The Islamic State (ISIS), despite losing its self-declared caliphate in Iraq and Syria over half a decade ago, remains a potent force in the global ideological landscape. In the recent publication of its newsletter al Naba 526 titled “The Pride of Sydney”, the organisation discusses the use of online platforms to radicalise, mobilise, and attack, citing the Bondi Beach attack in Sydney, Australia, as a perfect example. The Islamic State’s digital operations in 2025 remain a key pillar of its modus operandi, enabling it to maintain global influence and achieve its operational goals, particularly targeting younger demographics who are both most active online and vulnerable to radicalisation.
Contemporary jihadist activities, from the Bondi Beach attack to sporadic plots in Europe, North America and beyond, highlight this continued online dependence and its ability to drive people towards violence without direct contact.
Image: Al Naba 526, December 2025
Source: MEMRI and Google Translate
The group’s digital presence functions across three overlapping layers. First, it disseminates ideological material such as videos, newsletters, posters, and sermons, designed to normalise violence and frame it as both religiously sanctioned and socially necessary. Second, it uses online spaces to provide moral validation and psychological reinforcement to sympathisers, often through peer-to-peer interactions rather than formal recruiters. Third, and most concerningly, it promotes a model of action that requires minimal guidance, resources, or organisational affiliation.
This shift reflects a strategic calculation. Lone-actor or self-activating attacks are harder to detect, cheaper to execute, and more resilient to leadership decapitation. The internet enables ISIS to maintain influence even when its physical infrastructure is compromised.
Online Propaganda: Beyond Traditional Messaging
ISIS’s online strategy has always been multifaceted, beginning with high-production visual messaging and evolving into an agile, linguistically diverse ecosystem that reaches audiences across continents. At its peak, in 2015, ISIS had around 46,000 Twitter accounts, releasing custom-made propaganda in multiple languages, which has since decreased. However, it is still able to sustain itself with regular online propaganda on X, Telegram, TikTok, Facebook, Instagram, and YouTube.
Table: Estimated Presence of ISIS-Linked Accounts Across Platforms until 2024
| Platform | Estimated ISIS-Linked Accounts | Notes for Policymakers |
| Telegram | 6,000-8,000 active accounts and channels. | Core ecosystem for operational messaging, ideological indoctrination, and rapid reconstitution after takedowns. |
| X (Twitter) | 1,500–3,000 at any given time | Primarily amplifiers, not originators; heavy churn due to suspensions. |
| TikTok | 800–1,200 episodic accounts | Short-form propaganda, martyrdom aesthetics, and algorithmic reach to minors. |
| Facebook/Instagram | <1,000 combined | Mostly low-visibility supporters and recycled material. |
| YouTube | <300 channels at any time | Re-uploads, archival material, and long-form sermons |
| Other Platforms (RocketChat, Hoops, and Matrix) | Growing but unquantified | Shift towards decentralised and encrypted ecosystems |
Source: Author’s Own and Younes Karimi, 2024.
This continued online presence is significant for two reasons. Firstly, it allows narrative continuity by which ISIS and its affiliates translate core themes such as militancy as religious duty, western interventions as existential threats, and martyrdom as religious duty, into culturally and linguistically localised material. Secondly, the internet enables parallel spread of these messages; users, rather than central media organs, often become vectors of propagation and amplification through sharing, reposting and discussion threads.
Recruitment in the Digital Space
Contrary to the tiered recruitment networks of previous decades, modern ISIS strategy increasingly prioritises networking and mobilisation via online channels, earning the group the moniker ‘cyber caliphate’. These digital ecosystems have enabled not only the dissemination of propaganda but also the cultivation of interpersonal connections among sympathisers worldwide.
For instance, Europol’s 2023 report noted that the majority of jihadist propaganda now circulates through encrypted platforms and social media, with Telegram, RocketChat, and Discord emerging as key nodes of activity. This shift correlates to the rise of so-called “ISIS-inspired” or lone-wolf attacks, where individuals radicalised primarily online carry out violence independently. Examples include the 2020 Vienna attack, the 2021 Auckland supermarket stabbing, and the 2021 Kongsberg bow-and-arrow attack in Norway, each involving perpetrators with demonstrable online exposure to ISIS narratives. Even the Bondi Beach attack was an Islamic State-inspired act of terror. These incidents underscore how digital radicalisation continues to translate into action, even in the absence of structured organisational control.
Quantifying Influence: Who Is Reached Online?
Quantifying the number of individuals “influenced” by ISIS ideology is challenging due to the lack of uniform data across regions, languages, and platform architectures, complicating detection and prevention efforts. The passive consumption of content and ideological sympathy to active engagement in extremist forums or operational planning is what highlights the ISIS presence online.
Unlike earlier phases of jihadist mobilisation, physical proximity or face-to-face recruitment is no longer essential. Online ecosystems enable individuals in Europe, South Asia, and West Asia to engage with ISIS-aligned narratives independently, often across multiple platforms, before migrating to encrypted spaces.
The individuals drawn into ISIS’s orbit are young, digitally fluent, and navigating complex socio-political identity challenges in their communities. Their online presence begins with curiosity, followed by progressive exposure to striking narratives that promise an ideal world.
Thereafter, it exploits the vulnerabilities of the individuals in the diverse societies. Social media algorithms, while not causal agents, create echo chambers that strengthen and normalise extreme views, increasing the risk of transition from passive consumption to active following.
Outlets such as al-Naba, Amaq, and a constellation of semi-official supporter channels continue to frame social differences, global events, selectively reference attacks, and reinforce ideological narratives. Digital content including propaganda videos, manuals, and discussion groups, continues to circulate, replicating itself across mediums. These ecosystems do not require constant creation of new content; reuse and resale of archived material maintain ideological accessibility.
Table: Scale of Online Influence (Not Membership)
| Region | Estimated Individuals Exposed to ISIS Ideology Online | Policy Relevance |
| Europe | 1.2-1.8 million | Radicalisation risk clusters among second-generation migrants and prison populations |
| South Asia | 3.5 million | Ideological competition with local jihadist groups; recruitment narratives are increasingly digital |
| West Asia and the Middle East | 8-12 million | Legacy networks, conflict memory and grievance mobilisation |
| Global (Conservative) | 20-25 million | Exposure, in some cases, leading to radicalisation, represents algorithmic reach |
Source: Author’s Own and Younes Karimi, 2024.
Attribution and Accountability of Attack
Recent attacks linked to ISIS in the Bondi Beach killings illustrate a consistent challenge: distinguishing between actual organisational direction and post hoc online claim-making. ISIS and its affiliates claim attacks on encrypted channels and unofficial forums. These claims are disseminated globally through messaging networks, creating the impression of a coordinated operation even when direct ties are absent or unverified.
Till 2024, ISIS-affiliated media outlets and supporter networks have claimed approximately 400 violent incidents globally and on some occasions (Europe, South Asia), claims emerged before verification, later being withdrawn. Therefore, digital claim-making increasingly functions as strategic signalling rather than operational proof. Hence, claim-making should be treated as an information operation, rather than as an immediate confirmation of organisational involvement.
This pattern of attribution has two policy implications. On the one hand, it complicates threat assessment and attribution, making it harder to distinguish between inspired, autonomous actions and centrally coordinated operations. On the other hand, it artificially amplifies perceived organisational reach. Responsible counter-terrorism analysis, therefore, requires careful differentiation between propaganda claims and verified operational involvement, avoiding assumptions that embed unverified assertions into public discourse.
Policy and Strategic Considerations
Effective responses to online extremism require coordinated action by both policymakers and civil society. Policymakers must move beyond automated content removal toward a more nuanced approach that integrates contextual and linguistic analyses to detect evolving extremist narratives and platform migration patterns. This effort should be grounded in robust interdisciplinary research that examines how algorithms amplify content, how propaganda adapts to new digital environments, and how individuals progress along radicalisation pathways. Evidence-based findings from such research can help shape proportionate policies that uphold freedom of expression while improving the precision of intervention strategies.
Equally important is the development of differentiated threat assessments that distinguish between passive ideological sympathy and active operational intent, ensuring that enforcement resources are directed toward credible risks. At the same time, preventive and rehabilitative measures address early-stage radicalisation.
Alongside these policy measures, civil society plays a critical role in building community resilience through digital literacy, local engagement, and the creation of culturally credible counter-narratives. Empowering community voices to challenge extremist messaging sensitively and authentically strengthens social cohesion and undermines the appeal of violent ideologies at their roots.
Conclusion
ISIS and its affiliates are adapting to the limitations of post-territorial revolution, in which the internet remains central to their strategy. The digital age has made access to extremist narratives cheaper, faster, and customised, further lowering the thresholds for engagement. It has diffused recruitment from tiered pipelines to networks of influence and inspiration. Understanding this evolution requires both granular analysis and empathetic insight into the human dynamics underpinning online radicalisation.
The challenge for governments, civil society, and technology platforms is not merely to suppress content but to disrupt the ideological appeal that draws susceptible individuals into violent extremism. This demands not only robust security measures but also sustained investment in resilience, research, and community-led engagement, taking a holistic approach to countering a threat that has already evolved far beyond traditional battlefields.
Soumya Awasthi is a Fellow, Centre for Security, Strategy and Technology (CSST) at the Observer Research Foundation
This article was originally published on the Observer Research Foundation website.