives simply by sharing compelling images, messages, memes, slogans, disinformation and other propaganda, whether the users understand the message or not. They are assisted by algorithms that prioritize emotional reactions, such as Facebook giving greatest algorithmic weight to the “anger” emoji.[5] This type of low-effort interaction allows people to claim to be supporting the cause without encouraging violence, which is an easy mental disconnect in a screen-based reality. Thus, extremist groups enjoy cost-free collaboration with people they have never met and who may not even understand the impact of their actions.

But extremist messaging does not always seek to incite anger or negative emotions. There can also be “soft power” social messaging. For example, Taliban officials welcomed American adventure YouTuber Jake Youngblood to Afghanistan, where he posted a viral 55-minute travel vlog showing him “wandering through Kabul, meeting Taliban guards, swimming in lakes, and sharing meals with locals.” Youngblood tells his viewers, “It’s safe. It’s beautiful. It’s not what you think,” and reframes Taliban-dominated Afghanistan as “a haven of hospitality and calm.”[6]

A Versatile Medium

Indeed, extremist groups use social media not only to communicate but to manufacture the appearance of influence, authority, and momentum far beyond their actual capabilities. Apparent online followings are often illusory, inflated through bots, paid supporters, and sock-puppet accounts that create the impression of a vibrant, disciplined, and powerful movement, an effect that matters because terrorism is as much about perception as it is about violence. These groups and their sympathizers deliberately cultivate the image of a functioning political or social organization by posting “governance” content such as community events, social services, and ideological lectures; showcasing internal cohesion and operational competence to attract donors or foreign sympathizers; and operating pseudo-media outlets that mimic professional journalism in order to project credibility.

For example, Drop Site News was funded by George Soros’ Open Society Foundations to help “bridge a crucial information gap in independent journalism” in the Middle East.[7] In practice, this meant amplifying Hamas narratives and disinformation about the Gaza War. Instagram later removed reposted reportage from Drop Site News, citing a policy against posting “symbols, praise, or support of people and organizations we define as dangerous.”[8]

Terror groups further expand their reach through hashtag and account hijacking, inserting propaganda into trending conversations or established networks that would not otherwise encounter extremist messaging. While this activity may generate only “soft” support that rarely translates into direct operational assistance, it nonetheless normalizes extremist presence and narratives in the broader information environment. Emerging technologies, particularly AI-generated imagery and deepfake video, are likely to intensify these dynamics by making manufactured legitimacy, scale, and authenticity even easier to produce and harder to detect.

Social media also expands the capabilities of extremist groups to radicalize and recruit. The interactive nature of social media gives extremists direct, two-way communication with self-selected groups of individuals who may be attracted to or curious about their messages and primed for further radicalization, and eventually recruitment as active supporters.

Terrorists can seek out and actively target affinity groups with carefully crafted appeals based on pre-existing group interests. These could be based on identity-driven affiliations, where people seek belonging, nurture grievances, and look for heroes to represent them. Terrorists can engage in selective storytelling and narrative-building that highlights perceived past injustices and glorifies participation in acts of resistance or revenge. They utilize standard emotional hooks to target individuals who feel alienated, angry, or ideologically aligned with extremist worldviews.

Prolonged exposure to such tailored content creates a psychological environment where the most vulnerable recruits eventually make themselves known to the terrorists, who can then engage in more individualized recruitment.[9] Given the international nature of this recruitment activity, it can build highly dispersed cells inside target countries that may be difficult to detect and counter.

Terrorists also use social media for fundraising, where people sympathetic to the cause but not interested in being recruited are offered easy means of providing monetary support. Social media platforms are ideal for soliciting donations, facilitating crowdfunding, and directing users to resources that support terrorist operations. Furthermore, the extremist groups can hide their true intent behind fronts requesting support for humanitarian and other nonviolent efforts. These transactions may be difficult to detect and trace, and extremists actively make use of cryptocurrency transactions with the belief that this guarantees privacy and anonymity. This, however, is a double-edged sword; the digital – and thus trackable – nature of these financial tools can also easily lead to extremist financial networks being exposed and taken down.[10]

The Nexus With Terror Operations

Social media is increasingly used to support and execute terrorist operations as well. Given its inherently dispersed and wide-area nature, social media is a natural tool for terrorist action. At the dawn of the social media age, Syrian jihadisttheorist Abu Mus’ab al-Suri advocated the development of decentralized, leaderless resistance around common themes and objectives, to facilitate widely dispersed lone wolf and small cell actions.[11]

The nature of social media is tailor-made for this model. Social media platforms are ideal for instruction, education and training in terror methods. Mainstream and niche platforms often provide ready-made “how-to” videos and manuals, ranging from cyber-crime methods to bomb-making guides. Terrorists can make their own such content posted anonymously or under fake accounts to avoid detection. These could be used to facilitate and inspire lone wolf terror attacks, particularly inside a well-defended target country such as the United States. Al Qaeda’s online Inspire magazine, for example, is focused on encouraging this precisely this type of individual terrorist action.

Social media and the Internet in general also provide ample resources to support terrorist attacks. The vast amount of information shared on social media channels is ideal for intelligence gathering. Terror organizations can browse this wealth of public information for targeting and planning purposes, or to create fake profiles and exploit users’ openness to gather personal, military, and political information for operational use. Encrypted chat platforms such as Telegram, Signal and WhatsApp can be used for secure communication during operational planning, for making travel and meeting arrangements, establishing logistics, and during attacks.

A Study In Social Media Exploitation

The horrific events of October 7, 2023 provide a case in point. Social media was central to the conceptualization, planning and execution of the massacre perpetrated by Hamas against Israel that day. Hamas leader Yahya Sinwar drew up precise orders for attackers to record and quickly publish shocking imagery of the attacks aimed at maximum operational impact. In a captured operations order, Sinwar instructed his men to “make sure to produce images that spark a frenzy, madness and an outburst among our people” and to “instill terror and fear in the enemy.” [12] He believed that such images would foment a mass uprising of Palestinians in Gaza, the West Bank, Jerusalem and elsewhere.

Sinwar directed his commanders to think deliberately about the media impact. “Plan in advance events that will yield terrifying images,” he ordered, “several burning car bombs exploding at an outpost or building and creating horrific destruction, heart-rending scenes, terrible fires. Five or ten such images will sow mortal fear in [the Israelis].” He gave several suggestions, including “burn down an entire neighborhood or kibbutz — pour gasoline or diesel from a special tanker, set it alight and broadcast the images.” He urged his teams to “broadcast the footage as quickly as possible: soldiers’ heads being stepped on, point-blank shootings, stabbing several people with knives, tanks exploding, soldiers kneeling with their hands on their heads, and the like.”[13]

Intercepts during the attack show how Hamas commanders coordinated the information strategy. Hamas commander Abu al-Baraa told operatives in the area of Kibbutz Sa’ad to “Slaughter them. End the children of Israel” and “document the scenes of horror, now, and broadcast them on TV channels.” Another commander, Abu Muath, said, “It is essential that you bring the drone in so it films for the entire Islamic world.”[14]

By one analysis, Hamas was also using these images to push back against criticism from ISIS and al Qaeda that they were weak in bringing the fight to Israel. Terrorism expert Daniel Byman noted that “Hamas wants genuine images of itself as resistance,” and not as a mainly political, often compromising and ineffective resistance group.[15]

Sinwar’s concept shows heightened awareness of the potential of social media-enabled terrorism. But it also underscores the pitfalls of this approach. The hoped-for mass uprising in support of what Sinwar optimistically called Operation Al Aqsa Flood never materialized. And, far from demoralizing the Israelis, the brutal images that Hamas terrorists broadcast engendered in Israelis a burning sense of mission and desire for payback. Scenes of barbaric killings, sounds of women and children pleading for their lives before being butchered, and images of hostages being dragged into captivity had much to do with the scope and nature of Israel’s response.

Nevertheless, Hamas demonstrated a sophisticated, platform-specific social media strategy that adapted rapidly to different digital environments to maximize reach and emotional impact. Telegram emerged as the central hub for official messaging, serving as the primary channel for initial attack announcements and the distribution of graphic content, which helped the group rapidly expand its following in the hours and days after major events. On X, networks of coordinated accounts amplified Hamas propaganda and disinformation, at times exploiting premium features to boost the visibility of video content and shape real-time narratives. Meanwhile, TikTok and Instagram were used to circulate emotionally charged imagery and trending hashtags, particularly content exaggerating civilian suffering in Gaza, as well as hostage videos, aimed at mobilizing sympathy and influencing global public opinion. Hamas celebrity spokesman Abu Obeida was an omnipresent, authentic and charismatic voice until he was tracked down and eliminated by the IDF in September 2025.[16]

Taken together, these practices illustrate a multifaceted digital strategy that leverages platform dynamics, emotional storytelling, and selective distortion to project influence and shape international perceptions well beyond Hamas’s material capabilities.[17] Hamas’s media campaign is not solely about broadcasting violence, but about constructing legitimacy—presenting itself as a credible resistance movement rather than merely a terrorist organization, particularly to audiences already sympathetic to the Palestinian cause. And even though Hamas was banned on many platforms, the group got a huge spike in followers and benefitted from a continued social media presence from supporters who spread their narratives.[18] Israel, the U.S. and European states were powerless to counter this dynamic.

Countering Terrorist Exploitation Of Social Media

Effective policy responses to the terrorist use of social media must be comprehensive, coordinated, and adaptive, reflecting the scale and complexity of the digital information environment in which extremist actors operate. Meaningful mitigation requires an integrated approach that combines regulatory frameworks, proactive platform governance by social media companies, close collaboration with law enforcement, and sustained strategic communication efforts aimed at reducing vulnerability to radicalization and strengthening community resilience.

Regulatory measures play a foundational role, by establishing clear expectations and accountability for technology companies. In the European Union, the Regulation on Terrorist Content Online represents one of the most assertive attempts to impose legal responsibility on platforms, including the possibility of significant fines for failing to remove terrorist material within prescribed time limits.[19] Similar national approaches, such as the United Kingdom’s code of practice, require platforms to proactively identify and prevent the upload of terrorist content through a combination of automated detection systems and human moderation.

In the United States, while direct content mandates are more limited due to legitimate concerns over infringement on civil liberties, legislation and oversight mechanisms increasingly require federal agencies such as the Department of Homeland Security to conduct regular threat assessments and report on how terrorist organizations exploit online platforms. Together, these measures aim to shift platforms from reactive takedowns toward more systematic risk management.

Platform-level action remains the most immediate line of defense. Social media companies enforce community standards that explicitly prohibit terrorist content, but the effectiveness of these policies depends on consistent and context-aware enforcement. This has driven investment in artificial intelligence–based detection tools capable of identifying known extremist material at scale, along with the hiring of local-language moderators who can assess nuance, symbolism, and coded messaging. At the industry level, collaboration has become increasingly important. Initiatives such as the Global Internet Forum to Counter Terrorism (GIFCT) facilitate information sharing, coordinate responses to emerging threats, and maintain shared databases of known terrorist content, enabling faster cross-platform removal and reducing the ability of extremist groups to migrate seamlessly from one service to another.

Law enforcement cooperation is equally critical, particularly in time-sensitive or high-risk situations. Formalized channels between platforms and security agencies allow for rapid response to accounts promoting terrorism, coordinated disinformation campaigns, or livestreamed violence. Beyond enforcement, multi-stakeholder partnerships that include non-governmental organizations, academic researchers, and community groups enhance situational awareness and improve reporting mechanisms. These actors often possess localized expertise and cultural insight that neither governments nor platforms can easily replicate, helping to identify emerging narratives and vulnerabilities before they escalate.

Strategic communication and counter-narrative efforts address the longer-term challenge of radicalization. Rather than focusing solely on removing content, the most effective approaches seek to undermine the appeal of extremist ideologies by promoting credible alternative narratives using the same social media tools, inclusive identities, and social cohesion. Evidence suggests that messages delivered by trusted community voices are more persuasive than overt government campaigns. Community resilience initiatives, such as mentorship programs, dialogue forums, and support networks, help to insulate individuals from extremist recruitment by addressing underlying grievances and social isolation.

Taken together, these policy responses reflect a growing recognition that terrorist exploitation of social media is not merely a content problem. Rather, it is a systemic challenge rooted in platform design, regulatory gaps, and social vulnerability. Addressing it effectively requires sustained cooperation across sectors and a shift from episodic crisis response to durable, preventive governance of the digital public sphere.