Ever since the arrest of Telegram founder and Chief Executive Officer (CEO) Pavel Durov, IS munasirin and its supporters have been expressing concerns about their Operational Security (OPSEC) on the messaging platform and, broadly speaking, within the IS online ecosystem. It is easy to observe these concerns since authorities have been increasingly directing their attention to Telegram. Following the arrest of Durov, and by examining the ISIS Watch Telegram channel, between August 2024 and June 2025, bans linked to IS or pro-IS material increased by around 240%. Specifically, in the same period, according to the ISIS Watch Telegram channel, 208,689 bots and channels have been deleted. Notwithstanding that, in January 2025, Al-Azaim Media Foundation underlined the centrality of Telegram in the IS online ecosystem in its magazine Voice of Khurasan (VOK) Issue 43:
“Even after its recent policy changes, Telegram continues to provide unique benefits that distinguish it from other messaging apps, particularly for users concerned about security and functionality” (VOK, Issue 43, p. 53).
Concurrently, since August 2024, IS supporters’ concerns of being banned from Telegram have been addressed by pro-IS users as well as IS institutional and non-institutional media outlets. These outlets have made efforts to inform their user base about the range of messaging platforms they can adopt to face Telegram’s stricter moderation policies. In the past, these recommendations have pushed IS munasirin and supporters to explore new applications that combine security, privacy, and anonymity with broadcasting capabilities. This is intimately intertwined with the concept of the Multiplatform Communication Paradigm (MCP). This refers to the strategy adopted by IS and Salafi-Jihadi groups in general to operate on multiple interconnected platforms to communicate with supporters, advocate active proselytism, and spread propaganda. Among these new possibilities, SimpleX Chat emerged as a valuable option. Therefore, this Insight will analyse the IS ecosystem on SimpleX Chat, delving into the main actors and the stream of IS propaganda present on the messaging platform.
What is SimpleX Chat?
According to its website, SimpleX Chat is a messaging platform designed for privacy and security, without compromising its functionalities. Based on its GitHub page, it has a strong End-to-End Encryption (E2E), which protects one-to-one chats, private group conversations, and voice/video calls. Moreover, SimpleX Chat uses a double-ratchet protocol – two parties exchanging encrypted messages based on a shared secret key (like Signal) – combined with an additional encryption layer for every single message. In terms of anonymisation, SimpleX Chat does not require any phone number, email, or personal details to create an account, and it uses one-time invitation links or QR codes to establish connections and temporary anonymous queue identifiers for message routing. Furthermore, all user data is stored client-side in an encrypted database, thus holding messages on relay servers only temporarily until being delivered. This means that once a message is delivered, it is deleted from the server. Another unique feature of SimpleX Chat is “Incognito mode”. When this setting is turned on, a user’s profile name and image are not shared with new contacts. The messaging application generates a random profile name, allowing connections with other users without any shared personal data. Privacy and security are also enhanced by the two-day expiration limit to download files. After that, they are no longer available.
The Pro-IS Online Ecosystem on SimpleX
Since mid-2024, within the pro-IS server on Rocket.Chat, users began talking about SimpleX and its potential by comparing it to Signal. Yet, between late 2024 and early 2025, the first links to channels and chats were shared on the pro-IS ecosystem on the messaging platform, Element, and later on the pro-IS server on Rocket.Chat.
In November 2024, Qimam Electronic Foundation (QEF) – a pro-IS media house focused on OPSEC and technology – shared a handbook on Rocket.Chat called “Easy Guide to Using Simplex Chat” (Figure 1).
Figure 1: QEF infographic – “Easy Guide to Using SimpleX Chat.”
The digital handbook explored the messaging platform’s main features. On Rocket.Chat, several users highlighted Simplex Chat’s high security and privacy levels, underscoring how “SimpleX got more security and privacy features compared to Telegram” (Figure 2).
Figure 2: A pro-IS user’s comment on SimpleX Chat’s security.
On Element, a user shared a double-entry table comparing SimpleX Chat to other messaging platforms like Session, Signal, and Element (Figure 3). Based on different features such as message padding, repudiation (deniability), break-in recovery, 2-factor key, and post-quantum hybrid crypto, it showed how SimpleX Chat gets the best score among the other messaging platforms.
Figure 3: A double-entry table shared by a pro-IS user on Element.
Exploring the pro-IS ecosystem on SimpleX Chat reveals that the available materials are primarily in Arabic. Overall, most of the propaganda content posted belongs to the IS institutional and Ansar Production media outlets. Channels and users share AMAQ News Agency material (such as bulletins, videos, and pictures of military operations), entire issues or editorial from the weekly newsletter An-Naba, and IS institutional videos (Figure 4). Some of them act as nashir channels, sharing only IS institutional propaganda material.
Figure 4: Examples of institutional propaganda material shared on SimpleX Chat (L-R: a video of Wilayah West Africa, an AMAQ News Agency bulletin, and a newsletter of An-Naba).
Several channels and chats also share posters created by Ansar Production media houses – Sarh al-Khilafah Foundation, Sunni Shield Foundation, al-Battar Foundation, Talaea al-Ansar Foundation, At-Taqwa Foundation, and many others (Figure 5).
Figure 5: Examples of Ansar Production’s media houses’ propaganda material.
Considering the majority of pro-IS material shared, it can be argued that SimpleX Chat is primarily dedicated to the propaganda stream of Ansar Production media houses. This is particularly relevant when one considers that, apart from a few channels on Telegram and in the pro-IS server of Rocket.Chat, Ansar Production propaganda is consistently available only on IS’s relatively new surface web archive website since March 2025. Moreover, there are also some channels for non-institutional media houses. Among them, there is also a channel which has been set up to look like a pro-IS forum page.
Overall, the pro-IS ecosystem on SimpleX Chat has more than 60 channels, chats, and users linked to Ansar Production and non-institutional media houses. Yet, without considering single users, almost one-third are duplicates of the same channels or chats, reducing the total number closer to 20. While the presence of duplicate channels and chats originally appeared to be a tactic to enhance their presence, this tactic fades in significance considering that, as channels or chats are not public and accessible via the SimpleX Chat directory, they cannot be banned from the platform. Therefore, there are no valuable reasons to duplicate channels and chats so many times. This could be due to the fact that they create a new link each time they want to share access to their channels and chats. As explained before, SimpleX Chat allows you to generate a new link each time a user wants to connect with other users.
The outlinks stream from SimpleX Chat is mainly directed to web archives or cloud stores to gain access to IS propaganda materials and some IS core messaging platforms, such as Telegram and Element. SimpleX Chat thus partially embodies the configuration of a “content aggregator” platform that, as explained by Fisher et al, “gathers a range of jihadist materials and provides users with a collection of links to locations where a specific propaganda material can be downloaded”. Specifically, in the first case, channels and chats share outlinks mainly to obtain and download IS institutional and Ansar Production videos (as well as older ones) and newsletters of An-Naba. In the second case, many channels and chats mainly share Telegram handles to nashir channels, followed in quantitative terms by outlinks to pro-IS non-institutional media houses’ Telegram channels and groups. Regarding Element, some channels and chats periodically share lists with links to pro-IS Element rooms, which can be in the form of channels or chats. Furthermore, it is worth noting that, some months ago, a user created a channel that works as a directory to other pro-IS SimpleX Chat channels and chats, helping users to easily and rapidly join channels and chats.
Moreover, while SimpleX Chat has attracted the attention of IS munasirin and supporters alike for its qualities in terms of security and anonymity, users also complain that the material is no longer downloadable 48 hours after it has been uploaded. This feature prevents the ecosystem from creating archive channels for IS propaganda material. It is a constant problem for many users, considering that many only have sporadic access to the Internet and do not use the platform constantly.
Conclusion and Recommendations
SimpleX Chat offers strong security and privacy features that position it to become a primary platform within the terrorist online ecosystem. However, despite growing awareness of its capabilities, SimpleX is far from gaining a robust foothold within the pro-IS online ecosystem as a core messaging platform. Since December 2024, the pro-IS ecosystem on SimpleX Chat has grown in quantitative and qualitative terms. In the first half of 2024, the pro-IS ecosystem has increased significantly in the number of channels, chats, and users. Concurrently, the propaganda has been structured around institutional and Ansar Production media houses’ material, giving more relevance to the IS information ecosystem on SimpleX Chat.
Despite the advances in pro-IS users, the posture of pro-IS media houses and munasirin could dramatically shift on the platform. In the first half of July 2025, QEF shared an infographic (Figure 6) in its Element room, warning pro-IS users not to use SimpleX Chat because “SimpleX leaks your IP Address, cooperates with UK authorities and must be abandoned”.
Figure 6: QEF infographic on SimpleX Chat.
The infographic was shared with a PasteThis.to link – a website archive – to a brief text through which QEF underlines the rising concerns of pro-IS users “regarding the platform’s handling of user data, particularly the leakage of IP addresses.” According to QEF, which quotes a case documented on GitHub, “SimpleX can expose user IPs,” underlying how Simplex Chat’s founder admitted that “every server you connect to, be it your ISP, VPN provider, or Tor relay, can see your IP address.” However, QEF also focuses on the fact that “SimpleX has been allowing content from official and supporters media to remain untouched,” emphasising how it is “highly unusual” for a company based in the United Kingdom (UK). Finally, the QEF warning is more than urgent and extremely clear: “We recommend that brothers stop using this App immediately”.
Following the release of the QEF infographic, a user who has been part of the ecosystem for some time pointed out that all social media, whether messaging platforms or social networks, can leak data and work with authorities, inviting fellow users to lead more secure online habits. Another user shared a PDF document on Element that claimed the information provided by QEF is misleading. Nonetheless, other IS supporters and sympathisers disagreed with his counterarguments and expressed a certain degree of mistrust towards the messaging platform.
It is thus quite difficult to understand IS munasirin and supporters’ attitude towards the information shared by QEF, considering how the significant weight of individuals’ simple choices and habits can affect the propaganda flowing from part of IS’s online ecosystem. Certainly, as long as the material is not removed from the platform, IS munasirin and supporters have no reason to abandon SimpleX Chat. Overall, it is worth noting that IS munasirin have always been and will always be focused on sharing propaganda material following the previously described MCP. By quoting the June 2023 Halummu media campaign, IS munasirin must “spread our campaign and media to as many platforms as possible” to wage the “ongoing war between the camp of kufr and the camp of faith […] on the military and media levels”.
Social media companies and messaging platforms like SimpleX should thus increase their efforts to remove or, at least, reduce the IS propaganda stream by understanding the approaches adopted by Salafi-Jihadi groups to conduct da‘wa and spread propaganda material. Specifically, content moderators, as well as technologies that carry out this duty, should not wholly rely on a Western-centred point of view and aim to gain a better understanding of how Salafi-Jihadi groups act and operate within the online dimension. Artificial categorisations and classifications are frequently employed to depict and explain the approaches and concepts underlying the modus operandi and foundational concepts at the basis of Salafi-Jihadi groups’ propaganda. Holding onto strategies built on Western models instead of incorporating Salafi-Jihadi groups’ perspective will keep them one step ahead, making evanescent efforts to moderate and remove propaganda material from social media. Furthermore, since it is clear that IS Arabic propaganda material is less likely to be removed compared to English material, social media platforms should increase the number of Arabic-speaking moderators and better train Artificial Intelligence (AI)-based tools on specific Arabic propaganda material, from both textual and visual perspectives.
—
Alessandro Bolpagni is a senior research analyst at the Italian Team for Security, Terroristic Issues, and Managing Emergencies – ITSTIME. He also specialised in digital HUMINT (Human Intelligence) and OSINT/SOCMINT (Open Source and Social Media Intelligence), oriented particularly on Islamic terrorism and Russian Private Military Companies (PMC). He focused on monitoring terrorist networks and modelling recruitment tactics in the digital environment, particularly on new communication technologies implemented by terrorist organisations. He has produced operational reports and lectures for training and education purposes for companies, research centres, and law enforcement agencies.
Eleonora Ristuccia is a junior research analyst at the Italian Team for Security, Terroristic Issues, and Managing Emergencies – ITSTIME. She specialises in the application of Open Source Intelligence (OSINT) and Social Media Intelligence (SOCMINT) techniques. Specifically, she focuses on the study of jihad communication strategies and propaganda through various online platforms.
—
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.