By Fatma Younis
Analysts at Graphika have identified a China-linked influence campaign known as Spamouflage operating on X ahead of the U.S. midterm elections, with accounts posing as American voters and posting divisive political content.
Accounts mimic tactics from 2024 election
In a blog post Friday, the New York-based network analysis firm said the Spamouflage-linked activity closely resembles tactics documented during the 2024 presidential election. The accounts post content questioning election integrity and the legitimacy of U.S. democracy.
China focuses on undermining confidence in US democracy
Intelligence and national security officials have long warned that Russia, China, and Iran run online influence operations targeting U.S. voters. Observers say China's efforts aim to undermine confidence in elections, voting, and the United States generally, rather than support a specific candidate. The Chinese Embassy in Washington did not immediately respond to a request for comment.
Expert says operation ineffective at swaying political conversation
Darren Linvill, who co-directs Clemson University's Media Forensics Hub and has tracked Spamouflage, said there is "no chance it tips the balance in any real political conversation." He described the network as "famously bad at mimicking real Americans" but more effective at suppressing information by frequently attacking and harassing members of the Chinese diaspora community.
Graphika flags specific accounts
Graphika identified an account that appears to have replaced a previously removed Spamouflage-linked account, posting divisive U.S. political content including attacks on Democratic Party leadership during the October 2025 government shutdown and criticism of immigration policy. The firm also flagged four accounts with a history of Spamouflage activity that now amplify MAGA-styled personas, and another account with more than 200,000 followers that presents itself as a Philippine culture blog but now posts pro-China and divisive U.S.-focused content. Graphika could not determine whether that account was hijacked or its original operator lost control.
