TL;DR: Disinformation campaign Spamouflage used 62 linked accounts to discredit Chile’s Operation High Voltage coverage with AI-generated posts and images, according to Graphika, while targeting six journalists and shifting pressure away from China. Influence operations now weaponise fabricated media and personal allegations to undermine reporting credibility and redirect public attention.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Graphika's research: Spamouflage used 62 linked accounts and AI-generated content to discredit Chile’s Operation High Voltage coverage and target journalists.
Why it matters: Influence operations increasingly blend synthetic media with coordinated account activity, which matters to practitioners responsible for trust, attribution, and narrative integrity across digital channels.
Context
Disinformation campaigns use coordination, synthetic content, and platform reach to damage trust in reporting and redirect attention from the underlying event. In this case, the governance problem is not just false claims, but the ability of inauthentic accounts to sustain a narrative long enough to shape perception.
For security and trust teams, the key issue is provenance at scale: who is speaking, whether the content is synthetic, and how quickly a coordinated narrative can be contained before it spreads across platforms.
Key questions
Q: How do coordinated influence networks survive platform takedowns?
A: They survive by distributing the narrative across many accounts, platforms, and posting cycles so that removing one node does not remove the story. The operational defence is to hunt the coordination pattern, preserve evidence quickly, and disrupt the repost and amplification structure that keeps the campaign alive.
Q: Why do synthetic posts make disinformation harder to contain?
A: Synthetic posts make disinformation harder to contain because they can be produced at scale, tailored to different audiences, and republished through many accounts faster than moderators can verify them. They also blur provenance, so analysts must rely on platform telemetry, content similarity analysis, account behaviour, and rapid takedown workflows to separate coordinated manipulation from genuine discussion.
Q: What should security teams do when a campaign targets journalists or analysts?
A: Security teams should protect the targets, preserve evidence, and disrupt the campaign’s delivery channels. That means hardening accounts with phishing-resistant MFA, reviewing exposed contact details, monitoring impersonation and doxxing, escalating platform abuse reports, and providing journalists or analysts with secure reporting paths, account recovery support, and rapid threat-intelligence sharing.
Q: How can teams detect coordinated inauthentic behaviour in real time?
A: Teams detect coordinated inauthentic behaviour in real time by correlating account age, posting cadence, IP or device reuse, graph links, and shared content fingerprints across accounts. Behavioural analytics, bot detection rules, and network indicators can then flag campaigns, while analyst review confirms whether the activity is centrally coordinated or merely similar.
Technical breakdown
How coordinated inauthentic networks sustain a narrative
Spamouflage-style operations rely on many accounts posting in parallel so the activity looks distributed rather than centrally managed. The practical effect is resilience against takedowns, because the narrative persists even when individual accounts are removed. This is less about a single false post and more about orchestration: account churn, repeated themes, repost amplification, and cross-platform redundancy. The defenders' challenge is to detect the pattern of coordination, not just the content of any one post.
Practical implication: Track coordinated posting clusters and remove narrative amplification paths as well as individual accounts.
AI-generated text and imagery in influence operations
Synthetic text and images reduce the cost of producing large volumes of plausible but misleading content. The critical risk is not perfect realism, but enough consistency to create momentum, confuse verification, and seed search and social feeds with repeated claims. When AI-generated material is combined with human-run distribution, it becomes harder to separate production from orchestration. That complicates moderation, analyst triage, and evidentiary attribution because the content artifact and the operator are no longer the same thing.
Practical implication: Build detection workflows that assess both media authenticity signals and account-level coordination patterns.
Why journalist targeting changes the risk profile
When an influence operation shifts from issue messaging to personal allegations against journalists, it is trying to undermine the messenger as much as the story. That changes the defence problem from content moderation alone to reputational resilience and witness protection. The campaign can erode confidence even if the underlying reporting stands up, because the attacker is attacking trust in the people carrying the information. This makes editorial teams part of the threat surface, not just the channel.
Practical implication: Treat journalists and source communities as protected trust assets in your monitoring and response playbooks.
Threat narrative
Attacker objective: The objective was to weaken trust in the reporting, shift blame away from China, and blunt the reputational impact of the copper smuggling investigation.
- Entry began when Spamouflage-linked accounts started posting about Operation High Voltage across multiple platforms, creating initial narrative presence.
- Escalation followed as the network used AI-generated text and images to amplify discrediting claims and repeat allegations across accounts.
- Impact was the attempted erosion of journalist credibility and the redirection of attention away from the smuggling investigation and its reporting.
Breaches seen in the wild
- New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Synthetic influence is now an operations problem, not just a content problem. The significance here is the coordination layer: multiple inauthentic accounts, repeated themes, and AI-generated assets combine to create scale. Defending against that requires looking for orchestration patterns, not only false statements. Practitioners should treat cross-platform narrative coordination as an active threat indicator, not a moderation edge case.
Journalist targeting marks a higher-risk phase of influence activity. Once an operation moves from policy messaging to personal allegations against reporters, the goal is to contaminate the credibility chain that carries the facts. That raises the stakes for media organisations, platform trust teams, and threat intelligence groups that track reputational attacks. The practical lesson is to monitor who is being targeted, not only what claim is being pushed.
Attribution confidence depends on behavioural evidence, not just content similarity. The strongest signal in campaigns like this is the relationship between account behaviour, timing, and repeated narratives across platforms. That makes provenance analysis and network mapping central to response. Security and trust teams should prioritise structured evidence collection that survives takedowns and content deletion.
Influence operations increasingly exploit the gap between synthetic production and human distribution. The campaign shows how AI-generated media can be used as a force multiplier for a broader political objective. The named concept here is coordination camouflage: the use of many accounts, repeated messages, and synthetic assets to make central orchestration look like organic chatter. Practitioners should build defences that detect the campaign shape, not just the payload.
What this signals
Coordination camouflage: influence operators can hide central direction behind many accounts, repeated claims, and synthetic assets, which means defenders need pattern analysis rather than single-post judgment.
The practical next step is to align trust-and-safety response with threat intelligence workflows so that narrative shifts, account clustering, and media provenance are evaluated together.
Where a campaign moves into personal attacks on journalists, organisations should expect a credibility operation and prepare for faster escalation across platforms and audiences.
For practitioners
- Map coordinated account clusters Correlate posting times, repeated narratives, and platform overlap to identify the orchestration layer behind apparent organic discussion.
- Validate media provenance before escalation Check whether images, stills, and text show synthetic generation or reuse before treating them as standalone evidence.
- Track journalist-targeting patterns Escalate when a campaign shifts from issue framing to allegations against named reporters or outlets, because that change often signals a credibility attack.
- Preserve behavioural evidence for attribution Capture account relationships, cross-platform reuse, and timing data before content disappears, so later analysis can distinguish coordination from coincidence.
Key takeaways
- Spamouflage’s campaign shows that influence operations can scale through synthetic content and coordinated accounts rather than through any single viral post.
- The reporting pressure on Chile’s copper smuggling case was paired with direct attacks on journalists, which widens the trust and reputation problem.
- Defence works best when teams monitor coordination patterns, preserve behavioural evidence, and treat journalist targeting as a credibility attack.
Related NHI Mgmt Group resources: MITRE ATT&CK Coverage Mapping Guide · Writing Threat Intelligence Reports · New York Times GitHub breach 2024
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0005; TA0011; TA0040 — Stealth; Command and Control; Impact | Coordinated inauthentic behaviour uses stealth, controlled distribution, and reputational impact. |
| Recommendation — Map coordinated narrative campaigns to ATT&CK behaviours and look for timing, persistence, and amplification patterns. | ||
| NIST CSF 2.0 | DE.AE-02 — Anomalous Events | Coordinated posting spikes and synthetic media create anomalous activity worth investigating. |
| Recommendation — Detect unusual narrative clustering and escalate it as an anomaly in your monitoring process. | ||
| CIS Controls v8 | CIS-17 — Incident Response Management | Influence campaigns need structured detection, triage, evidence retention, and coordinated response. |
| Recommendation — Use incident response playbooks to preserve evidence and coordinate cross-functional handling of influence activity. | ||
Key terms
- Coordinated Inauthentic Behavior: Coordinated Inauthentic Behavior is a pattern of deceptive activity where multiple accounts or entities act together to mislead people about who they are or what they represent. In trust and identity settings, it often involves fake personas, account networks, or synchronised amplification used to manipulate verification, reputation, or access decisions.
- Narrative Mapping: Narrative Mapping is the process of organising a disinformation or influence campaign into its core themes, claims, audiences, and intended effects. Analysts use it to trace how messages evolve across posts, accounts, and channels, and to identify which content is meant to persuade, provoke, or distract.
- Attribution Indicator: An attribution indicator is a clue that points towards the likely source, actor or campaign behind an event. In cyber and influence analysis, indicators can include infrastructure overlap, coding style, posting cadence, language patterns or reused tooling, but each one needs corroboration before it is treated as evidence.
- Influence Operations: Influence operations are coordinated efforts to shape public perception, weaken trust, or manipulate behaviour through information campaigns. In cybersecurity discussions, they are important because attacks on trust can damage institutions even when no system is technically broken. They often exploit leaks, hacks, or synthetic media to amplify confusion.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, IAM, and secrets management. It helps security and identity practitioners connect identity controls to the broader risks their programmes must manage.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org