El Mencho Aftermath: Cartel AI Misinformation War

El Mencho aftermath shows how cartel propaganda, AI images, and U.S. political actors turned real violence into a viral narrative of state collapse.

Within hours of Mexican Special Forces killing CJNG leader Nemesio “El Mencho” Oseguera Cervantes in Tapalpa on February 22, 2026, a second operation was already underway — not in the mountains of Jalisco, but across the digital infrastructure of X, Telegram, TikTok, and WhatsApp. Among the most viral claims: armed sicarios had stormed and seized Guadalajara International Airport. A plane was burning on the runway. Smoke billowed from a church and multiple buildings in Puerto Vallarta. American and Canadian tourists were being taken hostage at hotels and highway checkpoints.

None of it was true.

What Actually Happened at the Airport

Grupo Aeroportuario del Pacífico (GAP), the company that operates the Guadalajara airport, confirmed in a statement posted to X on the afternoon of February 22 that the airport was operating normally, that no violent incidents had occurred inside the terminal, and that the facility was under the protection of the National Guard and the Ministry of National Defense. GAP attributed the viral videos of panicked passengers to “hysteria among passengers” triggered by the general climate of fear — not by any armed incursion. Euronews confirmed that the claims of a facility takeover had been debunked, noting that while videos showed passengers in distress, the terminals themselves were never breached. In Puerto Vallarta, the situation was materially different — real blockades disrupted highway access and flights were cancelled — but even there, the most widely shared images were fabrications. PolitiFact traced one viral photograph of Puerto Vallarta engulfed in flames to Google’s Gemini AI image generator, identifying telltale signs: distorted buildings, smoke moving uniformly in a single direction, and fire that appeared not to consume the structures it supposedly burned.

The Embassy Fights Back — and the Sources of Amplification

The Mexican Embassy in the United States moved to counter the deluge in real time. In a post on X, the embassy directly flagged and refuted six specific claims circulating on social media, stamping the word “FAKE NEWS” in red across a screenshot of one of the most prominent amplifiers — Laura Loomer, a far-right activist and close associate of Donald Trump. Loomer had posted on X that the United States had “eliminated” El Mencho, that CJNG had “retaliated by storming the Guadalajara Airport with armed gunmen,” and that cartel members were “taking American tourists hostage at nearby highways and hotels.” The embassy’s rebuttal was unambiguous: the military operation was planned and executed by Mexican Special Forces, with U.S. authorities providing “complementary intelligence” within a bilateral cooperation framework. The Latin Times reported that InSight Crime analysts warned that CJNG’s network structure meant the removal of El Mencho could trigger unpredictable splintering — making the information chaos both a propaganda tool and a forecast of structural instability. Mexico’s Undersecretary for North America, Roberto Velasco Álvarez, responded separately to Loomer on X, noting that her claim that the Mexican government was “run by cartels” contradicted the fact that the same government had just executed a decisive operation against one.

The convergence of cartel propaganda and U.S. political exploitation illustrates a broader pattern: media ecosystems do not simply report events — they process them in ways that serve specific interests. For an analysis of how this dynamic operates in Canadian political media, see Canadian Liberal Media Is Not Your Friend.

A Coordinated Propaganda Campaign

Reuters, in a detailed investigation published February 24, confirmed that the false images had been reviewed by their verification team and were shared tens of thousands of times. Researchers told Reuters the misinformation was not incidental but appeared to be a coordinated propaganda campaign — spread at surprising speed not only by unsuspecting users but also, in some cases, by cartel-linked accounts deliberately exaggerating the scope of retaliatory violence. The goal, experts said, was to make the CJNG’s response appear far more devastating than it actually was. Jane Esberg, an assistant professor of political science at the University of Pennsylvania whose research focuses on how Mexican criminal groups use social media, told Reuters the strategy was designed to project the impression that the cartel had a nationwide presence and that the state could not maintain control. She noted that this made it extremely difficult for the public, journalists, or even security forces to assess the actual scale of violence on the ground.

Pablo Calderon, an associate professor of politics and international relations at Northeastern University London, offered a sharper framing of what happened. Calderon told Reuters that Sunday was a good day for Mexican security forces, but that organized crime had been successful in shifting the narrative away from the military raid and toward chaos. This is the core of the information operation: a moment of genuine state capacity — the targeted killing of one of the world’s most wanted traffickers — was renarrated within hours as evidence of state failure.

From Narcomensajes to Narcomedia: The Infrastructure Was Already Built

This is not new. It is an escalation of a well-documented dynamic. The International Crisis Group’s January 2024 briefing, “Fear, Lies and Lucre: How Criminal Groups Weaponise Social Media in Mexico,” documented in detail how Mexican trafficking organizations use social media to garner popular support, denigrate rivals, glorify narcoculture, coordinate violence, and — crucially — spread disinformation designed to project territorial control they may not actually possess. The ICG report noted that because violence has made it impossible for journalists to safely report from vast areas of Mexico, social media has become a primary news source for affected communities, creating an information vacuum that criminal organizations exploit. Anonymous narcoblogs and Telegram channels provide genuinely useful civilian warnings about blockades and active firefights — but the same infrastructure can be, and routinely is, weaponized to sow confusion and amplify fear.

The academic literature on this phenomenon is extensive. Paul K. Eiss, writing in Latin American Perspectives in 2014, coined the term “narcomedia” to describe how narcomensajes and narcovideos — originally handwritten signs left with mutilated bodies — were from their inception designed for digital reproduction and viral transmission. By bypassing traditional media gatekeepers and uploading directly to YouTube and social platforms, trafficking organizations created a parallel information ecosystem that the Mexican state has never successfully contested. Eiss documented how, in some cases, government and security forces adopted the same tactics, circulating images of desecrated cartel bodies as a form of countersignaling — a finding that complicates any simple narrative of “cartel propaganda vs. state truth.”

The AI Escalation

The Tapalpa aftermath represents a qualitative leap. Reuters and multiple researchers noted that while Mexican criminal groups have long recycled old cartel footage or repurposed violent imagery from conflicts in other countries, the February 2026 disinformation campaign was the first major instance in which AI-generated content played a central role. The fabricated image of Puerto Vallarta in flames, traced by PolitiFact to Gemini, represents a new capability: the ability to produce photorealistic fabrications calibrated to specific locations and events, in real time, at no cost. A University of Texas researcher told KXAN Austin that this was the first time he had observed Mexican organized crime deploying artificial intelligence to create fake visual content in support of a propaganda operation. The KXAN investigation also confirmed that the Mexican Embassy had used its X account to individually refute six separate viral claims.

Narco-Influencers and the Amplification Machine

The narco-influencer dimension compounds the problem. The ICG’s 2024 report and CSIS research have documented how social media personalities with large followings — some operating with direct or tacit cartel support — function as amplification nodes. When a fabricated claim enters this ecosystem, it does not travel by random diffusion. It is boosted by accounts with established audiences and algorithmic momentum. After the Tapalpa raid, this infrastructure activated almost instantly, with cartel-adjacent accounts and sensationalist aggregators pushing false claims alongside genuine footage of blockades and fires, making it nearly impossible for ordinary users to distinguish truth from fabrication in real time. The Small Wars Journal documented a precedent case study of intra-cartel information warfare — the Dámaso López campaign against El Chapo’s sons — in which an entire fake website was created to manipulate rival factions’ understanding of ongoing violence. The Tapalpa misinformation operation follows the same logic but deploys it against the public and the international media rather than against rival traffickers.

Cui Bono: The Convergence of Cartel Propaganda and Imperial Narrative

But a materialist analysis demands we ask: who benefited from the information chaos?

The answer is not only CJNG. The airport fabrication and the broader disinformation flood served multiple actors simultaneously. For the cartel, the strategic logic is clear: projecting the appearance of overwhelming retaliatory capacity deters future state operations and signals to rivals that CJNG’s network remains dangerous even without its figurehead. But for U.S. political actors, the images of “chaos” — real and fabricated alike — served a different purpose entirely. Loomer’s posts were not simply misinformation; they were interventions in a domestic U.S. political narrative. By framing the operation as an American action (“the Trump administration eliminated…”) and the aftermath as proof of Mexican state failure (“they are now taking American tourists hostage”), Loomer constructed a narrative that reinforced the Trump administration’s framing of Mexico as a failed state requiring external intervention — a framing that has been used to justify the “foreign terrorist organization” designation applied to CJNG and the Sinaloa Cartel in February 2025.

Oswaldo Zavala’s framework, elaborated in Drug Cartels Do Not Exist: Narcotrafficking in US and Mexican Culture (Vanderbilt University Press, 2022), is instructive here. Zavala argues that the “cartel” as popularly understood is not a descriptive category but an ideological construction — a spectacle that serves the interests of both the trafficking organizations and the states that claim to fight them. The airport fabrication is a near-perfect illustration.

For a fuller treatment of Zavala’s argument — including how the “cartel” category functions to externalize U.S. responsibility and justify militarized intervention — see our companion analysis: Drug Cartels Do Not Exist: Rethinking Mexico’s War.

The image of armed men seizing a civilian airport is maximally spectacular: it collapses the distinction between legitimate and illegitimate violence, between state and non-state actors, and between the space of everyday life and the space of war. It does not matter that it never happened. What matters is that it was believed, and that the belief itself performed political work — for the cartel seeking to project power, for the U.S. political actors seeking to justify escalation, and for the media ecosystem that monetizes fear.

Fragmentation and the Collapse of Legibility

Esberg’s own published research demonstrates why the information ecosystem is so vulnerable to this kind of manipulation. Her 2025 article in Political Science Research & Methods, “Criminal Fragmentation in Mexico,” uses data from narcoblogs to track more than 450 criminal organizations operating between 2009 and 2020. The fragmentation itself — a direct consequence of the kingpin strategy that the Tapalpa raid continues — produces an ever-more complex information environment in which attribution is uncertain, territorial control is contested, and the very question of “who did what” becomes a site of strategic manipulation. In a landscape of 450-plus groups, a single viral claim about “the cartel” can refer to anyone and anything. The spectacle fills the void left by the collapse of legibility.

The fragmentation that makes the information environment illegible is not accidental — it is a direct product of the kingpin strategy itself. As we detail in our evidence review, two decades of research consistently finds that leadership removal splinters organizations into competing factions, each with its own incentive to manipulate the information space.

Mexican Security Secretary Omar García Harfuch confirmed at a Monday press conference that authorities had identified “various accounts” suspected of cartel connections and announced a deeper investigation to determine which had direct relationships with organized crime groups. He also distinguished between accounts directly linked to criminal organizations and separate accounts dedicated to spreading lies without confirmed organizational ties (Reuters, Feb. 24, 2026). This distinction matters: the information operation was not a monolithic cartel campaign but a convergence of cartel propaganda, opportunistic amplification by narco-influencers, engagement-farming by sensationalist aggregators, ideological exploitation by U.S. political actors, and genuine panic by civilians sharing unverified content in a crisis. The airport never fell. But the narrative ecosystem that processed the event was designed — by multiple actors, for multiple reasons — to make it feel as if it had.

The Real Violence and the Manufactured Apocalypse

The real violence was real enough. Twenty-five National Guard soldiers were killed in the aftermath. Over 250 blockades were established across at least 20 states. More than 200 Oxxo stores and 18 Banco del Bienestar branches were damaged in Guanajuato alone. Fifty-six flights were cancelled from Guadalajara on Sunday, and Puerto Vallarta’s international operations were shut down entirely. Over a thousand tourists were stranded at the Guadalajara Zoo overnight, sleeping in tour buses (Al Jazeera, Feb. 23, 2026; Mexico News Daily, Feb. 23, 2026). The real consequences of the kingpin strategy’s violence were devastating. But they were not devastating enough for the purposes of those — cartel operators and U.S. hawks alike — who needed the aftermath to look like the collapse of a state.

The manufactured apocalypse obscures the material system that produces the real violence. As we document in our analysis of the binational cartel economy, the weapons pipeline, drug flows, and militarization cycle constitute an economy that operates regardless of which narrative — state success or state failure — dominates any given news cycle.

President Claudia Sheinbaum, in a post on X, urged calm and noted there were many fake news stories circulating. By Tuesday, the Mexican Embassy declared the security situation “stabilized,” with airline operations returning to normal and transit corridors reopening. The U.S. Embassy issued its fifth security alert update, confirming that all airports in Mexico were open and most were operating normally. Freedom House’s 2024 assessment of Mexico’s digital ecosystem had already documented how bot-driven campaigns and coordinated inauthentic behavior were shaping political discourse in the country — a structural vulnerability that the post-Tapalpa information operation exploited at scale. The spectacle had served its purpose and was already dissipating. But the images — the airport “takeover,” the AI-generated inferno, the hostage claims — will persist in the digital archive, available for the next cycle, ready to be recycled and recirculated the next time the state executes a kingpin and the information machine activates again.

The airport that never fell will be remembered as if it did. That is the point.

Sources