A China-linked disinformation operation is using so-called “Spamouflage” networks to ramp up Beijing’s propaganda aimed at social media users in the West who regularly promote cryptocurrency-related content on X.
Spamouflage accounts are bots pretending to be authentic users that promote narratives that align with Beijing’s talking points issues, such as the COVID-19 pandemic, China’s human rights record, the war in Ukraine and the conflict in Gaza.
The cryptocurrency accounts were discovered by a joint investigation between VOA Mandarin and DoubleThink Lab, a Taiwan-based social media analytics firm.
DoubleThink Lab’s analysis uncovered 1,153 accounts that primarily repost news and promotions about cryptocurrency and are likely bots deployed by engagement boosting services to raise their clients’ visibility on social media.
The findings suggest that some official Chinese X accounts and the Spamouflage operation have been using the same amplification services, which further indicate the link between the Chinese state and Spamouflage.
Beijing has repeatedly denied any attempts to spread disinformation in the United States and other countries.
From cryptocurrency to Spamouflage
A review of the accounts in the VOA-DTL investigation shows that the majority of the posts were about cryptocurrency. Users regularly repost content from some of the biggest cryptocurrency accounts on X, such as ChainGPT and LondonRealTV, which belongs to British podcaster Brian Rose.
But these accounts have also shared content from at least 17 Spamouflage accounts that VOA and DTL have been tracking.
VOA recently reported on Spamouflage networks’ adoption of antisemitic tropes and conspiracy theories.
Spamouflage was first detected by the U.S.-based social media analytic firm Graphika, who coined the name because the operation’s political posts were interspersed with innocuous but spam-like content such as TikTok videos and scenery photographs that camouflage the operation’s goal of influencing public opinions.
All cryptocurrency accounts have reposted content from a Spamouflage account named “Watermelon cloth” at least once. A review of the account revealed that “Watermelon cloth” regularly posted content critical of social inequalities in the United States, the Ukrainian and Israeli governments, and praised China’s economic achievements and leadership role in solving international issues.
In one post, the account peddled the conspiracy theory that Washington was developing biological weapons in Ukraine.
“The outbreak of the Russo-Ukrainian war brought out an ‘unspeakable secret’ in the United States. US biological laboratory in Ukraine exposed,” the post said. X recently suspended Watermelon cloth’s account.
Since Watermelon cloth’s first posting in March 2023, its content has been reposted nearly 2,600 times, half of which were by the cryptocurrency accounts. Most of the remaining reposts were either by Spamouflage or other botlike accounts, according to data collected by DoubleThink Lab. The investigation also found that the cryptocurrency accounts’ amplification on average almost tripled the view number of a post.
Robotic behavior
All 1,153 cryptocurrency accounts have demonstrated patterns that strongly suggest they are bots instead of human users.
They were created in batches on specific dates. On April 6 alone, 152 of them were registered on X.
Over 99% of their content were reposts. A study of their repost behaviors on September 24 shows that all the reposts took place within the first hour after the original content was posted. Within each wave of reposts, all took place within six seconds, an indication of coordinated action.
At least one such account offered engagement boosting services in its bio with two Telegram links for interested customers. VOA Mandarin contacted the service seller through the links but did not receive a response.
Chinese official accounts amplified
The cryptocurrency group has also promoted posts from Chinese official accounts, including several that belong to Chinese local governments, state media and at least one Chinese diplomat.
The Jinan International Communication Center was the third most amplified account whose posts the cryptocurrency groups have shared. Its content was reposted over 2,200 times.
The Jinan International Communication Center was established in 2022 to promote the history and culture of Jinan, capital of the Shandong province in Eastern China, to the rest of the world as part of Beijing’s “Tell China’s Story Well” propaganda initiative.
A local state media account boasted in an article last year that Jinan was the third most influential Chinese city on X, which was then called Twitter.
Other Chinese cities, including Xiamen and Ningbo, and provinces, such as Anhui and Jilin, had their official accounts amplified by the cryptocurrency group.
Other amplified accounts include Xi’s Moments, a state media project propagating Chinese leader Xi Jinping’s speeches and official activities; China Retold, a media group organized by pro-Beijing politicians in Hong Kong; and the English-language state-owned newspaper China Daily.
Zhang Heqing, a cultural counselor at the Chinese Embassy in Pakistan, was the sole Chinese diplomat whose posts were promoted by the cryptocurrency group.
DoubleThink Lab wrote in an analysis of the data and findings that Chinese official accounts and the Spamouflage operation have “likely” used the same content boosting services, which explains why they were amplified by the same group of cryptocurrency accounts.
The Chinese Embassy in Washington, D.C., declined to answer specific questions about what appears to be a connection between the cryptocurrency group, Chinese official accounts and Spamouflage.
But in a written statement, spokesperson Liu Pengyu rejected the notion that China has used disinformation campaigns to influence social media users in the U.S.
“Such allegations are full of malicious speculations against China, which China firmly opposes,” the statement said.
