Digital Intelligence Team／Doublethink Lab

Between March 15, 2025 and April 30, 2025, Doublethink Lab has observed 51 inauthentic accounts that pretended to be Taiwanese citizens and participated in political narratives that mainly criticized Taiwan’s Democratic Progressive Party (DPP) on Threads. All of the accounts stole photos from Taiwanese or other Asian influencers. Based on these accounts’ forensic indicators, we believe it is likely that they can be linked to the PRC.

Introduction

Threads has steadily risen in popularity in Taiwan. The platform has become an important space for domestic political debate among young people, particularly during the 2024 Taiwanese presidential elections, the ensuing recall campaigns, and protests. Research by Street Corner Sociology found that Threads was one of the most important platforms for protesters during the Bluebird Movement in 2024. For these reasons, it is not unusual to see heated political discussions on the platform. Between March 21, 2025 and April 15, 2025, Doublethink Lab observed significant traffic around the phrase “I am Taiwanese and I oppose pan-green 「我是台灣人我反綠」”. We analyzed 1006 posts that contained this phrase in the above-mentioned time period. Among this data, we identified 91 posts by 51 inauthentic accounts that can likely be connected to the PRC. This research further investigates the behavior and content of these 51 accounts.

Threat actors

The 51 inauthentic accounts were created between June 2024 and April 2025. The accounts all used stolen profile photos of Asian women (see behaviour section). They made 7,032 posts between June 5, 2024 and April 30, 2025. Virtually all posts were in traditional Chinese. We believe that the accounts can be connected to the PRC for several reasons. First, 23 of the accounts made a total of 71 posts that contained simplified Chinese characters. In some posts, this includes posts that were almost completely in simplified Chinese, whereas other posts only had one or two simplified characters that were likely the consequence of conversion errors.

Second, due to Threads and Instagram’s login design, it is possible to see a redacted version of the destination of password reset links after pressing ‘forgot password’ (footnote 1). Through this method, we found that one of the accounts was linked to a phone number in Hong Kong. Another account was linked to a phone number in Poland.

Finally, the accounts showed a similar ‘influence for hire’ pattern that we also noticed during the US elections (Footnote 2). Alongside the political content, the account promoted specific sex dating websites without any clear connection to the PRC (Footnote 3). This leads us to hypothesise that the accounts are operated by amplification service providers that serve different types of clients. We will have to conduct further research to prove this hypothesis.

Behaviour (DISARM Tactics, Techniques, and Procedures)

• Divide T0079: The threat actor sought to divide the Taiwanese public by amplifying divisive political content, most of which criticized the DPP.
• Motivate to Act T0138: The accounts posted over nine posts that encouraged people to protest against the DPP government.
• Copy Account Imagery T0145.001: Campaign stole photos from female influencers. We were able to identify the picture origins of 44 out of 51 accounts
• Fabricated Persona T0143.002, Create Localised Content T0101: Most of the accounts consistently posted stolen account imagery from one specific individual in an attempt to fabricate a consistent person. Most of the stolen account imagery came from small Taiwanese beauty bloggers and influencers, but some also came from Thai and Malaysian individuals. The accounts posted about specific local events like the Taiwan Music Festival in an attempt to fabricate a Taiwanese persona.
• Generate Content Unrelated to Narrative T0129.002: The accounts posted sexually suggestive content alongside political content.
• Flood Information Space T0049: The accounts engaged in bot-like behaviour to flood people’s timelines. To illustrate, we conducted a keyword search for the term “I am Taiwanese and I oppose pan-green 「我是台灣人我反綠」”, which returned 1,006 posts between March 13, 2025 and April 15, 2025. 91 of these posts (~%9) came from these 51 inauthentic accounts.
• Link Shortening Platforms T0153.002: ​​Accounts used TinyURL to disguise the sex date website links.
• Bots Amplify via Automated Forwarding and Reposting (T0049.003): The accounts engaged in highly coordinated behaviour. Many of the accounts posted similar, or exactly the same content (Copypasta T0084.001). The graph below (left) shows the number of times that each of the 51 accounts made a post that was also posted by at least ten other accounts. The accounts often did so within short periods of time. The table below (right) shows that 12 different accounts made 13 posts with exactly the same content in a short time period of 20 minutes.

In addition, at least one of the accounts also made a sloppy mistake that can likely be attributed to erroneous bot settings. Specifically, on April 29 one of the accounts posted that it would attend the anti-DPP protests on April 26, three days after the protests took place (see image below).

Content (Narratives)

Our targeted keyword searches of the 7,032 posts revealed roughly 290 posts related to politics. Virtually all of these posts (275) were identical posts that opposed the DPP: “I’m not afraid of online bullies or doxxers. I’ll post what I want! I’m Taiwanese and I oppose pan-green.「霸凌肉搜什麼的我通通都沒在怕啦我就是要po！我是台灣人，我反綠」”. In addition, there were 10 other posts that expressed direct support for the Taiwan People’s Party and the Kuomintang by expressing support for the protests organized on April 26, 2025 (see figure 5). Interestingly, there were 5 posts that directly criticized the Chinese Communist Party (CCP). These posts used almost exactly the same phrase as the 275 anti-DPP posts but replaced “oppose pan-green「反綠」” with “oppose the CCP 「反共」”. It is unclear whether the accounts used this method to further divide and agitate both sides of the political spectrum, or if the posts were erroneously copy-pasted from other social media users (during that time, “I am Taiwanese and I oppose the CCP 「我是台灣人我反共」” was also a popular phrase on Threads).

It is important to note that political posts only made up a small portion of the accounts’ timelines. Virtually all of the other posts contained sexually suggestive content and links to sex dating websites. In total, we found 1,122 posts with links to these dating websites.

Impact

On average, the accounts in question obtained 143 likes, 11 comments, 2 reposts and 2 shares. However, these numbers were significantly higher on the political posts, which obtained an average of 506 likes, 16 comments, 2 reposts and 2 shares. The most popular non-political post obtained 18.8K likes and was viewed over 247K times (current data collection methods do not allow us to calculate average view counts). The most popular political post obtained 7.8K likes and 78K views. Some of the comment sections contain comments that disagree with the account or point out that the profile photos are stolen. For this reason, we believe this campaign scores a 2 out of 6 on the breakout scale. The posts broke out of the inauthentic bubble but stayed on one platform. It is important to note that researchers and users have pointed out that Threads appears to drive higher interaction numbers than X.

Concluding Remarks

The 51 accounts discussed in this article are likely part of a larger group of inauthentic accounts that are operating on Threads. This initial research indicates that the network is likely part of an ‘influence for hire’ network that shares some similarities with a network we have identified earlier on X. Additional research is required to further assess this network’s true size and its connection to the PRC’s wider propaganda infrastructure.

Footnotes

1: It appears that only Threads and Instagram show this redacted version of password reset link destinations. This method is not possible on other platforms.

2: During the US elections, we found CIB accounts that amplified both crypto currency promotion accounts as well as Spamouflage and PRC state owned media outlets. Some of the CIB accounts advertised boosting services in their account bio. This led us to hypothesise that the CIB accounts were operated by amplification service providers that catered to different types of clients. This case in Taiwan is slightly different, as the CIB accounts in question posted the political content directly to their own timelines. The CIB accounts we discovered during the US elections only reposted other accounts and did not post anything directly to their own timelines.

3: The shared links pointed to bllsteringdates[.]com, which then forward users to other websites like blink-match[.]com and onenightfriend[.]com. At least 10 of the accounts used exactly the same tracking links, which serves as further evidence that the accounts are operated by the same actor.