Banner: Examples of AI-generated images circulated by the inauthentic X network which also appeared via the Spamouflage Dragon operation. (Source: @bestolweb, @mmshouhu, @fo29904619)

Following the July 2024 attempted assassination of former President Donald Trump, a network of inauthentic pro-Chinese accounts on X engaged in discussions about the shooting, including narratives promoting falsehoods and conspiracy theories. This network also amplified unflattering clips of Vice President Kamala Harris and projected a bleak outlook for American democracy after President Joe Biden announced his withdrawal from the presidential race. The behavior and content of this network resemble those of Spamouflage Dragon, a large-scale Chinese information operation; it is also consistent with China’s long-term agenda to achieve discourse power globally by portraying itself in a positive light while simultaneously denigrating its democratic competitors.

The DFRLab compiled accounts in this network that amplified narratives of the shooting. These accounts stoked conspiracy theories by spreading false rumors that Trump had been assassinated while vaguely speculating that “they” tried to assassinate Trump. The accounts also criticized US gun control policies, speculated on the likelihood of civil war, commented on Trump’s and Biden’s physical condition, and shared a Breitbart article tying a comment by former US House Speaker Nancy Pelosi to the shooting.

Similarly, the network began amplifying narratives after Biden withdrew from the presidential race and endorsed Harris for president on July 21, 2024. In one instance, an account amplified a meme implying that Israel would decide who wins the presidential election rather than US voters. Elsewhere, accounts amplified a manipulated compilation of Harris laughing.

Even before these momentous political events took place, the network disseminated narratives taking aim at US government and American political divisions. These topics included racial discrimination, police brutality, gun violence, the Fentanyl crisis, homelessness, presidential candidates, involvement in Ukraine, support for Israel in Gaza, and gender identity. Some of these narratives, including police brutality and gun violence, were previously associated with Spamouflage. Another highly amplified topic by China in 2023, the release of the Fukushima nuclear wastewater, was also promoted by this network. The accounts have also utilized AI-generated images were either identical or similar to ones used by a Spamouflage network previously attributed by the Institute for Strategic Dialogue. This general narrative approach is consistent with the Chinese Communist Party’s approach to achieving “discourse power,” providing a positive image of China in the world while undermining democratic competitors as chaotic, unruly, and fundamentally flawed.

These aforementioned accounts appear to serve as “content originators,” posting original content that is then amplified by bot accounts. The DFRLab identified ten accounts serving as content originator accounts, whose content was then amplified by 165 bot accounts over a one-year period preceding July 18, 2024. Three originator accounts received the most engagement from these bots: @congcong612 (1,938 reposts and quote-posts), @fo29904619 (1,418) and @fo80508772 (1,381). Most bot accounts appear to be dedicated to amplifying a single content originator account, though some amplified other originators as well. This engagement pattern can be visualized when presented as a network graph.

Although most of the reposts these originator accounts accumulated were from inauthentic bot accounts, they still garnered a considerable number of views over time, as many of them have been active since 2022. One post garnered over 44,000 views, though most posts were much lower on average. For example, posts by @fo29904619 averaged 4,065 views, while another originator account, @bestsolweb, garnered an average of 956 views per posts.

Table of the viewership metrics of the content originator accounts. Data accounts for original posts made from July 18, 2023, to July 18, 2024. (Source: DFRLab via Meltwater)

Judging from these accounts’ profiles and posting histories, the DFRLab believes that these accounts were likely purchased from account vendors. One indicator is the “fo” tag in some accounts’ names, bios, or handles, used to signal the account would automatically follow back if followed. This tag might be a vestige left by the vendors when they were using it to grow their accounts’ follower counts to sell at higher price points. Another sign is that some accounts, such as @nbsdemo, had previously been automated to repost generic content before being repurposed to amplify anti-US narratives. Vendors offer accounts that serve a specific audience, like ones for sports, entertainment, or crypto, and they would automate their accounts being sold to repost generic posts of that community. Although some originator accounts were created many years ago—@nbsdemo was created in 2011, for example—vendors specifically sell older accounts, which are more highly valued than accounts established recently.

These tactics are very much in line with Spamouflage operations in the past, and also reflect an evolution in the network’s tactics from focusing on retweets and reposts of pro-China narratives to seeking to identify and exploit polarizing narratives that already exist in a given information environment. For example, a recent Microsoft Threat Analysis Center report outlined how China-linked accounts posing as conservative American voters were taking polls to determine how other users felt about divisive social issues and using AI-generated content to gain traction among organic users.

“Inauthentic Chinese X accounts amplifying Trump shooting and Biden withdrawal conspiracy theories,” Digital Forensic Research Lab (DFRLab), July 30, 2024, https://dfrlab.org/2024/07/30/china-x-trump-biden-harris/.