Skip to main content
Threat IntelligenceEmerging Threats

X Disrupts 13,000 Accounts Tied to Foreign Influence Ops Ahead of US Midterms

A social media company's office building with a subtle global map in the background and employees walking in the foreground.
"People come to X to talk about what's happening in the world, including the upcoming 2026 US midterms," the platform said.

X announced on Wednesday evening that it had removed more than 13,000 accounts tied to three suspected foreign influence operations aimed at U.S. political debate. The platform linked the networks to Iran, Russia and China, saying the accounts used inauthentic identities to post and amplify political content that targeted candidates and public figures across the political spectrum. The takedown comes ahead of the 3 November 2026 midterm elections.

X's takedown: 13,000 accounts across three suspected operations

X framed the action as a pre-emptive step to preserve authentic conversation on its service, saying the networks deployed inauthentic accounts to push and amplify political material. The platform described the activity as three distinct suspected foreign influence operations but did not provide public detail on the technical evidence, infrastructure, or the specific accounts involved.

Attribution to Iran, Russia, and China — and X's silence on evidence

In its public post, X attributed the campaigns to Iran, Russia and China. The company, however, "did not publicly explain the evidence behind its attribution," according to the report. That absence of explanation leaves the public with the platform's classification but without the supporting forensic or intelligence detail that would typically accompany such claims.

Civic Integrity policy, Community Notes, and platform labeling

X highlighted its Civic Integrity policy in parallel with the account removals. The policy covers misleading information about how, when and where to vote, and content intended to discourage participation. Reports submitted under that policy are routed into requests for Community Notes, X's crowdsourced context feature. X said it uses Community Notes alongside platform moderation, and that it may label policy‑breaking posts in critical cases.

Community Notes under scrutiny and regulatory context

Community Notes has attracted regulatory attention. When the European Commission launched formal proceedings against X under the Digital Services Act in 2023, the Commission questioned the feature's effectiveness for validating a post's accuracy. The company’s continued reliance on crowdsourced context — rather than exclusively on centralized moderation — remains a focal point for regulators watching how platforms enforce civic‑related rules.

Moderation staffing after Musk acquired Twitter

X’s statement and reliance on Community Notes follow reported layoffs and senior departures from its moderation teams "after Musk acquired Twitter," the report notes. That staffing shift provides context for why the platform emphasizes crowdsourced solutions alongside — rather than instead of — traditional moderation practices.

What this means for technologists, policymakers, and voters

  • Technologists and security teams: The company’s description of "inauthentic accounts" used to post and amplify political content highlights patterns to monitor in future campaigns; the lack of published evidence means forensic details that would help defenders are not being shared publicly in this case.
  • Policymakers and regulators: The European Commission’s 2023 DSA proceedings over Community Notes show regulators have already raised questions about whether crowdsourced context is sufficient for validating political content, a thread that is likely to reappear given X’s stated approach.
  • End users and voters: X routes Civic Integrity reports into Community Notes and may label critical posts; users should expect some political posts to carry crowdsourced context or platform labels in the run-up to the November election.

Outside the United States, the report reminded readers that foreign influence operations are not a uniquely American concern. MI5 chief Sir Ken McCallum said this week that Russia had attempted to interfere in the 2016 Brexit referendum but cautioned against treating that as evidence it changed the result — a note that underlines the difference between attempted influence and demonstrable electoral impact.

The facts published by X — the three attributed campaigns, the scale of the removal, the timing before the midterms, and the platform’s reliance on Civic Integrity and Community Notes — leave open a central question: without publicly shared evidence for attribution, how will independent researchers, regulators and the public assess whether the networks were state‑directed operations or something else? With the election approaching, that question is practical as well as political.

Original story: https://www.theregister.com/security/2026/10/15/x-purges-13000-accounts-linked-to-suspected-meddling-ahead-of-us-midterms/5303234