A processor-implemented method for detecting an information operations campaign includes retrieving a first neural network language model including a natural language model trained on a first dataset. The first neural network language model is modified, via transfer learning and based on a second dataset, to produce a second neural network language model. Social media post data associated with a social media post is received, and features are extracted from the social media post data. The features are tokenized to produce at least one token including a value. A prediction score for the at least one token is generated using the trained neural network language model. If the prediction score exceeds a threshold value, a threat warning including a representation associated with at least one of the social media post or an account associated with the social media post is generated.