Meet @BlancaMatos13, a four-week old Twitter account with a penchant for using stolen photos and a distaste for Ecuadorian presidential candidate Andrés Arauz. Unsurprisingly, this account is not a solo act.
The @BlancaMatos13 account is part of a network of (at least) 63 accounts created in batches in March 2021 that all tweet almost exclusively via TweetDeck and have Ecuador as their profile location. Most operate on very similar schedules.
This network is likely using TweetDeck's scheduling feature, which disproportionately posts its tweets during the first second of the minute for which they are scheduled. (It's also possible that TweetDeck is being automated using other software with similar scheduling behavior).
The hashtags most frequently tweeted and retweeted by this network are mostly related to the politics of Ecuador, with a particular focus on criticizing presidential contender Andrés Arauz. "Arauz" is, in fact, the most frequently used non-trivial word in their tweets.
We already touched on the use of stolen pics briefly in the first tweet in this thread, but here are a few more examples of accounts in this network with stolen profile pics. Note that the originals have been cropped and in some cases flipped horizontally.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
It's New Year's Eve, and a bunch of politics enthusiasts with GAN-generated faces are enthusiastically replying to a variety of posts with similarly-worded replies. #NewYearShenaniGANs
cc: @ZellaQuixote
The politics enthusiasts are part of a spam network consisting of (at least) 575 accounts created between May and December 2023 with GAN-generated faces. Many of their handles, such as @Maairiuieinaaa and @eJooeiaAoneueer, contain long strings of vowels.
@Maairiuieinaaa @eJooeiaAoneueer All 575 of these accounts use StyleGAN-generated faces as profile images. Some of these, such as @MauMoiagaia's profile image, contain a tiny "StyleGAN 2 (Karras et al.)" watermark in the lower right corner.
It's a great day to look at a network of inauthentic accounts that post identical AI art images (with a side of good old fashioned T-shirt spam).
cc: @ZellaQuixote
This network consists of 24 X accounts. 12 of these accounts were created in the latter half of 2023 and have female avatars, while the other 12 were created in 2013 or earlier and have male avatars.
The 12 accounts with female avatars and 2023 creation dates regularly post AI-generated art images, and these image posts are quickly reposted by other accounts in the network (both female and male). The AI-generated images are often duplicated across accounts.
Meet @ImJamesMiller (permanent ID 1371651462153994242), an account with a GAN-generated face, 172K followers, and no tweets prior to two days ago. What's up with that?
cc: @ZellaQuixote
As it turns out, @ImJamesMiller wasn't always named @ImJamesMiller. In June, the account was named @/IamJimCaviezel in an apparent attempt to impersonate Sound of Freedom actor Jim Caviezel.
@ImJamesMiller Multiple prominent users appear to have accepted the fake Jim Caviezel account as legitimate, including Texas Congressman Brian Babin, right-wing influencer/ex-Game of Thrones blogger Jack Posobiec, and recently indicted ex-Assistant Attorney General Jeff Clark.
It's a great day to look at a network of Bluesky spam accounts with randomized names. #SundaySpam
cc: @ZellaQuixote
This spam network consists of (at least) 401 accounts, all of which were created (or added to the Bluesky app view) in August 2023. These accounts do not follow each other; rather, each one follows a small number of popular Bluesky accounts.
The accounts in this network cycle rhythmically between posting three types of content:
• reposts
• posts containing links to news articles
• posts containing links to news articles accompanied by images
Meet @thisisorange, a Twitter account created in February 2022 with a gold "verified organization" badge, thousands of batch-created fake followers, and a couple other interesting traits.
Verified organizations on Twitter can verify affiliated accounts (employees, teams, brand names, etc), which receive blue checkmarks as well as an organization badge (help.twitter.com/en/using-twitt…). The @thisisorange account has thousands of affiliates, mostly cryptocurrency accounts.
How did this come about? The website linked on @thisisorange's profile (orange dot associates) apparently allows one to become an affiliate simply by providing a Twitter account and a cryptocurrency wallet.