How AI, open-source intelligence, and social media fought over reality itself - before the body was even confirmed.
The missiles hit Khamenei's compound at around 4 AM Tehran time. By noon, the world was watching two completely different wars: one fought with air power and ballistic missiles, the other fought with satellite imagery, AI-generated video, Telegram channels, and competing government press releases. The second war was arguably more chaotic.
This is what happened in the information space on February 28, 2026 - and why it matters for every conflict that comes after it.
Within minutes of the first Operation Epic Fury strikes, Iran's internet flatlined. Forbes reported national connectivity collapsed to just 4% of normal levels - a near-total digital blackout. This was not a technical accident. Iran has a well-documented playbook: in 2019, a week-long shutdown accompanied the "Bloody November" crackdowns. In January 2026, the same switch was pulled during mass protests that left tens of thousands dead.
The shutdown serves a dual function Tehran has refined over years. First, it prevents citizens from organizing and sharing evidence of state violence. Second - and this is the underappreciated part - it creates an epistemic fog so thick that any footage, any photo, any claim becomes deniable. With connectivity at 4%, who can prove anything from inside?
But this tactic hit a wall in February 2026 that it hadn't hit before: a global OSINT community armed with commercial satellite feeds, aircraft transponder data, maritime tracking systems, and AI image analysis tools - all operating entirely outside Iran's borders, entirely outside Iran's ability to shut down.
Open-source intelligence has been creeping into mainstream conflict coverage for years. Ukraine accelerated it. Gaza normalized it. Iran on February 28 may have cemented it as the default first draft of military history.
Before any government made an official statement about Khamenei's fate, OSINT accounts on X were already working the problem. Satellite imagery from commercial providers showed thermal anomalies and destruction at the secure compound in northern Tehran where the Supreme Leader was known to shelter. The Guardian's visual team published a satellite-annotated guide to strike sites within hours of the first explosions.
The Institute for the Study of War's live update feed cited an OSINT account based in Bahrain tracking Iranian missile barrage patterns - counting two to four missiles per wave - in near-real time. IranMonitor.org, a real-time open intelligence dashboard, aggregated X feeds, internet connectivity data, flight radar, and prediction market prices simultaneously, presenting a live picture of the conflict that no single intelligence agency was publishing publicly.
Commercial satellite imagery (thermal + optical) confirming strike sites at Natanz, Fordow, Tehran compounds. Aircraft transponder data tracking US and Israeli air assets in real time. Maritime feeds monitoring Red Sea activity. Network telemetry via Cloudflare and NetBlocks confirming the civilian connectivity collapse. Prediction markets - Polymarket's "Khamenei dead before March 2026" contract hit 94% within 90 minutes of first reports, functioning as a crowd-intelligence signal independent of any official statement.
OSINT accounts were breaking pieces of the story that neither side wanted broken on their schedule. Israeli intelligence wanted controlled narrative release. Iran wanted total blackout. The open-source community respected neither preference.
The narrative war over Khamenei's death ran on parallel tracks in real time - directly contradicting each other for hours.
Iran's state apparatus pumped denial throughout. Israeli sources leaked confirmation in stages. Western journalists threaded the epistemological needle in real time. And social media was a chaos engine amplifying every signal and counterclaim simultaneously.
The regime's dirty secret about its own shutdown: it was selective.
Foreign Policy's reporting from days before the strikes documented Iran's "white SIM" system - a two-tiered connectivity architecture where ordinary citizens navigated unstable VPNs and blocked ports while regime officials had unrestricted access to Instagram, Telegram, and WhatsApp. The blackout was a weapon aimed at citizens. The regime kept its own communications infrastructure intact.
Telegram became the clearest proof of this split. Iran International documented the pattern during January 2026 - and the same dynamic played out in February. Khamenei's official office kept posting to Telegram throughout the blackout. Araghchi's channel stayed active. But reformist newspapers like Shargh and Etemad went silent. Iran's state news agency IRNA went dark entirely.
The result: Telegram became the primary news source for both Iranians with VPN access and the international audience watching the conflict. Millions of followers across diaspora channels, opposition channels, and regime channels received radically different versions of events through the same app. Telegram was simultaneously the regime's propaganda pipe, the opposition's lifeline, and the global press's primary feed from inside Iran.
Psiphon - a VPN tool built specifically for censorship circumvention - reported a surge in Iranian users consistent with prior crackdown spikes. VPN traffic provided the narrow channel through which civilian footage escaped. Without it, the information war inside Iran would have been entirely one-sided. The regime knows this too, which is why Iranian lawmakers have blamed the "VPN mafia" for limiting the effectiveness of their own censorship apparatus.
Generative AI entered the Iran conflict narrative well before February 28. As early as June 2025, BitMindAI founder Ken Jon Miyachi told AFP there was "a surge in generative AI misinformation specifically related to the Iran-Israel conflict." By the time Operation Epic Fury launched, the pipeline was mature and running at scale.
The deepfake problem in conflict zones operates on two levels. Level one: outright fabrications - AI-generated video of events that didn't happen, fake speeches, synthetic news anchors delivering false reports. Level two, far more dangerous and harder to counter: the degradation effect. When enough convincing fakes circulate, real footage becomes suspect by association. The regime's internet blackout was designed to exploit exactly this - starve the information space, then seed it with enough confusion that anything authentic can be dismissed as AI-generated.
On February 28, several AI-generated videos claiming to show missile impacts circulated on X within the first two hours. Some were crude enough that reverse image search debunked them within minutes. Others took hours to verify. The OSINT community - specifically accounts with established track records for satellite imagery analysis - became the de facto arbiters of what was real.
This is a power shift worth naming. In previous conflicts, wire agencies and government statements anchored the truth. On February 28 in Iran, a decentralized network of anonymous analysts with commercial satellite feeds and AI detection tools held more epistemic authority than Iranian state broadcasting or even initial Western government statements.
The most striking information event of the day may also have been the most subtle. While Iranian state media ran denial and spokesmen hedged their language, Khamenei's own X account broadcast what analysts read as a coded confirmation of his death.
The post - an image dense with Shia Islamic symbolism, specifically invoking Imam Ali's battle title "Hyder" - was decoded almost instantly by scholars of Shia theology and Iranian political communication. The title is not used in contexts of defiance or resistance. It is associated with martyrdom and the passage of a leader. The New York Times flagged the significance at 4:56 PM ET, citing multiple analysts.
Someone with control of that account chose that specific image. Either they were signaling the death to the faithful in a language the regime hoped Western analysts wouldn't immediately catch, or it was the most sophisticated piece of psychological warfare in the day's information battle. Given that official confirmation followed within hours, the martyrdom interpretation appears correct. The regime broke its own blackout - through symbolism, on the same platform it was using to project strength.
The open-source intelligence community performed well on February 28. Satellite confirmation of strike sites. Real-time missile tracking. Thermal imagery analysis. Network telemetry proving the blackout. Crowd-sourced deepfake debunking. All of it faster, and in many cases more accurate, than official statements from any party.
But OSINT has limits the day also exposed. It confirmed what was destroyed. It could not, with commercial satellite data alone, confirm who was in a building when it was hit. The six-hour gap between "strikes hit Khamenei's compound" and "body confirmed recovered" was a gap OSINT could not close. That required human intelligence - people on the ground, or inside the chain of custody of the body, talking to reporters. The satellite plus signals equation still has a human layer at the center that no algorithm fills.
The AI misinformation surge exposed a structural weakness too. The same tools that let a Bahrain-based account track Iranian missile barrages in real time are available to anyone. The threshold for generating convincing fake footage of military strikes is now measured in hours and dollars, not weeks and budgets. For every high-credibility OSINT account doing careful verification work, there were dozens on February 28 pushing unverified or fabricated material - and the algorithms treated them identically in the first hour.
February 28 is not a one-off. The systems that shaped the information environment around Khamenei's death are not going away. They are getting faster, cheaper, and more capable.
| Capability | 2024 State | Feb 28, 2026 State |
|---|---|---|
| Commercial satellite revisit time | Hours | Near-real-time (sub-hour) |
| AI video generation quality | Detectable artifacts | Convincing at first glance |
| OSINT crowd-sourcing | Community-driven, slow | Structured dashboards, real-time aggregation |
| State internet control | Blunt cutoffs | Surgical two-tier - regime in, citizens out |
| Deepfake detection tooling | Specialized, expert-only | Still lagging generation capability |
The Iranian regime's two-tiered internet model is particularly worth watching. It represents a maturation of information control doctrine: don't cut everyone off, cut citizens off while keeping your own comms running. The blackout as a selective weapon, not a blunt instrument. This architecture will spread.
The OSINT community's performance suggests the era of state monopoly over battlefield information is over. No government can fully control what commercial satellites see, what network telemetry reveals, or what diaspora communities with smartphones and VPNs document and leak. The question going forward is whether institutions meant to arbitrate truth - press agencies, platform trust-and-safety operations, verification teams - can keep pace with AI-manufactured content at scale.
On February 28, they mostly kept up. The credible accounts won the day. The fake videos were debunked. The coded martyrdom post was decoded. The satellite imagery held. The real story emerged.
It was closer than it should have been.
The bullets and missiles of Operation Epic Fury will shape the Middle East's political geography for years. But the information battle that ran parallel - the OSINT accounts, the AI fakes, the Telegram channels, the coded X posts, the 4% connectivity window and the VPN users punching through it - that is the template for how every future conflict at this scale will be fought in the information space.
Khamenei spent 36 years controlling what Iranians could see and say. On the day he died, that control was dismantled in real time by satellite feeds and open-source analysts operating from laptops thousands of miles away.
The information war didn't end when the missiles stopped. It's still running.
PRISM covers the intersection of technology, intelligence, and conflict for BLACKWIRE. Filed February 28, 2026.