Across global digital subcultures, extremist networks are increasingly weaponising edgy internet humour and memes to spread covert propaganda. In the West, the far-right extremist movement has successfully exploited the culture of shitposting and internet memes to normalise hate speech in the public sphere. This practice of meme hijacking and the exploitation of pop culture has also been used by ISIS sympathisers, who have constructed subcultural counter-narratives using everyday internet elements, ranging from the ‘mewjahid’ trend on Twitter to humanise extremists to the exploitation of memes featuring characters from popular culture to appeal to a younger demographic.
In Indonesia’s digital ecosystem, this evolution creates a complex security concern. Whereas prior research largely focuses on propaganda crafted by extremists themselves, this Insight examines how unaffiliated local creators inadvertently allow terrorist content to exist on their platforms. Numerous accounts now disguise ISIS footage and jihadist nasheeds with everyday socio-economic grievances as satirical memes or shitposting. Digital footprint analysis reveals most creators lack genuine ideological ties to ISIS. Their focus on mainstream subcultures provides plausible deniability, allowing them to frame terrorist aesthetics as mere edgy humour. However, this Insight contends that this seemingly organic trend poses a profound threat. By subconsciously normalising extremist symbols, it creates a permissive grey area that opportunistic pro-ISIS sympathisers can easily hijack to build networks and establish radicalisation pathways targeting youth.
To understand this phenomenon, this Insight uses qualitative open-source intelligence to analyse social media content with a specific Indonesian regional and linguistic focus, collected between March and August 2026. The Instagram and TikTok content identification process has three stages. First, the author manually searched the platforms using specific audio tracks (such as jihadist nasheeds commonly used in short videos) and keywords that blend Indonesian slang with extremist terminology. Second, by engaging with these initial profiles, the author used the platforms’ built-in recommendation systems to naturally discover a wider network of similar content creators. Finally, the analysis evaluated the comment sections of these viral posts to distinguish between a general audience enjoying dark humour and sympathisers validating propaganda. Together, this approach illustrates a troubling pipeline where digital irony and local social contexts are weaponised to normalise extremism.
The Weaponisation of Irony Poisoning and Social Context
The concept of irony poisoning serves as the primary lens for analysing how organic internet humour can become associated with movements that pose a security threat. In digital subcultures, young people often deliberately breach taboos and moral boundaries to gain social appeal, fostering a culture of edgy humour. When footage of ISIS battles, censored executions, or other attributes of terrorism are remixed into absurd ‘shitposting’ material, this triggers a process of irony poisoning within society. Through repeated exposure to such jokes, the audience becomes desensitised, and their sensitivity and horror towards the reality of terrorist violence gradually fade, with such content instead being regarded as everyday comedic material.
Figure 1: (Left) A TikTok meme framing terrorist recruitment as a ‘Plan B’ for failing university exams. Centre: Instagram Reels using ISIS footage juxtaposed with a news headline about Jakarta student protests. (Right) Instagram Reels exploiting public anxiety over the depreciating Rupiah.
Footage of armed militants on platforms such as Instagram and TikTok is frequently juxtaposed with current socio-political topics trending amongst Gen Z teenagers. For example, failure in Indonesia’s national state university exams (locally known as SNBP and SNBT) is used as the premise for comedy, in which joining a terrorist group is framed as a ‘Plan B’ for students. More concerningly, memes like this are also actively hijacking real-world political momentum. In one case, footage of an ISIS armed attack in the al-Waqif district was juxtaposed with a news headline about student demonstrations in Jakarta in June 2026. This framing dangerously equates democratic civic dissent with militant violence, blurring the line between legitimate political grievance and terrorism.
Another finding showed an Instagram Reels post exploiting public anxiety over the rupiah’s plummeting value against the US dollar in mid-2026, which hit an exchange rate of Rp18,000 to USD 1.00. The meme creator juxtaposed a screenshot of the exchange rate with propaganda footage from an Indonesian terrorist group, framing armed jihad and the establishment of a caliphate as a solution to the country’s financial problems. This post, which garnered over 30,000 likes, shows how easily radical ideology can be repackaged as a joke that offers relief from young people’s socio-economic frustrations.
This seemingly harmless shield of humour, initially free of direct ideological intent and identifiable signals on user profiles, effectively stifles critical thinking and lowers psychological defences against radical narratives. This mirrors broader international and regional digital cultures, such as the gamification of far-right extremism in the West or local ‘jedag-jedug’ video edits glorifying militant figures in Southeast Asia, where extremist aesthetics are commodified for entertainment. The danger of this permissive ecosystem lies in how it bridges ironic consumption and genuine extremist rhetoric. As seen in the rupiah meme (Figure 1, right), amateur creators inadvertently circulate unedited propaganda subtitles condemning ‘government tyranny’ alongside their jokes. Consequently, pro-ISIS sympathisers no longer need to create propaganda from scratch; instead, they can piggyback on this viral edgy humour, using the comment sections of these posts to inject unironic ideological support and potentially steer curious teenagers towards genuine radicalisation. The result is reduced resistance to the aesthetics used by extremist groups in their own self-promotion, opening the door for more ideological content to be received with the same non-critical lens.
Evading Moderation and Algorithmic Amplification
Automated moderation systems’ inability to understand meme context and the nuances of irony is the biggest loophole exploited in this phenomenon. According to Meta’s Community Standards (98.8% proactive removal in Q2 2026) and TikTok’s Community Guidelines Enforcement Report (99.5% proactive removal in Q2 2026), their existing detection systems are highly efficient, consistently demonstrating over 98-99% proactive removal rates for unmodified extremist propaganda and explicit violence. However, when visual elements associated with ISIS (such as flags, images of key figures, or non-lethal footage) are remixed into absurdist-style ‘shitposting’, the content is transformed into material that is free of explicit gore and more difficult for security algorithms to flag as a threat.
This practice of platform moderation evasion has become increasingly sophisticated with the rise of overwritten memes in Indonesia. In this phenomenon, creators take original footage of extremist propaganda, then overwrite it with text boxes containing random, nonsensical captions, thereby altering the original translated text, or covering up certain sensitive elements (such as weapons or logos) with other images or stickers.
In addition to visual elements, modifying text and audio is another evasion tactic. The use of hashtags and leetspeak to disguise references to extremist groups, or local online community slang to refer to them, is still able to exploit the filters’ blind spots. This is exacerbated by the use of modified jihadist nasheeds, such as those sped up or slowed down, given a reverb effect (p.6), or combined with local pop music, which allows them to evade the platforms’ detection systems.
Figure 2: Evasion tactics on TikTok using overwritten text. The creator uses absurdist captions, local slang, and leetspeak. Extremist hashtags are redacted for safety, leaving only #fyp to demonstrate algorithmic intent.
Furthermore, when this grey-area content slips through moderation, engagement-driven recommendation algorithms on both TikTok and Instagram act as a catalyst for its spread. The short-form video format and the platforms’ recommendation features, such as Instagram’s ‘Suggested for You’ and TikTok’s ‘For You’ page, are designed specifically to prioritise the amplification of content with high engagement rates. Crucially, these algorithms are sentiment-agnostic, meaning they cannot distinguish between ironic amusement, user confusion, and genuine extremist endorsement. Because ISIS-themed memes provoke polarised reactions, the resulting friction in the comments and high share rates are registered by the system purely as valuable engagement signals. For example, an ISIS meme on TikTok disguised as a college entrance exam failure garnered over 124,000 likes, 35,000 reposts, and 10,000 saves. In such cases, ordinary users’ amusement and curiosity inadvertently subsidise the algorithmic reach of extremist imagery, prompting the platform to aggressively push the material onto wider youth feeds. What distinguishes this phenomenon from traditional algorithmic amplification is the decentralisation of intent. Extremist networks no longer need to artificially manipulate algorithms; instead, they effortlessly free-ride on the organic, ironic engagement of unaffiliated accounts to bypass security filters and infiltrate mainstream digital spaces.
The Comment Section as a Gateway
Within the comment sections of these social media posts, the convergence of amused casual users, curious viewers asking for the original context, and genuine radical sympathisers creates a unique vulnerability. For opportunistic extremist networks, this mixed space functions as an open arena for ideological validation.
Figure 3: (Left) An Instagram comment section showing ordinary users asking for the title of the modified nasheed and the source of the extremist footage. (Right) A TikTok comment thread where user curiosity is met with ideological validation from radical sympathisers praising the militants as role models and enforcers of justice (red text indicates the author’s translations).
As shown in Figure 3, the comments section also functions as an information-sharing hub where users actively request and exchange the titles of jihadist nasheeds and the original propaganda footage (‘doksli’) behind the memes. Curious users are actively guided towards raw extremist material and deeper ideological rabbit holes. For instance, user requests for background audio are frequently met with replies providing the exact nasheed titles, the specific names of militants, or direct search keywords to locate unmodified propaganda. When this information-seeking behaviour intersects with peer-to-peer validation from sympathisers who, as seen in Figure 3, frame the militants as ‘role models’ and ‘enforcers of justice’, the comment section turns into a functional bridge towards pre-radicalisation. It facilitates a critical shift from the passive consumption of shitposting to active engagement with, and potential sympathy for, violent ideological narratives.
Moderation Challenges
Both Meta and TikTok have established strict Community Guidelines that prohibit harmful organisations and individuals, as well as hate speech. These platforms have moderation systems in place to detect and remove explicit terrorist propaganda, such as recognised terrorist symbols, overt calls for violence, and accounts known to be linked to terrorist groups. However, these systems struggle when radical material is disguised within internet subcultures, particularly when ordinary creators circulate terrorist aesthetics for humour, inadvertently contributing to the spread of extremist imagery that genuine sympathisers subsequently hijack. This dynamic presents a complex policy challenge regarding the ‘awful but lawful’ phenomenon. This challenge is further highlighted by inconsistent platform enforcement, where some flagged posts are removed while identical content remains live.
To close this loophole, platforms must pair automated detection with targeted human review in the comment sections. Specifically, platforms should refine their existing Natural Language Processing (NLP) classifiers to scan viral meme threads for clusters of extremist code words, takfiri (the practice of declaring others as apostates to justify violence) narratives, leetspeak, and requests for raw propaganda. Posts crossing this threshold can then be escalated to Indonesian-speaking human moderators to verify whether active network consolidation is occurring. Using these behavioural signals, Instagram and TikTok can demote such posts from algorithmic feeds or disable their comments, providing accountable metrics to mitigate horrific yet legally permissible threats without compromising freedom of expression.
Conclusion and Recommendations
The phenomenon of pro-ISIS imagery disguised as memes demonstrates that the threat of digital extremism has mutated into a grey area. Rather than crafting propaganda from scratch, opportunistic extremist networks can now exploit the enforcement gaps in internet culture. They can hijack edgy humour trends and shitposting created by content creators, adapting them to evade platform moderation, and using them as a starting point for a radicalisation pipeline. Unwittingly, social media users have become facilitators for the normalisation of violent ideologies.
To address this challenge, platforms must integrate context-aware moderation by strengthening the role of human moderators who understand the nuances of slang, the boundaries of satirical comedy, and local digital subcultures in Indonesia and other countries. Reporting systems must also be refined to distinguish between accounts engaged in pure shitposting and those actively linking to extremist spaces in their comment sections.
For practitioners in the prevention and countering of violent extremism (P/CVE), this reality calls for updated digital literacy strategies. Future counter-narrative campaigns can no longer rely solely on rigid religious doctrine; they must adapt and target youth who are drawn to transgressive memes/humour. Educational programmes must ensure young people understand that their edgy jokes about terrorism are not just harmless comedy but are actively exploited by radical groups for recruitment.
–
Jonathan Suseno Sarwono is an independent researcher focusing on digital extremism, cybersecurity, and open-source intelligence. He previously served as a researcher at the Indonesia Knowledge Hub on Countering Terrorism and Violent Extremism (I-KHub) under the National Counter Terrorism Agency, where his work centred on counter-narratives and regional security developments in Southeast Asia.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.
The views and opinions expressed in this Insight are the authors’ own and do not necessarily reflect those of GNET or any of its partners.