Escalating Threats: The Transnational Campaign Against Exiled Iranian Journalist Mohammad Jorjandi

MIAMI, October 19, 2026 — The digital walls are closing in on Mohammad Jorjandi. A renowned investigative journalist and cybersecurity expert who has spent the last decade peeling back the layers of Iran’s complex web of cybercrime, Jorjandi now finds himself the target of a sophisticated, multi-front campaign of digital harassment, doxxing, and international legal intimidation.

The Committee to Protect Journalists (CPJ) issued a formal condemnation this week, highlighting that the campaign against the founder of Webamooz is not merely an isolated case of online bullying, but a targeted, transnational effort to silence a critical voice that has dared to expose the intersection of Iranian state entities, organized fraud, and illicit financial networks.

The Architect of Accountability: Who is Mohammad Jorjandi?

Since arriving in the United States in 2016, Mohammad Jorjandi has established Webamooz as a premier independent outlet for monitoring cybercrime. While his primary focus is the Persian-speaking audience, his investigations into the dark underbelly of Iranian internet operations have gained international attention.

Jorjandi’s work is characterized by meticulous data-driven journalism. He has spent years mapping out how illicit payment processing hubs fuel gambling networks, VPN black markets, and cryptocurrency embezzlement schemes. His reporting frequently highlights the complicity of state-affiliated telecommunications companies, suggesting that much of the "fraud" occurring within Iran’s digital borders is not merely tolerated by the state—it is, in many instances, facilitated by it.

Chronology of a Coordinated Campaign

The current escalation follows years of pressure. The timeline of Jorjandi’s struggle reveals a transition from traditional legal harassment to more dangerous, extra-legal tactics.

2022–2024: The Legal Warfare Phase

Jorjandi’s investigation into an alleged fake-degree operation involving the NIUTM—which reportedly defrauded the Canadian immigration system—brought him face-to-face with the limits of international legal protection. A plaintiff filed a defamation lawsuit against him in Virginia, a tactic often used by powerful entities to drain the resources of independent journalists. After two years of intensive litigation, the plaintiff withdrew the case on the eve of trial in 2024. However, the victory was short-lived.

Late 2025: The Transnational Shift

Following the collapse of the Virginia lawsuit, the nature of the attacks shifted from the courtroom to the digital sphere. Jorjandi reports that this was the catalyst for a highly coordinated campaign. Using Telegram and Instagram, anonymous actors began disseminating smears, labeling him an "intelligence operative," a "money launderer," and a "sanctions evader."

2026: The Doxxing Escalation

The situation reached a critical point in late 2025 and throughout 2026, when individuals operating from Germany—posing as Iranian opposition figures—began targeting Jorjandi’s family. Through near-daily sessions on Clubhouse and Telegram, these actors have publicized the private address of his elderly father in Iran. The harassment has transcended speech; they have circulated photographs of his father’s residence and reportedly offered financial bounties to anyone willing to take "action" against his family members.

Supporting Data: The Anatomy of the Attacks

The harassment campaign against Jorjandi is marked by several distinct, high-tech features that underscore the sophistication of his attackers:

• Platform Weaponization: The use of Telegram channels and Instagram accounts to host "verified-looking" smear campaigns. These channels often share coordinated content, suggesting a centralized effort rather than spontaneous internet outrage.
• The "Shadow" Website: Attackers have launched a website specifically bearing Jorjandi’s name, designed to dominate search engine results when his name is queried, thereby poisoning his professional reputation.
• State-Judicial Synchronization: Inside Iran, the government has used its judiciary to formalize the suppression. This includes blocking Webamooz domains, ordering the removal of his content from Iranian platforms, and issuing a nationwide arrest warrant. Jorjandi has been sentenced to two years in prison in absentia on charges of "sedition" and "incitement."

Official Responses and the Stance of the CPJ

The Committee to Protect Journalists has been unequivocal in its support for Jorjandi. José Zamora, CPJ’s regional director for the Americas, emphasized the gravity of the situation: "Mohammad Jorjandi and his family should not face threats and harassment because of his reporting. Iranian authorities must end their persecution of Jorjandi, and social media platforms must act against threats and the publication of his family’s private information."

Despite these calls, the response from social media platforms has been, at best, sluggish. Jorjandi told the CPJ that he has repeatedly reported the Telegram channels responsible for doxxing his family, yet the content remains live. This highlights a persistent gap in the safety protocols of major tech platforms when it comes to defending journalists from transnational digital threats.

Implications: The High Cost of Independent Journalism

The case of Mohammad Jorjandi serves as a grim case study in the evolution of modern censorship. In the digital age, state actors no longer need to rely solely on physical imprisonment to silence their critics. By weaponizing the digital infrastructure of foreign nations, these actors can project power across borders, turning an investigative journalist’s home into a target zone.

The Erosion of Safety for Exiles

Jorjandi’s experience underscores a terrifying reality for many journalists in exile: there is no "safe" distance. Whether one is in the U.S. or Europe, the reach of state-sponsored intelligence and criminal networks, combined with the anonymity of the internet, ensures that personal life remains perpetually exposed.

The Challenge for Digital Platforms

The failure of companies like Meta and Telegram to address the targeted harassment of journalists like Jorjandi raises significant ethical questions. When platforms are used to coordinate criminal activity—such as soliciting physical harm against a journalist’s family—they cease to be mere forums for expression and become conduits for violence. The inability of these platforms to provide timely intervention serves as a de facto endorsement of the harassers.

The Resilience of Webamooz

Despite the mounting pressure, Jorjandi remains defiant. His pending lawsuit against the plaintiff who initially sued him in Virginia serves as a testament to his commitment to transparency. He is not merely defending his own name; he is attempting to establish a legal precedent that will make it harder for state-connected entities to use the American legal system as a weapon against journalists.

Conclusion: A Call for Accountability

As of October 2026, the investigation into these attacks is ongoing. The CPJ continues to monitor the situation, but the burden remains on the international community to recognize that the digital harassment of individuals like Jorjandi is a violation of fundamental human rights.

For the international community, the implications are clear: if independent journalists like Jorjandi are not protected from the coordinated, cross-border reach of entities seeking to suppress the truth, then the digital landscape will become increasingly inhospitable to anyone reporting on corruption, state-sponsored fraud, or systemic abuse.

The battle for the truth is no longer just happening in the headlines; it is happening in the comment sections, the encrypted chat groups, and the courthouses of the West. Mohammad Jorjandi stands at the front lines of this fight, and his survival—and his continued ability to report—is a litmus test for the integrity of our global digital society.