Spambots are impersonating teens to spread pro-Trump tweets

A new Twitter campaign is impersonating American teens, and using their likenesses to spread right-wing propaganda. The pattern was identified by Nicole Flotteron, who analyzes Twitter activity at Mercury LLC, after a friend fell victim to the scheme. But while Flotteron is used to spotting spam, she says this is something different. “They’re pushing pro-Trump propaganda,” Flotteron told The Verge. “There are a lot of disturbing things that happen on Twitter, but I’ve never seen something like this.”

Flotteron identified 48 separate accounts that seem to use the techniques, although whether all of the accounts were created by the same group. In each instance, the photo was cloned from a real account and the username was marginally changed, giving it the appearance of authenticity. Twitter’s API limits prevented a more thorough scan, and it’s likely the 48 identified accounts are only a small fraction of the total accounts created by the campaign. “They’re finding accounts that are inactive,” Flotteron says, “almost all of young people, which is very different from typical spambots.”

The accounts are particularly notable because they contain no original tweets, sticking entirely to retweets of existing accounts. As Flotteron points out, that makes it easy to bypass Twitter’s traditional spam filters, which look for suspicious phrases or links in original tweets. Since the accounts aren’t creating tweets, there’s nothing to catch in the filter, but they can still boost retweet numbers, potentially giving favored tweets an advantage in Twitter’s algorithmic “You May Have Missed” section.

The accounts promote a range of tweets, including many tweets with no obvious spam value or political content. Still, the majority take a right-wing perspective on the politics, sharing photos from Trump rallies, criticism of Angela Merkel’s refugee policies in Germany, or links to articles from the pro-Putin site Sputnik News. A number of the linked stories are based on emails published by Wikileaks, a hack many have attributed to Russia. Other retweets are more familiar spam, sharing links to pornography streams or affiliate-friendly stores.

It’s hard to say how effective the campaign has been. None of the accounts have large follower bases, so it’s unlikely the tweets traveled significantly farther as a result of the campaign. The main effect may be a simple appearance of popularity, mixed in with marginally profitable spam.

For Flotteron, the most troubling part is the people being impersonated. “A lot of these are teenagers, these are American kids,” Flotteron says. “It’s scary. It’s concerning that they’re leveraging young people to do this.”