China-linked disinformation operations are using so-called “spamflage” networks to step up Chinese government propaganda targeting Western social media users who regularly promote crypto-related content on X.
Spamflage accounts are bots masquerading as real users promoting stories that align with the Chinese government’s hot-button issues, such as the coronavirus pandemic, China’s human rights situation, the war in Ukraine, and the conflict in Gaza.
The cryptocurrency account was discovered through a joint investigation between VOA Mandarin and Taiwan-based social media analytics company DoubleThink Lab.
DoubleThink Lab’s analysis revealed 1,153 accounts that primarily repost news and promotions related to cryptocurrencies. These accounts may be bots deployed by engagement services to increase customer visibility on social media.
The findings suggest that some Chinese official X accounts and spamfrage operations are using the same amplification services, further demonstrating the connection between the Chinese state and spamfrage.
The Chinese government has repeatedly denied attempts to spread disinformation in the United States and other countries.
From cryptocurrencies to spamflage
A review of the accounts in the VOA-DTL investigation shows that the majority of posts were about cryptocurrencies. Users regularly repost content from some of the biggest crypto accounts on X, including ChainGPT and British podcaster Brian Rose’s LondonRealTV.
However, these accounts also shared content from at least 17 Spamouflage accounts tracked by VOA and DTL.
VOA recently reported on the Spamouflage network’s embrace of anti-Semitic tropes and conspiracy theories.
Spamoflage was first discovered by US-based social media analytics company Graphika. The company coined the name because the operation’s political posts were interspersed with innocuous but spam-like content such as TikTok videos and landscape photos that disguised the operation’s goal of influencing public opinion. Ta.
All cryptocurrency accounts have reposted content from a Spamouflage account named “Watermelon Cross” at least once. An investigation of the account revealed that “Watermelon Cloth” regularly posts content criticizing social inequality in the US, Ukraine, and Israeli governments, while praising China’s economic achievements and leadership role in resolving international issues. It turned out that
In one post, the account promoted a conspiracy theory that the U.S. government is developing biological weapons in Ukraine.
“With the outbreak of the Russia-Ukraine war, America’s ‘unspeakable secrets’ have come to light. America’s biological laboratory in Ukraine has been exposed,” the post said. X recently suspended the Watermelon Cross account.
Since Watermelon Cross was first posted in March 2023, its content has been reposted nearly 2,600 times, half of which were from crypto accounts. Most of the remaining reposts came from Spamouflage or other bot-like accounts, according to data collected by DoubleThink Lab. The study also found that the number of views on posts almost tripled on average as crypto accounts grew.
robot-like movements
All 1,153 crypto accounts exhibit patterns that strongly suggest they are bots rather than human users.
These were made in batches on specific days. On April 6th alone, 152 of them were registered with X.
Over 99% of the content was reposts. When we looked at reposting behavior on September 24th, we found that all reposts occurred within an hour of the original content being posted. Each wave of reposts, all within 6 seconds, shows coordinated actions.
At least one such account offered an engagement service with a profile featuring two Telegram links for interested customers. VOA Mandarin contacted the service seller through the link but received no response.
China’s official account expands
The cryptocurrency group has also promoted posts from official Chinese accounts, including accounts belonging to local governments, state media, and at least one Chinese diplomat.
Jinan International Communication Center was the third most amplified account among the accounts where crypto groups shared posts. Its content has been reposted more than 2,200 times.
The Jinan International Exchange Center is part of Beijing City’s “telling the story of China well” publicity campaign, with the aim of promoting the history and culture of Jinan, the capital of eastern China’s Shandong province, to the world. Established in 2022.
Local state media boasted in an article last year that Jinan was the third most influential Chinese city on X, then called Twitter.
Other Chinese cities such as Xiamen and Ningbo, as well as provinces such as Anhui and Jilin, have also had their official accounts expanded by the crypto group.
Other expanded accounts include Xi’s Moments, a state media project that promotes Chinese leader Xi Jinping’s speeches and official activities. China Retold, a media group organized by pro-Beijing politicians in Hong Kong. and the English-language state-run newspaper China Daily.
Zhang Heqing, Cultural Counselor at the Chinese Embassy in Pakistan, is the only Chinese diplomat whose post has been promoted by a crypto group.
In an analysis of its data and findings, DoubleThink Lab notes that official Chinese accounts and spamflage operations “likely” used the same content augmentation service, and why this could be explained by the same group of crypto accounts. Explains whether it has been amplified.
The Chinese embassy in Washington, D.C., declined to answer specific questions about the cryptocurrency group, China’s official accounts, and its supposed ties to Spamfrage.
However, in a written statement, spokesperson Liu Pengyu rejected the idea that China has been using disinformation campaigns to influence social media users in the United States.
“These allegations are full of malicious speculation against China, and China firmly opposes them,” the statement said.
