The TikTok Caliphate: How Jihadist Supporters Exploit Algorithmic Recommendations and Evade Content Moderation

Introduction

Over the past two decades, social media platforms have become central to how people share ideas and form communities. Yet these same infrastructures are exploited by extremist groups who leverage the participatory affordances of social media to spread propaganda and recruit followers at scale. This is a particular concern with jihadist organizations like ISIS and al-Qaeda, which have long demonstrated their capacity to adapt to new media environments and circulate propaganda (Lakomy, 2023). While recent investigations reveal that jihadist actors are active on TikTok (Ayad, 2025; Organisation for Economic Co-operation and Development [OECD], 2024), little is known about their communicative strategies. This study offers one of the first in-depth analyses of jihadist activity on TikTok, expanding the literature’s existing focus on far-right extremism (Hohner et al., 2024; Ozduzen et al., 2023; Pantucci & Ong, 2021) and bringing new insight into how jihadist propaganda adopts platform-specific logics.

In what follows, we trace the evolving relationship between terrorism and media, examine the regulatory landscape, and outline the cultural logics, affordances, and moderation challenges that make TikTok attractive for extremists. Next, we describe how we located and analyzed pro-jihadist videos, strategically enrolling the platform’s recommendation system and inductively identifying communicative strategies used to evade content moderation. We introduce our typology of five strategies: audio camouflage (manipulating recorded audio and metadata), meme infiltration (embedding extremist content within pop culture references), blurred intent (distorting sensitive visuals), emoji codes (using coded language and symbols), and bait-and-switch (deferring the reveal of extremist messaging). Our typology provides an adaptable framework for investigating content moderation evasion across groups and platforms. In the discussion, we show how jihadist exploitation is symptomatic of vulnerabilities in TikTok’s architecture—its recommendation loops, participatory features, and uneven moderation practices—shifting the focus from content removal to infrastructural critique. We complement this analysis with policy recommendations for the industry and regulators. In this way, our typology deepens scholarly understanding and equips policymakers and practitioners with a map of the adversarial creativity that sustains extremist communication on social media.

Mediated Terror and Propaganda

“Terrorism,” Gabriel Weimann (2022) explains, “always had a communicative dimension” (p. 554). Yet, the communicative dimension has become more pronounced with the rise of modern media systems. The 1972 Munich Massacre, in which Palestinian terrorists killed 17 Israeli athletes, marked the first major terrorist attack that was a media event. Seeking to spotlight the Palestinian cause, members of Black September, the group responsible, concluded that “the choice of the Olympics, from the purely propagandist’s viewpoint, was 100% successful” (quoted in Weimann, 2022, p. 554). Years later, the September 11 attacks solidified the media’s central role, with al-Qaeda’s assault demonstrating the media’s power to instill widespread fear (Kellner, 2004). The rise of the Internet, and later “decentralised, diversified new media platforms” (Weimann, 2022, p. 568), has called into question the ability for terrorists to stage global media events, but brings new opportunities to coordinate operations and radicalize the public (Lakomy, 2023).

We focus on the use of media by jihadist groups like ISIS and al-Qaeda, organizations that have been especially successful in their communicative strategies and have created a template replicated by other terrorist organizations like Boko Haram and adapted by states like Iran, Russia, and Syria (Farag, 2017). However, to clarify our focus and terminology, we understand jihadism as “a modern fundamentalist ideology that frames armed confrontation with political rivals as both theologically justified and instrumentally effective for socio-political change” (Ashour, 2011, p. 379). We distinguish between the radicalized use of the term by jihadist groups and the broader Muslim concept, which can refer to peaceful striving against aggression and corruption (Hasanzadeh & Renani, 2023). Jihadism represents a radical minority within the wider Salafi movement, which “revolves around strict adherence to the concept of tawhid (the oneness of God)” (Wiktorowicz, 2006, p. 208). Yet its followers differ sharply over how this creed should be interpreted and enacted in the modern world. Indeed, other branches of Salafism have denounced jihadists as khawarij—those who rebel against authority and are not recognized as Muslim, a grave insult within Sunni tradition (Amghar, 2023).

Although the leadership of jihadist groups perceives the media as a potential threat to authority and morality, they believe that communicative technologies can serve organizational purposes when used correctly (el-Aswad et al., 2020). Since the early 21st century, ISIS and al-Qaeda have made use of television, radio, and online magazines, relying on designated communications divisions to spread propaganda, shape perceptions, and enforce unified ideological narratives (Piwko, 2021; Weimann, 2022). If the Black September and 9/11 attacks marked terrorism as a media spectacle, the rise of Web 2.0 has turned that spectacle into a “digital jihad” (Lakomy, 2023). Jihadist groups have been early adopters of Web 2.0 offerings, including chatrooms and online forums like Yahoo! eGroups, online multi-player virtual worlds like Second Life, and platforms like Myspace, Twitter, Facebook, and YouTube (Weimann, 2010). These technologies have enabled organizations to orchestrate attacks remotely (West, 2016) and integrate propaganda into the rhythms of everyday digital life (Thompson, 2011), radicalizing sympathizers far from conflict zones to significant effect (Choi et al., 2018; Speckhard et al., 2018). By the mid-2010s, ISIS and al-Qaeda also harnessed encrypted apps like Telegram to recruit members, coordinate movement, and disseminate tactical guidance (Bloom et al., 2019). Jihadist groups now operate in a multi-layered ecosystem where propaganda, recruitment, and operational planning intersect across platforms.

Within this ecosystem, jihadist groups strategically employ different communication channels. For example, both ISIS and al-Qaeda have used YouTube to distribute highly produced propaganda videos due to its reputation as the “prime platform for engaging with international media outlets” (Murthy, 2021, p. 805). In the 2010s, Twitter provided a platform to justify attacks and circulate video footage (Choi et al., 2018). The platform’s conversational structure provided ISIS with a direct line to Western audiences, further enhanced by the presence of European foreign fighters who tweeted in their native languages (Klausen, 2015). Jihadist organizations have used Twitter and Facebook to “glamorize” extremism (Carter et al., 2014). Despite general tendencies, organizations vary in their use of social media, with a comparative analysis concluding that “Al Qaeda predominantly used cyber-resources to promote its ideologies, while ISIS used cyber-resources to primarily create fear and justify their cyberterror actions” (Choi et al., 2018, p. 31). Similarly, a large-scale analysis of pro-ISIS Tweets from France, the United Kingdom, Germany, and Belgium found that local indicators of anti-Muslim sentiment correlated with online radicalization, offering a caution against looking at online content in isolation from offline conditions (Mitts, 2019).

The accessibility of social media simultaneously expands the reach of jihadist propaganda and reduces organizational control over messaging. Official communication channels exist alongside networks of disseminators, referring to “unaffiliated but broadly sympathetic individuals” who shape social media conversations around Salafi jihadism through commentary, translation, and cultivated interactions with followers (Carter et al., 2014, p. 8). Via strategic use of video, music, and multilingual translation, ISIS crafted a digital vernacular that resonated with Western youth (Klausen, 2015). Such communicative practices are an “effective virtual propaganda machinery” (Gates & Podder, 2015, p. 108) that draws on Western cultural symbolism—like images of militants with Nutella jars—to attract young audiences. In this vein, Klausen (2015) shows how playful elements, like “tweets of cats and images of camaraderie” (p. 4), bridge the gap between suburban life and war zones.

This strategy is part of a broader trend where pro-jihadist ideologues adopt platform vernaculars, youth-focused aesthetics, and alt-jihadi styles. Ayad (2025, p. 6) shows how the “digitally astute generation of jihadi fan boys and ‘edgelords’ are forming collectives and infusing new aesthetics and language into unofficial Islamic state propaganda.” Huey (2015) similarly documents how political jamming renders terrorism appealing to young audiences accustomed to dark humor, contributing to the rebranding of “jihadi cool” as a hip subculture. The case of Colleen LaRose, a US woman who became known as “Jihad Jane” after moving rapidly from online sympathy to plotting violent action, illustrates how these rhetorics can accelerate “a self-radicalizing terrorist to move into the stage of radical violent action” (Picart, 2015, p. 358). Taken together, these findings suggest that meme-driven aesthetics and platformed vernaculars make extremism accessible, relatable, and ultimately actionable.

Regulating Terrorism and Extremism on Social Media

Responding to the rise of “digital jihad” (Lakomy, 2023), governments, organizations, and commercial platforms have introduced regulations to combat terrorist propaganda and recruitment (Borelli, 2023). However, these efforts face jurisdictional challenges due to the transnational nature of social media platforms (Palladino et al., 2025) and a lack of agreement over the definition of terrorism (Antúnez & Tellidis, 2016). For instance, Hezbollah in Lebanon and Hamas in Palestine are designated as terrorist entities by some states, while others regard them as resistance movements or political actors (Sadiki, 2010), demonstrating the contentious politics inherent to classification (Ganor, 2002). Finally, there are fundamental disagreements over the desirability of international cooperation (Shackelford & Craig, 2014), leading to the rise of regional cooperation based on ideological similarities, such as the Council of Europe’s Convention on Cybercrime (Wu, 2015).

In this fragmented regulatory environment, legal obligations for platforms remain unclear. Gillespie (2017) distinguishes three main approaches to platform liability: shielded (e.g., the United States and Section 230 of the Communications Decency Act), conditional (e.g., the European Union’s Digital Services Act, which specifies the conditions under which platforms are liable for types of harmful content), and strict (e.g., the expectation to screen and prevent the circulation of particular types of harmful content in China). In the context of terrorist recruitment and propaganda, Section 230 complicates efforts to prosecute platforms, whereas the conditional liability regimes of Europe often have stricter laws. For example, in Germany, the Network Enforcement Act requires platforms to remove illegal content within 24 hr to 7 days or face fines up to €50 million (Bundesamt für Justiz, 2018). The UK’s 2023 Online Safety Act takes a middle-ground approach, obliging platforms to reduce exposure to illegal content and meet transparency standards (Neudert, 2023).

While public actors play a role in monitoring terrorist content online, social media platforms play a “fundamental role in establishing and enforcing the global governance regime on terrorist communication” through policies, content moderation, and international collaborations (Borelli, 2023, p. 2878). TikTok’s Community Guidelines, for example, prohibit violent and criminal behavior, hate speech and hateful behavior, and violent and hateful organizations and individuals. The explanations of hate speech and hateful behavior, defined as “content that attacks people based on protected attributes like race, religion, gender, or sexual orientation,” are more detailed than the explanations of what counts as a violent and hateful organization or individual (TikTok Community Guidelines, 2024). Terms like “Violent Extremist Entities” are left unspecified, following revisions to these policies in early 2023 when TikTok removed prior explicit references to terrorism, thus making enforcement more ambiguous (OECD, 2024).

Beyond individual platform policies, major tech companies have engaged in efforts to coordinate industry responses to the problem of terrorist content. In 2017, Facebook (Meta), Microsoft, Twitter (now X), and YouTube formed the Global Internet Forum to Counter Terrorism (GIFCT) (Borelli, 2023; Murthy, 2021). The forum manages a shared hash database to automatically detect and remove known terrorist content, develops best practices for content moderation, and conducts policy research related to terrorist uses of the Internet (Borelli, 2023). While this represents a significant investment, it lacks transparency and independent oversight, raising concerns over who defines terrorist content and the risk of political censorship (Gorwa et al., 2020). TikTok, notably, is not a member of the forum, although it has participated in other industry coordination efforts, such as supporting the UN-launched organization Tech Against Terrorism (de Bailliencourt, 2022). Regardless of the configuration, these efforts index a broader structural shift where tech companies like Facebook and Google have moved from content moderators to global security actors, shaping counterterrorism policy via self-regulation and private governance (Borelli, 2023).

The Challenges of Content Moderation on TikTok

While TikTok plays a “fundamental role” in governing online speech (Borelli, 2023), it has been widely criticized for both the content it removes and the content it permits. Interviews with creators from marginalized groups have found widespread belief that the platform disproportionately targets the content and accounts of minority users (Delmonaco et al., 2024; Harris et al., 2023). Similarly, academics have theorized the platform’s biases as a kind of “algorithmic ableism” (Rauchberg, 2025) and “racialized surveillance” (Peterson-Salahuddin, 2024). Alongside concerns with the restriction of visibility, research from civil society and academia has also problematized what gets amplified on the platform. For example, a report from the OECD (2024) placed TikTok among the top 10 platforms used to spread terrorist and extremist content. Other research has documented the operations of far-right networks (Hohner et al., 2024; Ozduzen et al., 2023) and processes of radicalization (Pantucci & Ong, 2021; Shin, 2024), along with an array of harmful content types, including anti-Semitism (Salhi & Goldhorn, 2025; Weimann & Masri, 2021), racial stereotypes (Matamoros-Fernández et al., 2022), and political propaganda (Bösch & Divon, 2024). TikTok is certainly not alone in this public scrutiny; social media faces a “looming legitimacy crisis” around content moderation due to rising polarization and a broader backlash against big tech (Hallinan et al., 2025, p. 2). Yet the research on TikTok also suggests some platform-specific contributing factors.

First, the design of TikTok, especially its emphasis on personalized recommendations, complicates effective platform moderation. The “For You” Page (FYP) curates content based on user behavior and is the default mode for using the platform (Duguay & Gold-Apel, 2023). As a result, if users engage with extremist content, the FYP will prioritize similar material, creating a feedback loop that pushes them further into radicalization pipelines (Shin, 2024). A study of anti-Semitic tropes on TikTok underscores this risk, identifying a “spiral of hate” that pushes users into “a rabbit hole of dangerous content” (Weimann & Masri, 2021, p. 702). Interactive features also provide opportunities for extremists. For example, the “stitch” option lets a user include a portion of someone else’s video in a response, while the “duet” lets a user add commentary on top of the original video (Quick & Maddox, 2024). On one hand, TikTok encourages political engagement with users who hold opposing views (Kligler-Vilenchik & Literat, 2024). On the other hand, the platform can be used to target political out-groups through hate speech and antagonistic messaging (González-Aguilar et al., 2023). Finally, TikTok’s audio features can be exploited to spread misinformation, including reusing sounds for coordinated campaigns, creating audio memes for amplifying messages, and reuploading sounds from anonymous accounts to conceal the orchestrators’ identities (Bösch & Divon, 2024).

Second, TikTok’s playful and participatory culture enables the spread of radical narratives. Like any engagement-driven ecosystem, the platform blurs the lines between entertaining expression and harmful messaging, as seen in controversial trends like the “Digital Blackvoice” filter (Conner, 2020) and the “Fox Eye” challenge (Zhao & Abidin, 2023), which reinforce racial stereotypes under the guise of entertainment. Similarly, extremists can use humor, irony, and play to mask harmful messages. An analysis of anti-Semitic content on TikTok found that users spread such tropes through memes (Salhi & Goldhorn, 2025). Content masking is multimodal and includes the use of aural memes to punch “down on historically marginalized groups” in videos about COVID-19 (Matamoros-Fernández et al., 2022). Finally, platform play itself can be weaponized, as in the case of the “Hit & Run” challenge, which gamified real-world violence by promoting physical attacks between Israelis and Palestinians through viral formats (Divon, 2022). Together, these examples show how the platform’s cultural logics can be co-opted to produce, circulate, and normalize extremist ideologies. The coded nature of this content, combined with the platform’s lack of robust detection mechanisms for covert harm, poses substantial moderation challenges (Matamoros-Fernández et al., 2022).

Having surveyed the appeal of TikTok for extremists, we return to the case of jihadist groups and their supporters. While far-right extremism on the platform is established (Hohner et al., 2024; Ozduzen et al., 2023; Pantucci & Ong, 2021), recent investigations reveal that jihadist actors also leverage TikTok to target young audiences (Ayad, 2025; OECD, 2024). Within the enduring challenges of content moderation, where platforms and adversarial actors are locked in a cycle of creating and exploiting conditions for communication, it is important to track how different groups exploit algorithmic recommendations and evade content moderation to compare strategies across groups and social media platforms. Contributing to this endeavor, we asked: What communicative strategies do supporters of jihadi groups employ in videos on TikTok?

Methodology

We adopted a modified grounded theory approach (Kelle, 2007), drawing on existing research to guide our interpretation of user behavior. We focused on two bodies of literature: research on the language and symbolism of jihadist groups and research on social media content moderation evasion. The former pointed us toward key audio, textual, and visual references that structure the propaganda of ISIS and al-Qaeda. In terms of audio, jihadist groups record and circulate nasheeds—a cappella Islamic vocal tracks—that convey political messages through narratives of important battles, martyrs, and organizational leaders (Gråtrud, 2016). Within the Salafi jihadist scene, these songs foster collective identity and mobilization via emotional resonance (Möller & Mischler, 2020). At the textual level, jihadi groups have appropriated emojis like to represent the black standard—historically the flag of the Prophet Muhammad in battle—as a symbol of jihad (Bahari & Hassan, 2014), alongside emojis used broadly by Muslims as markers of belief, such as for prayer, for the prayer solat, and for the Quran (Nasruddin et al., 2018). Visually, jihadist propaganda references iconic figures (e.g., Osama Bin Laden) and events (e.g., the 2001 Tora-Bora battle in Afghanistan). Together, this groundwork enabled the recognition of cultural and semiotic cues of jihadist messaging.

Our survey of the research on social media content moderation evasion revealed similarly multimodal strategies. In terms of audio tactics, users employ algospeak, defined as “abbreviating, misspelling, or substituting specific words” to avoid automated moderation (Steen et al., 2023, p. 1). Users also modify the speed and pitch of recorded audio to avoid automated copyright enforcement (Martin, 2023). Tactics of visual obfuscation include altering branding and blurring logos (Ayad, 2025), and obfuscating faces with emojis and drawings (Moran et al., 2022). Textual tactics, the earliest and best-documented form of evasion, rely on spaces, emojis, and character substitutions to elude automated detection (Ayad, 2025; Gerrard, 2018; Moran et al., 2022). Cutting across the different modalities, social media users employ memes and humor to downplay the seriousness or significance of messages that may violate platform policies (Gillett et al., 2024; Matamoros-Fernández et al., 2022).

We set up a designated anonymous TikTok research account and began the process of “radicalizing” the algorithmic feed to locate TikTok videos from jihadi group supporters. The first author accessed the app using a VPN server from the United States, a country with the largest userbase (Ceci, 2025) and comparatively less restrictive speech laws (Gillespie, 2017). They began by searching for hashtags in English and Arabic related to the canonical events and people mentioned above. They also searched for emojis and religious hashtags used by both mainstream Muslims and jihadist sympathizers, such as Allahu Akbar () and the shahada (). This initial search process developed into a form of algorithmically assisted snowball sampling, where each discovery of a relevant video or hashtag led to additional related accounts, hashtags, and audiovisual tropes. By interacting with and “liking” such content, the author allowed TikTok’s recommendation system to extend the sample organically, assisting in finding relevant creators and communities (Christin, 2020). While this snowball sampling strategy was necessary to access otherwise obscured extremist content, it inevitably limits generalizability. However, given that large-scale, application programming interface (API)-based data collection on TikTok remains inaccessible to independent researchers, manual, platform-embedded approaches like ours represent a viable option.

From there, whenever the author encountered a video in English or Arabic with a message that explicitly supported jihadist groups, they saved the video using TikTok’s bookmarking feature. By constantly comparing these videos with each other and existing research (Kelle, 2007), the first author began to develop a typology of communicative strategies, taking observational notes and capturing screenshots of videos that exemplified different techniques. The first author discussed definitions of each technique with the other members of the research team over a series of meetings. We approached communicative strategies as configurations of semiotic resources—sound, text, visuals, editing, and platform-native features such as filters or overlays (Kress & Van Leeuwen, 2020).

The process of observation and category development took place between January and July 2024. At the end of the period, the first author tabulated the number of bookmarked videos on the research account and found more than 300. Because we relied on platform tools for data collection, the number underrepresents the amount of pro-jihadist content we encountered during our investigation, as delayed content moderation may result in the removal of videos or accounts. Indeed, when we checked the bookmarks of the research account in October 2025, only 25 videos remained out of the original corpus (see Supplemental Appendix Table 1). Relying on platform tools thus comes with notable limitations. The lack of a platform-independent record and loss of videos over time mean that we cannot speak to the prevalence or success of different strategies. Given the legal and ethical concerns with downloading videos (Schellewald, 2021), future research could avoid this situation by using the Python-based package PykTok to collect metadata from relevant video URLs as soon as they are identified (Trillò, 2024). Despite these limitations, our study offers a rich, empirically grounded typology of communicative strategies that can be tested, extended, and refined by others.

Interestingly, the limitations of our approach also offer analytical value for future research. The disappearance of most of the videos more than a year later reveals not only a challenge of data preservation but also a crucial feature of extremist content circulation on TikTok. The platform’s environment is inherently unstable: videos appear, spread, and vanish through a combination of moderation interventions and user tactics. Some removals likely resulted from TikTok’s moderation systems activating only after a delay. Others may reflect deliberate user strategies documented in previous research, where actors engage in ban evasion—that is, “creating a new account strictly after the previous account has been banned for malicious behavior” (italics in original; Niverthi et al., 2022, p. 2615). This pattern underscores how ephemerality itself may function as a tactic of resistance.

Findings

The pro-jihadist content we encountered on TikTok looks, in most respects, like other offerings on the platform, replete with memes, pop culture references, filters, and trending formats. The videos fit squarely within the “alt-jihadi” style (Ayad, 2025), including a seeming lack of official ties to the organizational structures of ISIS or al-Qaeda. While we did not investigate the identities of the accounts posting these videos beyond what they listed in their bios and descriptions, the presentation style has markers of unofficial propaganda. Accordingly, we refer to the accounts posting this content as supporters of jihadist groups and ideologies in what follows. Our analysis presents five main communicative techniques to evade content moderation on TikTok. These techniques often overlap, with multiple strategies appearing in the same video. For analytic clarity, however, we present each strategy independently and highlight relevant aspects of exemplary videos.

Audio Camouflage

Audio camouflage distorts the sound of recorded audio, or metadata about recorded audio, to circulate forbidden messages. Recorded audio, referred to on TikTok as “sounds,” plays a crucial organizing role on the platform (Kaye et al., 2022; Ramati & Abeliovich, 2024; Trillò, 2024). TikTok has a built-in sound library where creators can upload tracks that others can incorporate into their videos, enabling content to spread via shared audio tracks. While the library includes officially licensed music, creators also upload their own versions of popular songs for both aesthetic and pragmatic reasons. The “slowed and reverb” trend offers a prominent example of this practice as a participatory genre where songs are digitally altered using freeware to create slowed-down versions, intensifying emotional resonance and introspection while also helping users evade copyright detection (Martin, 2023).

Jihadist supporters employ similar tactics to camouflage the audio of propagandistic messages. Just as users alter songs to evade copyright takedowns, extremists distort audio to mask radical messaging and bypass automated moderation. This strategy is evident in the manipulation of nasheeds that glorify violence. While TikTok’s Community Guidelines prohibit such messages, extremist actors evade detection by altering the nasheed via autotune, pitch shifts, and tempo changes (see Figure 1a). We identified modified versions of ISIS Nasheeds circulating on the platform, including “Dawlati Baqiah” (My State has Returned, see Figure 1b) and al-Qaeda’s “Tora-Bora” (see Figure 1c). The former proclaims the group’s resurgence while the latter glorifies combat against Christians and praises Osama Bin Laden. The sonic distortions simultaneously make the nasheeds more difficult to automatically detect and signal affiliation with platform aesthetics.

OPEN IN VIEWER

Figure 1.

(a) ISIS’s nasheed “Dawlati Baqiah” played in slow motion. (b) The same nasheed “Dawlati Baqiah” is shown sped up. (c) Al-Qaeda’s nasheed “Tora-Bora” played in slow motion. (d) The audio was renamed as “Contains: My Love” instead of using its original title.

Creators further obfuscate violating activity by camouflaging audio metadata. To evade detection, users often disguise them under unrelated titles, as TikTok removes and blocks searches for violating keywords. For example, the al-Qaeda “Tora-Bora” Nasheed appears under the title “Contains: My Love” (see Figure 1d). The accounts that upload these tracks also lack identifying personal information, in line with the strategies of other propagandists on the platform (Bösch & Divon, 2024). Together, the audio and metadata camouflage tactic exploits gaps in automated moderation, which continues to rely heavily on textual information and struggles to detect subtle audio shifts. Despite these distortions, the nasheeds retain their ideological messaging while blending into TikTok’s broader participatory norms.

Meme Infiltration

Meme infiltration refers to masking propagandistic messages via pop culture references. Pro-jihadist videos incorporated upbeat music, clips of Japanese anime, footage from globally recognized video games like Grand Theft Auto and Counter-Strike, and viral hashtags like #ForYou that blend seamlessly with TikTok’s vernacular (Trillò, 2024). This strategy leverages platform trends and affordances to increase the reach and relatability of messages, camouflaging violent content via the familiar aesthetics of popular culture. It thus represents a TikTok-specific variation of the “content masking” technique Ayad has identified as a general strategy of jihadist communication on social media (2025).

The first example (see Figure 2a) features characters from the game Roblox acting out a scenario where an ISIS soldier executes a Western prisoner. The second (see Figure 2b) shows Omar Mateen doing Fortnite dances in front of the Orlando Pulse Club. The third video (see Figure 2c and d) uses the popular “a new emotion!” meme from the movie Inside Out 2 to depict Western countries as afraid of ISIS. Some of the videos employing the meme infiltration strategy are paired with popular hashtags like #ForYou as well. The fourth video (see Figure 2e to g) features the glorification of Zahran Hashim, an ISIS member who committed a suicide terror attack in a church in Sri Lanka, through a love song called “lovers from the past” by Mareux that talks about wanting to be “just like you.” This is a popular sound that has, as of September 2025, been featured in more than 54k videos on TikTok.

OPEN IN VIEWER

Figure 2.

(a) Impression of an ISIS soldier about to execute an American soldier in the game Roblox. (b) Omar Mateen performing the Fortnite victory dance near the Orlando Pulse nightclub. (c) Scene from Inside Out 2 introducing a new emotion. (d) ISIS soldier was inserted into the same Inside Out 2 video. (e) Start of a longer video sequence showing the Sri Lankan church bombed by ISIS. (f) User expressing adoration toward the terrorist attacker. (g) Image of the terrorist who committed the Sri Lanka attack.

Together, these examples demonstrate how supporters of jihadist groups embed recognizable fragments of the cultural zeitgeist into their messaging to engage broader audiences. Leveraging the appeal of memes, extremists reframe their ideologies into more palatable forms (Hakoköngäs et al., 2020; Trillò & Shifman, 2021), making memetic language a central dialect in communication strategies. Embedding propaganda within memes and viral trends poses a challenge to existing content moderation practices ill-equipped to assess the use of humor (Matamoros-Fernández et al., 2022). The challenge is compounded by the use of play to deal with an array of serious political topics on the platform, including topics and actors that fall within the boundaries of TikTok’s Community Guidelines (Divon & Eriksson Krutrök, 2024; Heřmanová et al., 2025). The layered, multimodal nature of these memes not only obscures the underlying message but also makes them harder to detect with predictive classification systems intended to flag extremist material for human review (Gorwa et al., 2020).

Blurred Intent

Blurred intent refers to the visual distortion or concealment of prohibited people and symbols. We came across videos that depicted and glorified illicit actors, including al-Qaeda and Osama Bin Laden, as well as ISIS and Abu Bakr al-Baghdadi. This strategy reflects another form of content production (Ayad, 2025) and parallels tactics used by other groups at the margins of social media—for example, anti-vaccine communities employing emojis and drawing tools to obscure the faces of banned accounts and sensitive topics (Moran et al., 2022). The depiction and degree of obfuscation vary across videos, ranging from subtle techniques to heavy visual distortions, clarified by accompanying audio. The following examples illustrate how this technique is used to circumvent detection while signaling allegiance through distorted visuals.

The first video features a blurred ISIS flag hung next to a Saudi road sign, accompanied by the text: “It is the island of Muhammad, may Allah bless him and grant him peace” (see Figure 3a). The second video includes a heavily obscured image of Osama Bin Laden’s face (see Figure 3b). The third video has more elaborate and layered visual obfuscations, contrasting a blurred American soldier labeled “2024 uniform” with subsequent carousel images showing ISIS militants about to execute Western prisoners labeled “2015 uniform,” all viewed through a television screen by a cat (see Figure 3c and d). The fourth video depicts a blurred image of Abu Muhammad al-Adnani, former ISIS spokesperson, delivering a speech praising ISIS, layered with a spiritual soundtrack to mask the audio (see Figure 3e).

OPEN IN VIEWER

Figure 3.

(a) ISIS’s flag blurred next to a Saudi Arabian road. (b) Blurred image of Osama Bin Laden with the label “AQ” symbolizing Al-Qaeda. (c) Start of a carousel video showing an American soldier today. (d) Transition to an American soldier depicted as an ISIS hostage about to be executed. (e) ISIS’s former spokesperson Abu Muhammad al-Adnani speaking in a mosque, with his face blurred.

Blurring is widely used by platforms as a moderation technique to reduce harm, allowing users to choose whether to engage with sensitive content (Haimson et al., 2021). However, this very technique has been strategically repurposed by extremist actors, who use visual distortions to evade automated detection systems trained to flag explicit imagery. Human moderators, too, may fail to identify the obscured figure or symbol of hate and terror if they lack contextual knowledge (Wilson & Land, 2020). For the intended audience, however, these visuals are easily decoded; the blurring becomes part of the aesthetic, allowing harmful content to circulate while bypassing detection.

Emoji Codes

Emoji codes mark affiliation and provide contextual cues that guide the interpretation of vague messaging. The polysemy of emojis facilitates the circulation of messages that would otherwise be detected and removed when written out in words, making them highly valuable as a tool to game automated text analysis (Ayad, 2025). Jihadist supporters are certainly not the only actors playing this game. To the contrary, the practice of algospeak has broad cultural uptake among content creators (Steen et al., 2023). A common strategy involves substituting potentially objectionable language with emojis, repurposing platform-native symbols with layered political meanings that are recognizable to in-group audiences (Steen et al., 2023). Similarly, both mainstream Muslims and supporters of radical jihadist groups deploy emoji symbolism to convey religious values, practices, and affiliations (Nasruddin et al., 2018). These coded symbols appear in hashtags, usernames, captions, and within the visual text of videos.

The most frequent emoji we encountered in pro-jihadist videos was the black flag (), a symbol historically associated with the Prophet Muhammad’s army and appropriated by jihadist organizations that use the black standard. Another prominent emoji was the raised index finger (), signifying tawhid, the Islamic concept of the oneness of God (Helm et al., 2020). On their own, such emojis may appear benign or religiously expressive. However, when embedded in broader narratives or clustered alongside specific linguistic cues and imagery, they can serve as coded vehicles for extremist messaging.

The following examples illustrate the strategic deployment of emojis within extremist messages. In the first video, a map is shown alongside an Arabic caption Baqiyah, meaning “remaining” or “coming back,” accompanied by the black flag emoji () (see Figure 4a). This references the ISIS nasheed Dawlati Baqiyah (“My State Remains”), discussed above. The emoji signals allegiance to ISIS, and the map highlights areas of current militant activity. The second example features declarations that Muslims will battle idols and kuffar (infidels), with repeated use of the black flag (Figure 4b to d). A third example shows a man aiming a gun at another man who is praying, with the caption “Fear only Allah,” followed by the and emojis (Figure 4e and f), visually merging martyrdom, defiance, and divine allegiance. In the fourth video, national flag emojis are displayed, only to be dismissed in favor of the black flag emoji, which the narrator claims is the only flag recognized by the Prophet Muhammad (Figure 4g). The background features the Makkah Clock Tower located near the Masjid al-Haram, Islam’s holiest site, reinforcing the ideological aspiration for a unified Islamic state, or caliphate, promoted by groups like ISIS and al-Qaeda.

OPEN IN VIEWER

Figure 4.

(a) Video showing ISIS’s current areas of control, with the word “Baqiyah” in Arabic and the black flag. (b–d) Video featuring a French nasheed with English translation, using the black flag in the description, and displaying violent lyrics. (e–f) Use of the black flag and the “Tawhid” emoji. (g) Black flag emoji is displayed to represent the Islamic Caliphate.

While seemingly innocuous in mainstream contexts, these emojis function as polysemous affiliation codes within specific communities. For example, when Meta banned the red triangle emoji (), citing its use as a proxy for Hamas—a group designated as a terrorist organization by the United States and the EU (Sadiki, 2010)—the move sparked backlash from pro-Palestinian and digital rights advocates, who contended that the emoji expressed resistance rather than terrorism (DiBenedetto, 2024). Although our analysis identifies more overt messaging associated with terror-affiliated groups, these cases reveal how platform governance can oversimplify the context-dependent nature of digital expression. When moderation systems fail to recognize ambiguity, they risk silencing legitimate political speech, especially when such content engages with geopolitically contested symbols.

Bait-and-Switch

The bait-and-switch strategy refers to videos that start with an innocuous message designed to attract attention and lower suspicion, and later pivot toward a more sinister message. By aligning the opening moments with platform norms and trending content, jihadist supporter videos can sometimes bypass early moderation checks. This is partly because moderation systems “pre-screen user-generated content before being published on a platform” (Sheng, 2022, p. 354), relying heavily on surface features—such as visual frames, audio snippets, or metadata—to flag potential violations. Scholars have observed comparable bait-and-switch tactics elsewhere, including “hiding content in cartoons and other innocuous formats, such as using still images of televisions that actually have embedded video within them” (Ayad, 2025, p. 7).

The following examples illustrate diverse applications of this bait-and-switch method. The first video opens with vibrant imagery celebrating Pride Month, accompanied by an upbeat pop song (see Figure 5a to c). Midway, the celebratory tone shifts as the visuals dissolve into a selfie of Omar Mateen—the gunman behind the 2016 Pulse nightclub shooting in Orlando—before cutting abruptly to black. The second video begins with footage of fireworks next to the Washington Monument, accompanied by an American flag and the text “Independence Day (United States)” (see Figure 5d and e). Toward the end, it switches suddenly to a blurred image of Osama Bin Laden, overlaid with a faint al-Qaeda flag and the text “September” with “eleven” subtly crossed out. In the third example, a video depicts highlights of football star Cristiano Ronaldo’s performance. Swiping to the next screen reveals the text: “Just like CR7 dominates 1vs1, that’s how I am willing to die for the Messenger of Allah” (see Figure 5f and g). Finally, the fourth example presents a series of idealized images under the caption “how the world would look if every country had Sharia law,” which transitions to the same images framed as “how the world would look if ISIS ruled” (see Figure 5h and i).

OPEN IN VIEWER

Figure 5.

(a–c) Video depicting a Pride event while slowly revealing an image of Omar Mateen. (d–e) Video appearing to celebrate the 4 July, later transitioning to Osama Bin Laden’s blurred face with references to the “September 11 attacks”. (f–g) Carousel video featuring Cristiano Ronaldo, then shifting toward extremist messaging. (h–i) Carousel post promoting life under Sharia law and imagining a “better” life under ISIS rule.

These examples showcase how extremist creators leverage the hook of familiar and positive content to draw viewers in before abruptly pivoting to radical messaging. A similar tactic is observed in work on large language models (LLMs), where bait-and-switch attacks manipulate the contrast between the surface-level appearance of content and its final message. These attacks are designed to generate text that appears benign at the time of generation but becomes malicious through subtle post-processing, enabling the seeding of future harmful outputs—while making such content “cheaper to obtain without reducing the general effectiveness of the message” (Bianchi & Zou, 2024, p. 2). Although the mediums differ—short-form video versus text generation—the underlying logic is parallel with the use of emotionally disarming cues to slip controversial narratives past algorithmic and human moderation alike.

Discussion

Our analysis shows how jihadist supporters strategically manipulate TikTok’s vernacular cultural practices, technical affordances, and automated systems. This manipulation fuels adversarial creativity on the platform, which we capture through a typology of communicative strategies that form a lexicon of exploitation and evasion. Although adversarial creativity has been practiced by a broad range of actors—such as far-right extremists (Hohner et al., 2024; Ozduzen et al., 2023; Pantucci & Ong, 2021), political propagandists (Bösch & Divon, 2024), and anti-Semites (Salhi & Goldhorn, 2025; Weimann & Masri, 2021)—our study contributes empirical evidence from an underexplored domain. The evolving tactics of jihadist supporters on TikTok resemble the tactics of these groups (Ayad, 2025) and draw on wider repertoires of content moderation evasion (Moran et al., 2022). That similar practices emerge across platforms and ideological positions tells us something about the broader dynamics of adversarial creativity on social media. As Moran and colleagues (2022, p. 9) observe, strategies pioneered by anti-vaccine communities “are not endemic to this particularized online conversation” but also appear among marginalized groups resisting discriminatory moderation. This underscores the dilemma of adversarial creativity: the same tactics can signal manipulation or resistance, and distinguishing between them requires context-specific interpretation that is notoriously difficult to scale.

The affinities between adversarial actors highlight the need for more comparative research. Our typology contributes to this effort by defining strategies independent of ideology, making it adaptable across contexts. It provides a framework for systematic comparison—for instance, examining the prevalence of particular strategies across platforms or groups. An initial investigation of existing research suggests both alignments with and divergences from the strategies of anti-vaxxers on Instagram (Moran et al., 2022). While both groups obscure the faces of leaders who are banned from social media, they draw on different tactics to game text analysis: anti-vaxxers rely heavily on altered spellings (e.g., “Maxine” for “vaccine”), while pro-jihadist videos employed emoji codes. Assessing the significance of these differences would require a dedicated study and points to an important trajectory for future research.

The similarities in evasive strategies across platforms underscore the need for coordinated regulatory responses, particularly around terror-related content. While the industry association GIFCT maintains a shared hash database, develops moderation best practices, and supports policy research (Borelli, 2023), platform participation remains limited. As one of the primary platforms for distributing terror-related content (OECD, 2024), TikTok’s membership in the association would be impactful for both the platform and other members in terms of information sharing and tooling. At the same time, TikTok’s current lack of participation in the association points to the limitations of relying on voluntary industry compliance. Fostering greater coordination between platforms would likely require policy incentives. In a world where private corporations like TikTok and Meta are “global security actors” directing counterterrorism policy (Borelli, 2023), more innovation is needed to develop effective partnerships between public and private actors.

Innovation is also needed to keep pace with the evolving relationship between terrorism, media, and the public. As Weimann (2022, p. 568) observed, “the platforms have changed, the technologies are new, the spread and speed are significantly higher, but the theatre of terror is still performing its deadly shows on the world stage of modern media.” Our analysis confirms this acceleration in the spread of harmful ideologies, yet what we encountered was less a grand spectacle and more a form of everyday extremism, embedded in TikTok’s vernacular practices, aesthetics, and pop culture references. At first glance, the term everyday extremism may appear oxymoronic, yet it resonates with prior work on “jihadi cool” (Huey, 2015; Picart, 2015), which shows how extremist messaging is embedded in cultural styles. Unlike earlier accounts of terrorism as spectacle—dramatic, shocking, staged visibility—or as event—ritualized interruption and collective experience—content from jihadist supporters on TikTok merges the two. Violent imagery and the glorification of attacks appear, wrapped in trending audio, filters, and short-form playfulness, giving them a strangely quotidian quality (Cervi & Divon, 2023). Each upload can be seen as a micro-event: algorithmically staged, collectively recognized by in-groups, and continuously remixed and circulated as ritual participation (Trillò et al., 2022). In this way, spectacle and ritual collapse into one another, rendering terror at once dramatically visible and mundane.

Everyday extremism exploits the structural vulnerability of TikTok. Its recommendation systems, moderation logics, participatory culture, and affordances converge to create a platform architecture that both permits and amplifies the spread of extremist ideologies. But beyond these complex challenges, our research points to basic flaws in TikTok’s moderation design. During our data collection, we found that direct searches for terms like “ISIS,” “al-Qaeda,” or specific nasheed titles typically triggered blocked pages citing guideline violations. Yet slight alterations (e.g., “1S1 S”) easily bypassed these filters, surfacing videos openly glorifying extremist groups without warnings or labels. While platform scale makes moderation difficult, the ease with which such content evades detection is alarming—particularly given TikTok’s large youth user base, many of whom are vulnerable to radicalization (Hotait & Ali, 2024).

We conclude with policy recommendations to address the circulation of radical content on social media. First, platforms need contextual expertise to recognize evolving forms of hate speech. While TikTok provides moderator training and consults experts (TikTok, 2025), our findings show these measures are limited. Moderation could be strengthened by employing staff who reflect user diversity and have specialized knowledge of extremist groups. Second, stronger cooperation is needed across the industry and between platforms and states to respond to the adaptive, multi-platform strategies of adversarial actors. Third, user participation could extend beyond reporting tools. Models such as X’s Community Notes, where users collaboratively contextualize content, could empower civic accountability—as evidenced by user-driven reporting campaigns on YouTube (Fiore-Silfvast, 2012)—but such mechanisms have been weaponized before (Meisner, 2023), meaning that any participatory model would require careful design and safeguards against coordinated misuse.

Still, the potential value of such models becomes clearer when placed in dialogue with the techniques identified in our analysis. For instance, videos that use meme infiltration or bait-and-switch strategies sometimes accumulate hundreds of thousands of views. In these cases, a well-placed community note could counteract deceptive aesthetics by helping users decode hidden messages. Similarly, in content that relies on blurred intent or audio camouflage, contextualizing notes might make distortions more legible and prevent extremist material from circulating under the guise of entertainment. Even emoji codes, which were ubiquitous in the videos we studied, could be addressed through collaborative notes that explain their layered meanings. In this sense, user-driven annotation could directly respond to the evasive strategies we documented, linking analysis and policy concretely.

Conclusion

This article investigated how supporters of jihadist groups promote propaganda on TikTok, identifying five main strategies: audio camouflage, meme infiltration, blurred intent, emoji codes, and bait-and-switch. Our findings underscore the adaptability of pro-jihadist messaging, but the implications extend to the broader ecosystem of harmful online content. Without adequate media literacy and critical thinking skills, users—especially youth—remain vulnerable to these tactics. While our study offers a typology of communication strategies to evade content moderation, it is crucial to acknowledge its limitations and point toward future research. First, our research design did not measure the reach or influence of the strategies. Future studies could assess which strategies are most effective in circulating content or bypassing moderation. Second, our research was limited to Arabic and English, although we encountered content in other languages, especially French. Future investigations should investigate tactics across other language communities. Third, our study focused on short-form video content and did not explore TikTok’s live video ecosystem—an increasingly important terrain that faces distinct moderation challenges (van Boheemen et al., 2025). Fourth, we did not study audience reception, which would provide valuable insights into how propaganda circulates, persuades, or is resisted. Finally, there is a need to assess the impact of media literacy interventions in mitigating the spread and uptake of such content. Taken together, these avenues can deepen our understanding of radicalization in an evolving platform landscape—and help inform more targeted, ethical, and context-sensitive responses.

Supplemental Material