A network of fake accounts are posing as young American women, posting pro-Trump content and disinformation, but they’re hiding behind, and manipulating, the images of European fashion influencers.
Our latest investigation at @Cen4infoRes. Details in this thread 🧵👇
Our full analysis can be seen at @Cen4infoRes here: . We also collaborated with @CNN to dig out the human stories behind those who had their photos stolen
One of the accounts is Eva. She lives in the US, and likes hanging out at the beach and posting to her 5000+ followers on X. Eva posts strong opinions against LGBTQ people and the US Democratic party and is a loyal supporter of former US president Donald Trump.
The blonde-haired woman pictured on Eva’s X profile, “eva_maga1996”, is not pro-Trump Eva, but a Danish fashion influencer whose images have been taken from her Instagram profile and used without her permission.
There are more of these fake accounts. We uncovered at least 17 others, some with thousands of followers each, posing as pro-Trump American women and hiding behind stolen and sometimes manipulated photographs. We found in total 56 matching the same appearance in the network.
Many of the photos stolen to create new personas on X, are from fashion influencers – most of whom are based in Europe.
Many of the fake accounts spread falsehoods and conspiracy theories. They praise Trump and Senator JD Vance, discredit Democratic Party members such as Biden and Harris and post divisive content in US politics, such as LGBTQ rights and aid to Ukraine.
Without insight into X’s data, it’s not clear who is behind these accounts, or to confirm whether they’re pushing pro-Trump content for ideological or monetary gain.
So let’s dig into what these accounts are doing, and how they are doing it.
In a number of cases, influencers’ photos were not just stolen and repurposed as new online personas but were manipulated to make it look like they were wearing pro-Trump paraphernalia.
Many of the accounts identified by CIR appeared in May and June this year. At least 13 accounts in the network had the blue tick verification badge which they obtained in either July or August 2024.
The criteria for achieving a blue tick states that accounts must have a name, a profile image, a phone number and active X premium sub, which requires processing of payment details. X also requires "no signs of being misleading or deceptive”. help.x.com/en/managing-yo…
The accounts share common traits such as listing their location as the US and often express support for President Trump and a love of God in their bios. Some of these accounts gained significant traction on X with some getting tens or even hundreds of thousands of views.
Some of the accounts attempted to establish ownership over the images by outing other accounts who they claim are using the images without their permission. In some cases, they claim they have reported and blocked these accounts, and call on their followers to do the same.
The content shared by the accounts is broad in subject, but much of it covers issues related to the election. CIR found posts mentioning the assassination attempt on President Trump, Vice President Harris’ ethnicity and defunding military aid to Ukraine.
Many of the accounts published or retweeted posts scrutinising Olympic boxer Imane Khelif, who was recently the centre of a gender eligibility row, despite the International Olympic Committee (IOC) confirming her eligibility to compete in the games.
In a number of the posts, the fake accounts sought to exploit wedge issues and existing tensions, at times spreading misinfo and conspiracy theories, concerning in the run-up to the US election.
We worked with CNN to tell this story, who interviewed some of the women who had their photos stolen, and some of the specialists who gave important context as to how this fits into the bigger picture. H/T @katie_polglase @PallabiMunsi @ArvanitidisCNN
@katie_polglase @PallabiMunsi @ArvanitidisCNN For this story @CNN reached out to X regarding these accounts "but did not receive a response". However, in the last 24 hours before publishing, X took down the majority of the accounts.
@katie_polglase @PallabiMunsi @ArvanitidisCNN @CNN Even though X took down many of the accounts, the pro-Trump fake account @Luna_2K24 is still active with a large following. The photos stolen to create that persona are photos of the Instagram influencer that @CNN's @katie_polglase interviewed as part of this collaboration.
Good to see the account @Luna_2K24 was finally taken down over the past hour.
So the account @luna_2k24, that stole someone’s photos to make a new persona and was part of a pro-Trump operation, has now renamed their account and continues to post as @Princess_S2K.
They blocked me, but it doesn’t stop the community of watchers out there.
I have received a number of messages asking about the location of this IL-76 (RA-76502) from Russian Aviacon Zitotrans (usually responsible for arms cargo).
It is not landing in Sudan (alleged in the comments), but is landing in Faya-Largeau in northern Chad. More in thread 👇
I identified an original and more clear version on TikTok (not hard if you want to find it). In it, we can see the registration number of the plane much more clearly, as well as the dune and cliffs in the background.
The registration, RA-76502 that had been owned by JSC Aviacon Zitotrans, named by US as "a Russian cargo airline that has handled cargo shipments for sanctioned Russian Federation defense entities".
This festive season I’m sharing a video every day for the next 24 days showing useful OSINT tools & techniques. Creating this OSINT Advent Series has been a lot of fun and I hope it’s helpful for the ever-growing OSINT community! 🎄👇
1. Searching Facebook with WhoPostedWhat.
2. Using AI to identify a car model in an image with Carnet.
Today is #WorldMentalHealthDay. As digital investigators we're often not experiencing what we see online, in real life, but it can still affect many.
So to keep doing the important documentation and investigative work online, here's a few practical steps you can take.👇
1. When sharing graphic content with colleagues and friends, remove those previews and give a little graphic warning indicator. There's always a little 'X' in the corner to remove preview.
2. Consider changing the settings on your social media platforms so you're not absorbing horrific content while doomscrolling. You don't have to filter it out, but at least stop the autoplay.
I was recently on a flight across Australia when I spotted this massive figure on the ground. It led me on a digital journey to find out what it was, how it got there and who made it.
I'm going to explain a bit more about what it is in this thread, and how I found out. 👇🧵
Without internet on the plane, I made a screenshot on my phone of the location (yes it was on flight mode) and later used flight tracking to pinpoint exactly where I saw it.
Using @flightradar24, I traced the path my plane took and found the spot!
Next stop: @googleearth 🗺️
I zoomed into the area and there it was — this huge humanoid figure etched in the Australian outback. Measuring 2.7km tall and covering an area of more than 1.7 square kilometres, it's a sight to behold.
Despite our reporting last week on the fake network of pro-Trump MAGA accounts, there appears to be many more accounts actively posting the exact same content. This one, @brenda_otto_ with 18k+ followers, is stealing photos from an Australian Instagram model in Queensland.
Here's another fake MAGA account, @Tracy_Miller044, stealing images from a fashion blogger (a popular one too).
@Tracy_Miller044 - if you want to reach out and talk about your work, why you're running these campaigns etc, I'm open.
Here is @Sarah_Hickey__
Sarah is stealing the photos of a Czech Instagram influencer to create a persona claiming to be a MAGA republican conservative with 40k+ followers and a blue tick (which means it's apparently not misleading).
Today US DoJ announced seizure of two domains and the search of 968 accounts on X used in a "Russian-government backed campaign" to spread disinformation.
Affidavit includes all of the accounts requested from X 👇
The DoJ announcement said the campaign used elements of AI to create fictitious social media profiles purporting to belong to individuals in the United States, which the operators then used to promote messages in support of Russian government objectives. justice.gov/opa/pr/justice…
The affidavit for the accounts on X shows that all of the accounts were registered to email addresses that were either using the domain 'otanmail' or 'mlrtr' justice.gov/d9/2024-07/aff…