#PuppetMaster
How Breadcrumbs From Spamouflage-Linked Assets Led Us to an Accounts-for-Sale Service
In investigating the Chinese influence operation Spamouflage, we identified an entity generating inauthentic Facebook accounts used in a set of Spamouflage activity, primarily using the name Salva Store. They operate YouTube and Telegram channels to promote the sale of Facebook accounts and social media services, primarily on Meta platforms. Based on open-source indicators, we assess with high confidence that this intermediary is located in Bangladesh.
Key Findings
We identified 47 YouTube channels, seven Facebook accounts, seven Instagram accounts, three X accounts, two Tumblr accounts, and two Bluesky accounts linked to the Chinese influence operation Spamouflage and posting a video, “VENOM: The Blackmail Symbiote.” The video suggests the U.S. president started the Iran war to shift public attention away from the release of government files on late sex trafficker Jeffrey Epstein.
The video was originally posted by an AI-generated Instagram video creator account, Forbidden Clothes, and later by a Chinese military blogger’s Weibo account. Watermarks from both accounts are visible on versions of the video.
Another set of 15 Facebook Spamouflage-linked accounts commented on Facebook posts from the previous set, bringing the total number of Spamouflage-linked Facebook accounts to 23. Three of those commenting accounts featured images with a “Salva Store” logo and a link to the Telegram channel Salva James.
That Telegram channel is linked to five others, as well as two Facebook pages, two web domains, and one YouTube channel, all collaborating to promote the sale of Facebook and other social media accounts. The web domains advertise Facebook and Instagram accounts, Meta ads, and Business Manager accounts, in addition to creating fake Gmail and Hotmail email addresses.
Based on open-source indicators, we assess with high confidence that this activity is based in Bangladesh.
Margot Fulde-Hardy researches Chinese online influence operations targeting global audiences. Additionally, she conducts investigations related to foreign information manipulation and interference campaigns targeting electoral contexts. Margot is also a FIMI-ISAC member and co-chair of OASIS Open source project DAD-CDM technical steering committee, where she supports the research on creating a common data model for FIMI campaigns, drawing on her expertise on STIX, TTPs, and OpenCTI.
Download the complete PDF
The full report includes the complete network graph maps, raw attribution indicators, cross-platform topology analysis, and the full takedown timeline with platform-level data.
- Full network graph visualizations
- Attribution indicators with confidence scores
- Raw behavioral modeling data
- Takedown coordination timeline
Related Reports
Summit Old, Summit New
Russia-Linked Actors Leverage New and Old Tactics in Influence Operations Targeting Online Conversations About NATO Summit
Read the Report
Glass Onion
Peeling Back the Layers of a Pro-China Online Ecosystem
Read the Report
Likes for Lorestan
On Oct. 11, Facebook said it had removed a network of 93 profiles, 15 groups, 14 pages and 194 Instagram accounts in September that originated in Iran and engaged in “coordinated inauthentic behaviour” to target domestic audiences in the country. We identified multiple open-source indicators that appear to corroborate Facebook’s attribution to individuals associated with the Islamic Revolutionary Guard Corps (IRGC).
Read the ReportSee How Graphika Can Help Your Team Act on This Intelligence
This report is one of 600+ investigations Graphika’s team has published. Our platform gives your analysts continuous access to the same intelligence — plus the tools to apply it to your specific threat environment.