Indian Political App Tek Fog Allegedly Hijacked Trends and Manipulated Public Opinion on Other Social Media Platforms

The Indian political social media app Tek Fog allegedly allowed operatives affiliated with the ruling political party to hijack social media trends and manipulate public opinion on other apps such as Twitter and WhatsApp, which opposition parties denounced as a national security threat.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.1 Disinformation, surveillance, and influence at scale

The Tek Fog app was systematically used to conduct large-scale political disinformation campaigns, manipulate public opinion, and hijack social media trends to influence democratic processes.

Additional risk subdomains

• 4.3 Fraud, scams, and targeted manipulation: The app targeted specific female journalists for coordinated harassment, abuse, and personal data phishing to silence their reporting.
• 1.2 Exposure to toxic content: The system generated and disseminated millions of highly abusive, sexist, and hateful replies across social media platforms.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was driven by human political operatives who intentionally deployed and utilized the Tek Fog app to manipulate public opinion and target critics.

EU AI Act risk tier

• Risk tier: 1 Unacceptable

Unacceptable Risk: The report describes an AI system used for subliminal manipulation, behavioral influence, and coordinated psychological operations at scale, which poses significant dangers to society and violates fundamental rights.

AI system and alleged parties

• AI system: Tek Fog
• AI purpose: Social Media Content Generation; Automated Content Curation
• Behaviour type: Tool
• Alleged developer: Persistent Systems
• Alleged deployer: Bharatiya Janata Yuva Morcha
• Alleged harmed parties: Indian women journalists, Indian voters, Indian social media users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Severe, indirect Negligible
• Differential treatment: direct Minor, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Minor, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: The report explicitly describes the generation and dissemination of massive amounts of toxic content and hate speech.

Directly caused: Over 800,000 abusive replies were sent to female journalists, and 2.2 million posts (58% of analyzed ShareChat posts) were classified as hate speech.

Inferred additional harm: Millions of social media users in India were exposed to highly toxic, sectarian, and misogynistic content amplified by the automated network.

Differential treatment

Reported: The report explicitly describes differential treatment targeting individuals based on gender, religion, and political views.

Directly caused: Female journalists and Muslim women were systematically targeted for harassment and abuse using a database categorized by religion, gender, and political inclination.

Inferred additional harm: The automated targeting of specific demographic groups likely exacerbated existing societal biases and marginalized these groups in public digital spaces.

Civil rights

Reported: The report explicitly describes violations of human and civil rights, specifically the right to free expression and safety.

Directly caused: Journalists' right to free speech and safety was violated through systematic harassment, rape threats, and invasion of privacy aimed at silencing them.

Inferred additional harm: The coordinated silencing of critics represents a broader, systemic threat to the civil liberties and human rights of citizens under democratic governance.

Democracy

Reported: The report explicitly describes the erosion of democratic norms through inauthentic social media manipulation.

Directly caused: Political operatives hijacked trending topics on Twitter and Facebook to artificially inflate the popularity of the ruling party and drown out opposition voices.

Inferred additional harm: The integrity of democratic elections and public discourse in India was severely compromised by the covert use of military-grade psychological operations tools.

Privacy

Reported: The report explicitly describes privacy violations through account hijacking and unauthorized data harvesting.

Directly caused: Operatives hijacked inactive WhatsApp accounts of private citizens to message their contacts and phished personal information to build a cloud-based political database.

Inferred additional harm: Thousands of private citizens likely had their personal data compromised and stored without consent, exposing them to unauthorized surveillance and future targeting.

Psychological

Reported: The report explicitly describes severe psychological distress and fear experienced by targeted journalists due to automated abuse.

Directly caused: Prominent female journalists like Swati Chaturvedi and Rohini Singh experienced severe distress, anxiety, and fear from receiving thousands of daily automated abusive messages and rape threats.

Inferred additional harm: It is highly likely that many of the other 280 targeted female journalists and citizens in the database suffered similar psychological trauma and anxiety from the coordinated harassment.

Epistemic

Reported: The report explicitly describes epistemic harm through the creation and dissemination of fake news and political propaganda.

Directly caused: Operatives used ShareChat to test and curate fake news before automating it to other platforms, and created fake news articles with realistic URLs to deceive the public.

Inferred additional harm: The widespread dissemination of fabricated information eroded the shared consensus reality and created highly polarized information bubbles for millions of citizens.

People affected

• Occurrences reported: 1
• People reportedly harmed: 280
• People reportedly exposed: 160000000

Potential causes

Management

• Prioritizing Growth Over Security: Platforms prioritized user engagement over securing APIs against abuse.
• Political IT Cell Supervision: Management directed operatives to use Tek Fog for narrative manipulation.
• Private Corporate Complicity: Private tech firms developed and supported the malicious app infrastructure.

Technology

• Vulnerable Platform APIs: Social media APIs allowed external apps to bypass security controls.
• Automated Bot Networks: Bots were used to scale up harassment and manipulate trending topics.
• Lack of Robust CAPTCHA Controls: The app bypassed reCAPTCHA and OTP verification to automate actions.

Data Inputs

• Unsecured Inactive Accounts: Inactive WhatsApp accounts were hijacked using token theft techniques.
• Granular Citizen Databases: Data on religion, gender, and profession was used for targeted abuse.
• Google Sheets Integration: Google Sheets provided automated inputs for derogatory auto-replies.

Human Factors

• Operative Compliance: Paid operatives manually directed harassment and executed tasks.
• Targeting of Female Journalists: Human bias and malice led to systematic targeting of female critics.
• User Trust Exploitation: Operatives exploited contacts of hijacked accounts to spread spam.

Process and Methods

• Inadequate API Auditing: Social media platforms failed to audit external API usage effectively.
• Lack of Content Moderation: Platforms failed to detect and block hate speech in regional languages.
• Deficient Account Verification: Weak verification allowed the creation and integration of bot accounts.

Regulatory Environment

• Weak Digital Privacy Laws: Absence of strict laws allowed unauthorized citizen databases to exist.
• Lack of Platform Accountability: No regulatory pressure on platforms to secure APIs and block bots.
• Inadequate Election Oversight: Regulators failed to monitor digital manipulation in political campaigns.

Information quality

• Classification confidence: Medium
• Reason for confidence: The investigative reports provide extensive forensic and technical analysis, including server tracking and script verification. However, the accused political party and private corporations issued strong denials, and direct access to the app's source code was not available, introducing some conflicting accounts.
• Ambiguities identified: The exact internal algorithmic architecture of Tek Fog remains opaque, and there are conflicting statements due to corporate and political denials.
• Alternative interpretations: The app could be interpreted as a collection of standard automation scripts and APIs rather than a unified advanced AI system, though its scale and impact align with AI-driven risk.
• Missing information: Direct access to the Tek Fog source code, independent audits of the servers, and official platform investigation reports from Meta and Twitter.

The Tek Fog incident represents a highly sophisticated, domestic, AI-enabled information warfare campaign in India. By automating harassment, hijacking trends, and bypassing platform security, the tool undermined democratic norms, targeted civil society, and demonstrated how consumer-grade automation can be weaponized for political psychological operations.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: India
• Alleged perpetrator: Political operatives affiliated with the Bharatiya Janata Party

Threat characteristics

• Imminence: Long-term. The incident represents an ongoing, post-deployment strategic capability rather than an immediate, fast-moving crisis.
• Autonomy: Human-supervised. The system operates with high automation for generating and posting content but is ultimately directed and supervised by human political operatives.
• Novelty: Evolved capability. While social media botnets are established threats, the integration of security-bypass features and targeted demographic databases represents an evolved capability.

Impact by dimension

• Physical security: Negligible. No physical security threats or critical infrastructure disruptions were reported in connection with this incident.
• Information security: Substantial. The app functioned as a large-scale automated information warfare tool, generating millions of toxic posts, hijacking trends, and conducting coordinated harassment.
• Sovereignty: Substantial. Operatives used the tool to manipulate public discourse, artificially inflate political popularity, and target critics, posing a threat to democratic processes.
• Economic security: Negligible. No significant threats to economic stability, financial systems, or strategic technological assets were reported.
• Societal stability: Substantial. Systematic targeting of female and Muslim journalists for automated harassment and hate speech directly undermined human rights, privacy, and social cohesion.