The Media Line: Why Are Jihadist Manuals Continuing To Reach Europe? 

Audio By Carbonatix

Enlarge

Why Are Jihadist Manuals Continuing To Reach Europe? 

European investigators say extremist propaganda is spreading through translation networks that repackage jihadist materials for new audiences on encrypted or little-known platforms. 

By Giorgia Valente/The Media Line 

After a year of knife attacks, rammings, and disrupted plots across Europe, investigators say the online machinery behind radicalization has changed shape. European agencies are confronting a familiar message wrapped in new packaging: propaganda that jumps borders not by virality alone but through translation. The most effective chokepoint is no longer a single post or channel, but the translation pipelines that move jihadist propaganda across languages and platforms. 

Analysts told The Media Line that semiofficial “translation hubs” and volunteer networks now act as multipliers—finding, subtitling, and repackaging content for new audiences on closed or harder-to-police services. These hubs include al-Azaim (the Islamic State’s primary media foundation), Halummu (a distribution and translation conduit for official statements), and Fursan al-Tarjuma—“Knights of Translation”—which specializes in rendering material into multiple languages. Cutting those pipelines, they argue, can slow recruitment, fundraising, and operational guidance more effectively than chasing single posts. 

If translators are the accelerant, volume is the fuel. Terrorism researcher Daniele Garofalo and Lucas Webber, senior threat intelligence analyst at Tech Against Terrorism, are among the specialists monitoring Islamist online ecosystems who told The Media Line that Europe’s problem in 2025 is not a lack of tools, but a landscape that has become more dispersed, more multilingual, and more embedded inside semi-private infrastructures than most platforms are able—or willing—to police. 

Garofalo urges authorities to target language nodes, not just messages. He said one of the most effective steps is to identify and block accounts that adapt extremist material for local audiences. “Identifying and blocking accounts/handles that translate/adapt content to official media in local languages is an important activity that works, as translators and language hubs act as multipliers,” he explained. 

He added that removals should be paired with “infrastructural disruption” aimed at bots, servers, distribution channels, and coordinated hub accounts. He also noted that the propaganda stream has diversified across official, semi-official, and supporter outlets—al-Azaim, Halummu, Fursan al-Tarjuma—often parked on “much more secure platforms.” 

Webber said the core issue persists even after years of pressure on Telegram, smaller forums, and file-sharing sites. Platforms still fail to consistently detect and remove banned material and moderation systems lag behind adversaries’ tactics. “These groups continuously find and exploit loopholes—such as moving to lesser-known platforms with weaker monitoring capabilities or employing sophisticated obfuscation techniques to disguise their content,” he said. 

For Webber, this gap is measurable. He said Western governments have underinvested in disrupting extremist activity online and pointed to his team’s monthly workload as evidence: “In October, for instance, we flagged over 4,000 unique violent Islamist URLs through our Terrorism Content Analytics Platform across the major social media platforms and archiving sites,” he noted. 

Webber added that Islamic State (IS) and al-Qaida (AQ) have shifted from territorial control to digital reach, using everything from recruitment funnels to fundraising and coordination online. While most of that can be summarized as a durable, multi-platform presence, one line captures the scope: “Social media, archiving and file sharing sites, as well as encrypted communication channels are commonly used, allowing them to maintain a global reach and distribute propaganda materials that aim to inspire and radicalize individuals worldwide,” he said. 

Linking this to politics after the Gaza war, Webber said IS has learned to harness the moment. He described how the group tailors narratives to grievance and identity politics and seeks to translate outrage into action: “In the post-October 7 environment, the Islamic State has been particularly adept at leveraging hostile sentiments toward the West and Israel to incite violence and build support,” he said. Online, he added, the group is pushing more pointed messaging designed to mobilize sympathizers: “They craft messages that exploit existing anger and fear, often sharing graphic content, incendiary rhetoric, and calls to action to mobilize potential sympathizers,” he added. Inspire-style guides—modeled on al-Qaida in the Arabian Peninsula’s Inspire—typically blend ideological justification with step-by-step instructions for carrying out attacks using easily accessible, low-tech methods. 

That online architecture has offline consequences. A series of low-tech, high-impact attacks over the past year has reminded European security services that the jihadist threat has not disappeared but adapted. 

On October 2, 2025, a British man of Syrian descent rammed security staff and stabbed worshippers outside the Heaton Park Hebrew Congregation in Manchester during Yom Kippur, killing two men and injuring others; police later confirmed one victim was inadvertently shot by officers responding to what they assessed as a terrorist incident. UK authorities said the attacker appeared to have been influenced by extremist Islamist ideology, despite no clear record of prior radicalization. 

Just months earlier, on February 22, 2025, an Algerian national armed with a knife attacked people near a market in Mulhouse, in eastern France, killing one and wounding several, including municipal police officers. President Emmanuel Macron said, “Once again, it is Islamist terrorism that has struck,” and anti-terror prosecutors opened an investigation for murder and attempted murder in connection with a terrorist enterprise. 

Germany soon faced a similar pattern. On February 21, 2025, a 19-year-old Syrian asylum seeker stabbed a Spanish tourist at Berlin’s Memorial to the Murdered Jews of Europe and, according to police and prosecutors, said he wanted to “kill Jews.” The victim was seriously injured, and authorities briefly reinforced protection of Jewish and Israeli sites. Later in the year, on October 1, 2025, German authorities arrested three men they said were preparing attacks on Jewish targets “on behalf of Hamas,” seizing an AK-47 and ammunition—evidence that alongside successful lone-actor attacks, security services are also disrupting plots clearly inspired by the same stream of online incitement. 

Threat bulletins reflect the same shift: fewer spectacular, centrally directed plots, and more decentralized, hybrid radicalization through mini-platforms, mirrors, encrypted channels, and the decentralized web—an environment in which jihadist groups’ older propaganda formats (magazines, manuals, how-to guides) still circulate and, in some cases, are being updated. 

That broader picture is echoed—and made more granular—by Garofalo, who has been tracking the output of both movements. He drew a sharp line between AQ’s comparatively centralized propaganda and IS’s looser, supporter-driven ecosystem. AQ, he said, still relies largely on Al-Malahem Media for videos and magazines in English and Arabic. “For the Islamic State, it is different,” he noted; outside of al-Naba editorials, much of the content now comes from supporter and sympathizer channels with little coordination. 

In practical terms, Garofalo said, Europe has the right tools—technical removals, prosecutions, and monitoring—but they are too often used in isolation rather than as a synchronized campaign. “To be truly effective, integrated operations (takedown + infrastructure disruption + targeted legal action) are needed,” he explained, along with better language capacity, more rigorous evaluation of countering violent extremism programs, and faster, more transparent cross-border cooperation. 

He also urged targeting the translator networks that act as multipliers for local-language content. He warned that relying on deletions alone keeps platforms in a perpetual game with extremists: “Removal alone has a ‘Whac-A-Mole’ effect, causing dispersion and an increase in evasive techniques,” he said, adding that prosecutions can define legal red lines but do not by themselves resolve social drivers or dismantle resilient tech stacks. 

Officials say the response must move from posts to plumbing. So, Garofalo argued, enforcement should shift from posts to the pipelines that move them. “Removals should therefore be combined with infrastructural disruption, so as not to limit oneself to a single post page, but to target bots, servers, distribution channels and coordinated hub accounts,” he said. That also means better analyst collaboration, clearer procedures to distinguish research from propaganda, stronger digital forensics, continuous training for investigators and judges, and streamlined EU-wide processes with independent oversight. 

He added that the manuals themselves have evolved to emphasize simple, lethal methods: “In recent years, there has been a noticeable use of low-tech weapons: knives, blunt objects, sometimes vehicles used as weapons; simplicity in tactics: short-lived ‘rush’ attacks, sometimes combined (ramming + stabbing), with little military training but high lethality due to the surprise effect,” he added. Prevention is complicated by the absence of a single profile, he said. Patterns recur—isolated actors or small local networks, foreign-inspired but locally acting—but variability remains high. Recently, he noted, extremist content has also included “new posts, magazines and editorials explaining the use of commercial drones or the production of weapons with 3D printers,” he said. 

On IS specifically, he concluded that the group has largely confined itself to editorials—such as those after October 7 and in al-Naba’s 500th issue—while videos and Inspire-style guides remain a staple across the broader pro-IS and pro-AQ sphere. These guides, modeled after Inspire magazine published by Al-Qaida in the Arabian Peninsula, typically offer ideological justification alongside step-by-step instructions for carrying out attacks using easily accessible, low-tech methods. “Like AQ, it has mainly published videos and Inspire guides,” he said, adding that most of the rest circulates in private digital spaces that analysts still encounter but the general public rarely sees.