On Aug 2019, a facebook account was hacked and an image of a blonde-haired boy dressed in desert camouflage and gripping a pistol with both his hands stared out from the screen were shared. The image was captioned, in Arabic, “Luqmen Ben Tachafin. He does not tire. He does not bore”.

Over the coming months, the account went silent, and the incident became just another story of social media hacking. That changed in March 2020, when Facebook accounts whose bios read “Luqmen Ben Tachafin. I shake your throne and destroy your dreams. Never tired, never bored, until the Judgement Day” began sharing Isis content across the platform. In a span of 87 days, 90 of them would appear – all with the same signature images and bios. Luqmen, the “destroyer of dreams”.

The account was a part of ISIS supporters on Facebook who called themselves the Fuouaris Upload network – after Fuorusiyya, the practice of equestrian fighting popular in 14th Century Islam. From March to May 2020, the network of accounts used Facebook’s platform to spread beheading videos and other Isis videos – sharing altogether 50 pieces of content, which raked in more than 34,000 views.  

In some instances, the network accounts created completely new content. Oftentimes these were audio speeches turned into Isis video montages. The Fuouaris Upload network account Youcef Ibrahim was one account posting such content. On April 28, the account shared a two-and-a-half hour-long audio message titled “rules for those who do not excommunicate unbelievers”, a two-part Arabic audio series delivered by Shaykh Abu Malik al Tamimi, a Saudi cleric turned Isis fighter, who was killed in Homs in 2015. While the content is not the atypical violent videos commonly-attributed to Isis, it does violate platform guidelines by honouring the legacy of a terrorist ideologue.

In between April to July, Fuouaris Upload lost 61 of the 90 accounts it controlled. However, 29 accounts continue to elude moderation, and spread Isis content across Facebook.

Presented with a list of 288 pro-terror accounts, including the whole Fuouaris Upload network, a Facebook spokesperson says the social network had already removed 250 accounts; it took down the remaining accounts on June 7 following WIRED’s enquiry. “We have no tolerance for terrorist propaganda on our platform and remove content and accounts that violate our policy as soon as we identify them,” the spokesperson says. The spokesperson did not answer direct questions about how it moderates video content or whether it is taking countermeasures to prevent the hacking of accounts through virtual phone number apps.

Luqmen ben Tachafin was among the accounts eventually taken down over the course of the network’s 87-day-long spell of terrorist preaching. On July 3, an account with identical name and profile image reappeared – and quickly started sharing new propaganda.