The Assassination Conspiracy Playbook: Tactics, Techniques, and Procedures

TL;DR

Alice’s Emerging Trends Detection team analyzed four major US political violence incidents: the 2024 Trump assassination attempt in Butler, Pennsylvania; the 2025 killing of Charlie Kirk in Utah; the 2026 shootings at the White House Correspondents’ Dinner (WHCD) and a White House checkpoint, and found that the conspiracy narratives that follow are neither random nor spontaneous. Instead, they are highly structured and follow a repeatable set of tactics, techniques, and procedures (TTPs) that are deployed with increasing speed and sophistication across incidents.

Across all four cases, the same core narratives reappeared in a similar pattern, adapted to fit the details of each event. These claims were not created in response to the incidents themselves; rather, they were pre-existing conspiracy frameworks repurposed for new actors, locations, and political contexts.

This report applies the TTP framework to examine how these narratives are constructed, distributed, and amplified, and what those recurring patterns imply for Trust and Safety teams. The central implication is clear: future incidents are unlikely to generate entirely new forms of misinformation. Instead, they will reactivate and adapt an existing playbook that is already embedded within online conspiracy ecosystems.

Tactics: Template Narratives, Localized to Each Incident

The most prominent misinformation narratives that circulated in the aftermath of the four violent incidents were nearly identical. Each appeared to follow a common template that remained structurally consistent across cases, with only the actors and locations changed. The adaptability of these narratives contributes to their durability and speed of adoption. Because each is pre-constructed, it can be rapidly deployed into the information vacuum that emerges immediately after a major incident, shaping public interpretation before verified reporting has time to stabilize.

Key examples include claims framing events as hoaxes, alleging official complicity, or asserting foreign involvement, all without credible evidence.

• Template A: The Staged Event:

Each of the major incidents highlighted in this blog triggered claims that the attacks were fabricated, false flags designed to manufacture sympathy, shift political momentum, or distract from another story. The claim requires no evidence to launch. The absence of an immediate official explanation is itself often treated as proof of a conspiracy. At the Correspondents’ Dinner, staged-event claims were circulating within minutes of the attack, before a suspect had been named.

• Template B: Deep State or Agency Complicity:

Security failures are used as evidence of intention rather than error. This template is particularly effective because security lapses, usually present in chaotic events, provide genuine ambiguities for the narrative to attach to, lending it increased credibility.

• Template C: Foreign Orchestration:

Russia, Iran, Israel, and Ukraine are some of the same geopolitical actors that appeared in attribution narratives across all of the incidents. Foreign blame is not an incident-specific conclusion; it is a flexible slot in the template, filled with whichever actor best fits the political moment, geopolitical interest, and the target audience.

Social media mentions of “staged” surged after the 25 April 2026 shooting at the White House Correspondents’ Dinner, according to data from Meltwater.

Techniques: AI-Generated Content as Early-Stage Seeding

AI-generated content is now deployed at the outset of an incident to seed narratives, before any verified account exists. Across all of the incidents reviewed, synthetic content appeared within hours of the events, shaping what people believed happened before facts were established.

Three broad content types recurred consistently:

• Fabricated media: AI-generated or manipulated images, video, and audio placing suspects in false contexts, impersonating public figures, or manufacturing visual evidence. For example, after the Kirk killing, AI tools produced false suspect identifications, one reshared by the Washington County Sheriff’s Office before a correction was issued.
• Unreliable AI fact-checks: People increasingly turn to AI chatbots to fact-check breaking news, but they can sometimes struggle to provide credible information during breaking news events. After Butler, major chatbots told users the assassination attempt had not occurred or called it fictional.
• Coordinated synthetic amplification: AI-generated accounts and posts flooding platforms almost immediately after each incident, manufacturing the appearance of organic consensus around false narratives.

Procedures: Actors Spreading Templates Across Borders

Domestic influencers and foreign state-linked actors operate under different incentives but rely on overlapping misinformation and disinformation infrastructures that enable conspiratorial narratives to be seeded and amplified within hours of a major event. Political violence does not create this capability; rather, it activates existing networks that move quickly to exploit the resulting information vacuum, capture public attention, and advance strategic, political, or financial interests.

Domestically, actors spreading misinformation operate across the political spectrum, though their motivations vary. For influencers and podcasters, financial and political incentives often drive amplification: conspiracy content generates engagement, grows audiences, and can create direct revenue opportunities.

Users alleged the 24 May 2026 shooting near the White House was staged.

Increasingly, the narratives themselves appear less tied to ideology. Following the 2024 Butler shooting, claims that the event had been staged circulated primarily among left-leaning accounts, framing the attack as manufactured to generate electoral sympathy. By 2026, prominent far-right figures, including Alex Jones, Candace Owens, Tucker Carlson, and Marjorie Taylor Greene, had adopted similar framing. Conspiracy narratives surrounding political violence are becoming less partisan and more opportunistic: the framework itself migrates to whichever actors find it strategically useful.

Foreign state-linked actors also exploit political violence to advance existing strategic objectives. In the wake of these violent events, Russian-linked networks amplified anti-Ukraine and anti-NATO narratives, Iranian-linked outlets promoted anti-Israel framing, and Chinese state-adjacent accounts emphasized institutional distrust and social division. The information vacuum that follows a major incident creates a window of heightened opportunity. As audiences actively seek explanations, pre-existing narratives aligned with these geopolitical interests are positioned to fill the gap and broaden their reach.

From Fringe to Mainstream: The Migration Is Accelerating

The TTPs described above appear to have had a measurable downstream effect on public perception. Claims that once would have remained confined to explicitly conspiratorial spaces are now reaching mainstream audiences more quickly and visibly. A May 2026 poll found that a majority of Americans were unsure whether any of the recent assassination attempts targeting Donald Trump were real, while nearly 30 percent believed at least one had been staged. The rapid deployment of narrative templates, amplified through interconnected networks and reinforced by misleading, manipulated, and increasingly synthetic content offering early “evidence” before corrections emerge, likely contributes to this dynamic.

Notably, these claims no longer peak and disappear after a single news cycle. Instead, they resurface across subsequent incidents because audiences have already partially absorbed the underlying framing. Each new event does not restart the conspiracy narrative from scratch; it builds on pre-existing suspicion and accumulated distrust. The resurgence of conspiracy narratives surrounding Charlie Kirk in May 2026 illustrates this dynamic. More than a year after his killing, conspiracies surrounding the arrest of his alleged killer again trended online. The core allegation, that a court video timestamp demonstrated a cover-up, was not materially new; only the detail used to revive and recirculate the narrative had changed.

A fresh conspiracy theory about Charlie Kirk’s alleged killer, Tyler Robinson, was trending on social media on 12 May 2026.

Similarly, the 2026 White House Correspondents’ Dinner shooting prompted renewed skepticism surrounding the 2024 Butler attack, with many users questioning whether it too was staged. Contemporary conspiracy ecosystems increasingly operate through persistent narrative templates that remain available for reactivation whenever a new event creates an opportunity to reinforce or expand them.

Implications for Trust and Safety

In high-attention crises, false narratives do not need to be convincing to be effective. They only need to arrive first. In the immediate aftermath of a political violence incident, facts are incomplete, official information is limited, and audiences are actively searching for explanations. That information vacuum gives conspiracy narratives and misinformation an opening to shape interpretation before verified reporting has time to catch up.

For Trust and Safety teams, the risk is not just the volume of misinformation, but the speed at which familiar frames can harden into belief. Staged-event claims, allegations of institutional complicity, foreign-blame narratives, and synthetic “evidence” give audiences a ready-made way to make sense of uncertainty. Once those interpretations take hold, later corrections often struggle to displace them; new facts are absorbed through the conspiratorial frame rather than replacing it.

The challenge, then, is not only reactive moderation but also intervening during the first window of narrative formation. Teams that understand the playbook behind these incidents are better positioned to recognize the claims most likely to surface early, identify the formats prone to accelerating them, and respond before speculation solidifies into durable distrust.

If your team is facing similar risks around crisis misinformation, political violence narratives, or AI-driven manipulation, Alice’s intelligence experts can help you identify emerging threats earlier and respond more effectively.

Learn more about our Intelligence offerings here or get in touch with an expert here.