About three years ago, a bunch of accounts with GAN-generated faces moved their companies to Las Vegas, where their companies were nearly destroyed. #NewYearsShenaniGANs
The duplicate tweets about moving a company to Las Vegas are from a botnet consisting of 37 accounts created on Sept 28th/29th, 2022. All 37 accounts have GAN-generated face pics, and (with the exception of a few early tweets) all tweet exclusively via automation service IFTTT.
GAN-generated face pics (at least, the ones in common usage generated by StyleGAN) have the telltale trait that the major facial features (especially the eyes) are in the same location on every image. This becomes obvious when the images are blended together.
The content tweeted by this botnet is repetitive, with tweets being duplicated verbatim across multiple accounts. Most of the tweets appear to be fragments of articles published by Success magazine.
In addition to the repetitive tweets copied from Success magazine, this network also occasionally tweets links to two websites - strive(dot)co and teamfearless(dot)com. These tweets are infrequent - only 253 of the network's 9165 tweets (2.8%).
More on GAN-generated profile pics and their use on Twitter and other platforms here:
Meet @SophiaM98566027 (permanent ID 1602043736195751937), a Twitter account created in December 2022 with a stolen profile photo that claims to be a Democrat and 12-year military veteran (allegedly serving in the "Nation Guard").
Unsurprisingly, @SophiaM98566027's profile pic is not the only plagiarized photo posted by this account. The photographs in the account's "good morning" tweets are stolen from the social media pages of random models, and are therefore unlikely to depict the account operator.
This photographic plagiarism habit isn't limited to images of humans. @SophiaM98566027 has repeatedly tweeted stolen cat and dog pics, often claiming or implying that the photos depict @SophiaM98566027's pets.
Here's a look at 60 hours' worth of recent growth of one of the largest fake follower networks we've ever seen. Between midnight on December 22nd and noon on December 24th, the network's operators created (at least) 131268 empty Twitter accounts.
We've been tracking various iterations of this massive fake follower network for months, over which the operators of which have created (and lost) millions of fake Twitter accounts. Some previous threads:
The two accounts most frequently followed by these fake followers are @elonmusk and @Twitter, whom the fake accounts followed ~2 days after being created. These fake accounts comprised 23.4% of @elonmusk's and 69.5% of @Twitter's most recent followers as of Dec 26th at 17:30 PST.
It's Christmas Day, so to mark the occasion here's a thread on an NFT spam network tweeting about a "Penguin Christmas" and tagging a bunch of random accounts.
This spam network consists of 830 accounts created on November 21st, 2022. Their @-handles are composed of ten random letters: the first either uppercase or lowercase, the next four lowercase, and the last five uppercase. Most of their display names contain the word "penguin".
Although there are 830 accounts in this network, they only have 23 distinct profile images between them. Each image is used by between 21 and 49 of the accounts in the network.
This spam network consists of 50 accounts with female names created on April 26th and April 27th, 2022. Thus far, these accounts have posted all of their tweets via "Twitter for Android", and all appear to have been dormant between October 2nd and December 2nd.
The tweets tweeted by this network are often repeated verbatim by multiple accounts. Their content is a mix of feel-good content about Xinjiang, denial of human rights abuses by China, and tweets about U.S. political issues (abortion, student loans, military aid to Ukraine, etc).
Over the last 3 years, we've analyzed and posted threads about a variety of similar spam networks associated with an entity known as "Thousand Followers" or "Thousand Bytes". Here's a Substack article covering the entire astroturfy saga.
This series of fake follower/account sales operations first came on our radar back in August 2020, when we ran across follower sales website thousandfollowers(dot)com. We found the site's operator(s) on BlackHatWorld, and kept an eye on their posts.
Answer: the tweets in question were amplified by a spam network consisting of (at least) 3586 accounts created between October 2013 and December 2022. The accounts have Turkish display names that rarely match their @-handles.
All of this network's recent tweets are retweets, and all of these retweets were tweeted via Twitter for Android. (Some accounts have older tweets sent with other apps; as we'll see, these accounts were likely hijacked and the old tweets are probably from the original owners.)