Date investigated: April 30 – May 15, 2026 Operation name: Pharmaflage (Alethea designation), a Spamouflage Dragon / Dragonbridge campaign Attribution: Chinese state-linked (Spamouflage Dragon), high confidence Platforms observed: X, Bluesky, Medium, Blogspot, YouTube Persona × scenario tags:
-
CCO × coordinated disinformation campaign (geopolitical and policy narratives)
-
CISO × coordinated inauthentic behavior detected
-
CSO × named-individual targeting
-
Narrative engineered to reach AI systems
Executive summary
Alethea has uncovered a coordinated Chinese state-linked influence operation running across X, Bluesky, Medium, Blogspot, and YouTube from January to May 2026, ahead of the May 14–15 Trump–Xi Beijing summit, against a backdrop of mounting U.S.–China tensions over counternarcotics policy. The operation bears the hallmarks of Spamouflage Dragon, the Chinese state-linked information operation also tracked as Dragonbridge by Mandiant and Google's Threat Analysis Group. The campaign zeroes in on the U.S. fentanyl crisis and is engineered to reframe moral and political responsibility for synthetic-opioid deaths away from China and onto a triad of substitute targets: U.S. pharmaceutical manufacturers, the government of India (recast as the dominant supplier of fentanyl precursors), and the U.S. political and regulatory system itself (depicted as captured by capitalism and paralyzed by partisan gridlock).
Alethea's platform, Artemis, surfaced at least 34 X accounts producing 40 posts using the #Fentanyl hashtag before the bulk of the cluster was suspended for platform-integrity violations. Using a proprietary image-similarity search tool developed in-house, Alethea identified an additional three accounts, @gautier_ma1333, @MullinixL51767, and @dortch32103, and an additional 253 fentanyl-related posts between January 27 and May 11, 2026. Identical narrative content and images were surfaced on Medium under the persona @maxine444444411, on Blogspot at lupeone.blogspot.com, across five Bluesky accounts including @maxine4899 and @garcuelueig, and across at least six YouTube channels created between February and May 2026.
The campaign is consistent with prior Spamouflage operations but unique in four respects. First, it does not defend China outright. It crowds China out of the dialogue by saturating the discourse with substitutions. Second, it deliberately operationalizes a domestic U.S. populist narrative, attacks on Big Pharma and the Sackler family, regulatory capture, and partisan dysfunction, to merge with authentic American grievance rather than oppose it. Third, it shifts the supply-side accusation from China to India, a U.S. strategic partner, in a manner that aligns with public statements by senior Chinese diplomats, including the PRC Ambassador to the United States. Fourth, the Bluesky accounts identified in this investigation appear to represent the first public attribution of covert coordinated Spamouflage activity on the Bluesky platform, building on Alethea's prior first-attribution reporting of Spamouflage on Gab in 2023.
Engagement remains low, with most posts in the live dataset registering zero likes, zero replies, and view counts in the tens, which is itself a signature of Spamouflage operations. Rather than engagement, the network's strategic function is narrative supply. It seeds a persistent inventory of anti-Western, populist-framed content available for indexing, scraping, citation, and eventual amplification by larger actors, including PRC state media.
Key assessments
-
Attribution. Multiple independent indicators, image sourcing traced to Westca.com (a Vancouver-based Chinese-language portal), Mandarin-language YouTube file naming, the verbatim Chinese rhetorical construction "Capital is bloodthirsty," leading-hashtag syntax, and message alignment with PRC diplomatic statements, collectively support attribution to Spamouflage Dragon with high confidence.
-
Video forensics. Short-form videos across the X, Bluesky, and YouTube accounts carry a second cluster of indicators. The subtitle styling in several videos, white sans-serif with a soft drop shadow and a karaoke-style multi-line reveal, matches the default auto-caption output of CapCut and its mainland counterpart Jianying (ByteDance), the dominant mobile video editor in China. Several captions contain literal word-for-word translations from Mandarin that read as English filtered through a Mandarin syntactic template.
-
Temporal signature. All 348 posts in the dataset fall within UTC 00:00–09:59, corresponding to Beijing working hours (08:00–17:59), with 99.4% posted Monday to Friday and a visible activity dip during Beijing lunchtime. This workplace-hours rhythm is consistent with a state-directed workforce and matches posting behavior documented in prior Spamouflage reporting.
-
Strategic intent. The operation is a defensive narrative campaign in the run-up to renewed U.S.–China negotiations over precursor controls and fentanyl-related tariffs. Its purpose is to inoculate target audiences against U.S. policy designating fentanyl as a Chinese-origin threat.
-
Targeting. Content is crafted for English-speaking audiences across the U.S. political spectrum. Left-leaning audiences are offered an anti-capitalist Big Pharma critique. Right-leaning audiences are offered a critique of Indian supply chains, open borders, and Washington dysfunction. Bipartisan grief is mobilized around named teen victims.
-
Novel element. The deliberate elevation of India as a substitute supplier is the most distinctive feature of this campaign and a meaningful departure from prior Spamouflage fentanyl messaging. It coincides with public statements by senior PRC officials urging Washington to remove China from its major-drug-source-countries list and to look instead to precursors of Indian origin.
-
First public attribution to Bluesky. The accounts identified on Bluesky appear to represent the first public attribution of covert coordinated Spamouflage activity on the platform, and they show clear coordination with assets found on X and YouTube.
Background: who is Spamouflage Dragon?
Spamouflage, also referred to as Dragonbridge, is a covert information operation publicly attributed by Meta, Google, Microsoft, and multiple Western governments to the Chinese state, with the most authoritative public attribution naming the Ministry of Public Security as the operating authority. The network has been tracked continuously by open-source researchers since at least 2019, when Graphika first documented coordinated inauthentic accounts amplifying Beijing's narrative on the Hong Kong protests.
The operation is best understood as a sprawling, persistent infrastructure of inauthentic accounts that has, over six years, expanded across dozens of platforms including X, Facebook, YouTube, Reddit, WeChat, Quora, Vimeo, Tumblr, Pinterest, Medium, and Blogspot. Meta's August 2023 Adversarial Threat Report described Spamouflage as the largest known cross-platform covert influence operation in the world, removing roughly 7,704 Facebook accounts, 954 Pages, 15 Groups, and 15 Instagram accounts in a single takedown round.
Operational signature. Spamouflage favors quantity over quality. Its assets are typically low-engagement, single-purpose accounts with zero or near-zero followings, frequently no header images, stolen or AI-generated avatars, posts in stilted English suggestive of machine translation, and hashtag placement patterns inconsistent with English speakers. Content is replicated across the network as copypasta, generating the appearance of organic consensus while in fact representing a single editorial source.
Selected campaign history.
-
2019 Hong Kong protests: the network's first publicly documented operation amplified PRC framing of pro-democracy protesters as violent, foreign-backed agitators (Graphika).
-
2020–2022 COVID-19 origins: Spamouflage seeded the claim that SARS-CoV-2 originated at the U.S. Army's Fort Detrick facility (Meta).
-
2022 U.S. midterms: Mandiant documented Dragonbridge impersonating U.S. voters across the political spectrum and amplifying narratives of inevitable U.S. decline.
-
2024 Members of Parliament and diaspora targeting: Global Affairs Canada's Rapid Response Mechanism publicly attributed a Spamouflage operation targeting Canadian Members of Parliament.
-
2024–2025 persona impersonation and "MAGAflage": the Institute for Strategic Dialogue documented a network impersonating American conservative voters, including fabricated MAGA personas, indicating a methodological shift toward immersion within authentic domestic American grievances.
Why this operation is unique: narrative substitution
Most documented Spamouflage activity falls into one of two patterns: direct defense of the PRC (Hong Kong, Xinjiang, Taiwan) or non-specific anti-U.S. denigration designed to depress confidence in American institutions. The fentanyl campaign documented here is a third, more sophisticated category: narrative substitution. Rather than defending Chinese conduct or attacking U.S. conduct in the abstract, the operation populates the information environment with a complete alternative causal story, one in which China is simply absent.
1. Absence-by-substitution, not denial. In the 253 posts from the three persistent X accounts, the word "China" appears only five times, and in those instances China is the named victim of false U.S. accusation rather than the defendant. By erasing China from the conversation while filling that space with Purdue, the Sacklers, the FDA, the DEA, social platforms, Republican obstructionism, Democratic incompetence, and Indian generic-drug manufacturers, the operation removes the question "is China responsible?" from the discourse entirely.
2. Weaponized populism across the political spectrum. The campaign's narrative architecture is deliberately bipartisan in its anger. The anti-Big-Pharma material is calibrated for left-of-center audiences; the India-precursor and border-control material is calibrated for right-of-center audiences concerned with immigration and supply-chain sovereignty; the teen-fentanyl-deaths material is calibrated for the politically unaffiliated parent demographic. It is a deliberate effort to attach Spamouflage content to whatever authentic American outrage is already moving through the platform.
3. Convergence with official PRC diplomatic messaging. On May 12, 2026, the Chinese Ambassador to the United States posted a long-form statement asserting that the fentanyl crisis in the U.S. was not created by China, citing a 37.5% decline in U.S. fentanyl deaths and urging the United States to stop shifting the blame and remove China from its major-drug-source-countries list. The covert network's messaging is the same brief, delivered by inauthentic personas in colloquial English, four to six weeks earlier and with broader cross-platform distribution.
4. The pivot to India as substitute supplier. Earlier Spamouflage fentanyl messaging in 2023 and 2024 typically deflected toward Mexican cartels or domestic U.S. drug culture. The deliberate elevation of India as the principal precursor supplier, with claims that "80% of precursors come from India," is a notable geopolitical shift. India is a U.S. strategic partner and the most important regional counterweight to PRC ambition. Inserting India into the fentanyl supply chain serves a dual purpose: it removes China from the supply-side narrative and introduces friction into a U.S.–India relationship Beijing has reason to weaken. The claim is unsupported by current DEA and ONDCP reporting, which continues to identify China as the primary source of fentanyl precursors flowing to Mexican cartels.
Network composition and scope
The persistent X cluster (example accounts).
| Account handle | Display name | Created | Posts in dataset | Followers / Following |
|---|---|---|---|---|
| @gautier_ma1333 | Maxime Gautier | January 2026 | 81 | 0 / 5 |
| @MullinixL51767 | Mullinix Lourdes | March 2026 | 86 | 0 / 0 |
| @dortch32103 | Robare Dortch | March 2026 | 86 | 0 / 0 |
Across these three accounts, Alethea collected 253 posts frequently using the #Fentanyl hashtag between January 27 and May 11, 2026, an average of about one post per day per account during the peak operational period of April 30 to May 11. Posting volume rose sharply in late February 2026, aligning with the broader account-creation wave, and remained elevated through the May Fentanyl Awareness Day campaign window.
Cross-platform infrastructure.
-
Medium. The persona @maxine444444411 ("Maxine," 0 followers, 1 following) published at least fifty long-form fentanyl essays going back to March 2026, including "The Great American Dodge: How Washington Uses a Decline in Overdose Deaths to Hide Its Own Fentanyl Failures," "How American 'Pain-Relief Culture' Conspires with Capital to Slaughter the Underclass," "The 'Fig Leaf' Covering U.S. Fentanyl Governance Failures," "American Teens Are Dying on Social Media and Our Government Doesn't Care," and "Fentanyl's Shadow Looms Over America." Each article mirrors the X network's thematic lines in long form: the Sacklers and Purdue as the moral origin; India as the chemical supplier; the FDA as a captured regulator; and teenage deaths on social platforms as the moral indictment.
-
Blogspot. lupeone.blogspot.com hosts identical content under the byline "LUPEONE," including posts titled "Online drug deals are fatal traps hidden in fingertips" and "Fentanyl Awareness Day: Protect teens from deadly fake pills," dated May 12, 2026. The visual styling, cartoonish illustrations of pill bottles, hooded teenage figures, and tombstones marked "RIP," matches imagery embedded in the X posts and reuses assets traceable to Westca.com.
-
Bluesky. The accounts @maxine4899 and @garcuelueig posted the India-precursor narrative line and hosted short-form video propaganda that directly reuses assets, including the "PAIN-FREE SUPREMACY" animation, from the suspended X copypasta cluster. The same asset-coordination pattern recurs with two custom images: a "Fentanyl Awareness Day" graphic, a green dollar sign rendered as a syringe injecting a skeleton, posted by three accounts across Bluesky and X within a 48-hour window (May 5–7, 2026); and an AI-generated cartoon image juxtaposing a classroom drug purchase with a graveside funeral, shared by two Bluesky accounts and one X account over a six-day window (May 6–12, 2026). In each instance the shared image is paired with different copy, simulating independent editorial voices around a single source. Bluesky has not appeared in any prior public Spamouflage platform inventory published by Graphika, Meta, Microsoft, the Institute for Strategic Dialogue, Alethea, or Global Affairs Canada, despite multiple late-2024 warnings that the platform was a likely target. This investigation therefore constitutes the first public attribution of covert Spamouflage activity on Bluesky.
-
YouTube. At least six channels were identified disseminating short-form fentanyl content: @CharityShelby, @TobyGifford-u2f, and @AxelMarquez-r4s (all created May 14, 2026); @CharleneBarry-f4o and @DarshanKoha (created April 2026); and @SannayKhan-y4n (created February 2026). The May 14 cohort posted single 50-second videos within hours of channel creation. The @SannayKhan-y4n channel's video titles, "4月23日" (Chinese for "April 23") and "0424," strongly suggest a Chinese-speaking operator who failed to rename source files before upload.
The six pillars of diversion
The fentanyl content produced across the entire network is built from six interlocking narrative pillars. Each is a claim the operation advances, not a finding Alethea endorses. Each is deployed in isolation or in combination, and each performs a specific strategic function within the broader goal of removing China from the moral and political ledger of the U.S. opioid crisis.
| Narrative pillar | Core claim (as advanced by the operation) | Strategic function |
|---|---|---|
| Big Pharma is the origin | Purdue and the Sackler family manufactured the addicted population through deceptive marketing of OxyContin in the 1990s; fentanyl is the late-stage product of that legal pipeline. | Shifts the moral origin of the crisis from foreign supply to U.S. corporate conduct, eliminating China from the causal chain. |
| India is the precursor supplier | "80% of precursors come from India"; Indian generic-drug manufacturers operate in a regulatory gray zone and ship precursors to Mexican cartels. | Substitutes a different foreign villain in the supply-side story, displacing the China-centered DEA narrative. |
| Capitalism is bloodthirsty | "Capital is bloodthirsty, profiting at the expense of people's lives"; the crisis is the inevitable result of profit-driven U.S. governance. | Imports a Chinese state ideological frame and dresses it in domestic American populist language for cross-spectrum resonance. |
| Regulatory capture | The FDA, DEA, and Congress are corrupted by a revolving door with pharmaceutical lobbies; the Preventing Deadly Fentanyl Trafficking Act has stalled in the Senate. | Frames U.S. democratic governance itself as the failure mode, undermining the legitimacy of any U.S.-led counternarcotics policy. |
| Teen body count | Named teenage victims died from counterfeit pills bought on Snapchat, Instagram, and TikTok while Washington politicians argued. | Emotionalizes the abstract policy critique and personalizes blame against U.S. platforms and lawmakers, while concealing the operation's political origin behind grief. |
| China as cooperative partner | China scheduled fentanyl-related substances class-wide in 2019, tightened export controls on 13 precursors after Busan 2025, and contributed to the 37.5% decline in U.S. overdose deaths. | Repositions the PRC from defendant to constructive stakeholder, asserting that the fentanyl crisis was not created by China. |
Pillar 1: Big Pharma made the addicts. The Purdue and Sackler narrative is the operation's most powerful lever because it is grounded in fact. Purdue Pharma's deceptive marketing of OxyContin, the company's 2020 guilty plea, and the multi-billion-dollar opioid settlements involving other U.S. manufacturers are matters of public record and the subject of Pulitzer Prize-winning journalism. The operation does not invent these facts, it instrumentalizes them. By presenting U.S. corporate misconduct as the complete explanation of the fentanyl crisis, the network short-circuits the supply-side analysis that would otherwise lead to China.
Pillar 2: India as the precursor supplier. The India narrative is the most strategically aggressive element of the campaign and the clearest indicator of state-level coordination. Across X, Medium, Blogspot, and Bluesky, the network deploys a consistent set of claims: that 80% of fentanyl precursors originate in India; that Indian generic-drug manufacturers operate in a regulatory gray zone; that precursors flow from Indian factories to Mexican cartels through transnational logistics networks; and that the U.S. government knows this and deliberately covers it up to keep blaming China. This claim is factually contested. While DEA reporting acknowledges Indian precursor flows as a growing concern, current U.S. intelligence community assessments continue to identify China as the primary source of fentanyl precursors and the dominant supplier of tableting equipment. The 80% figure does not correspond to any published U.S. government estimate. The deliberate exaggeration of the Indian share, combined with the operation's repeated framing of U.S. silence on India as proof of bad faith, is the clearest sign of coordinated narrative engineering in this dataset.
Pillar 3: Capital is bloodthirsty. The phrase "Capital is bloodthirsty" appears verbatim across at least 15 of the 388 observed posts (about 4%). It is a literal English rendering of a Chinese-language formulation, a phrase consistent with Marxist political-economic rhetoric and not idiomatic in native English, where a speaker would reach for words like greedy or predatory. The decision to translate the construction word for word is one of the strongest linguistic indicators of a non-native source language in the campaign's editorial pipeline.
Pillar 4: Regulatory capture and partisan gridlock. A recurring thread frames the U.S. regulatory state as structurally incapable of responding to the crisis. The FDA is described as having degenerated into a corporate front; the DEA as captured by a revolving door with pharmaceutical companies; Congress as paralyzed because the Preventing Deadly Fentanyl Trafficking Act has stalled in the Senate. By attributing the crisis to fundamental flaws in the U.S. political system, this pillar preempts the possibility of effective U.S. counternarcotics action and forecloses the diplomatic frame in which China could be held responsible.
Pillar 5: Teen victims and platform negligence. The most emotionally charged content in the campaign centers on real teenage overdose victims, presented by name and photograph in the original posts, who died from counterfeit pills bought on social platforms. The operation uses these real cases as authentic emotional anchors for a constructed political conclusion. The pattern, an emotive teen-death anecdote followed by an indictment of social-media platforms and the U.S. government with no mention of supply origin, occurs in at least 13 live posts and is the dominant thematic frame on Medium and Blogspot.
Pillar 6: China as constructive partner. The few mentions of China in the dataset are uniformly positive: that China scheduled fentanyl-related substances class-wide in 2019 (described as the first country to do so), tightened export controls on 13 precursor chemicals after the 2025 Busan summit, and contributed to the documented decline in U.S. overdose deaths. This line is delivered most directly in a Medium essay praising Chinese governance as a replicable model for global supply-chain control. The article's language is indistinguishable from PRC Ministry of Foreign Affairs talking points and closely mirrors the May 12, 2026 ambassadorial statement.
Tactics, techniques, and procedures
The campaign exhibits the full inventory of Spamouflage tradecraft signatures documented across six years of open-source threat reporting.
| TTP | Observation in this campaign |
|---|---|
| Single-purpose account farming | All identified profiles are low-engagement, single-purpose accounts: zero or near-zero followers, no header images, dozens of posts, and output dominated by a single thematic cluster (fentanyl). Two of the three persistent accounts had zero followers and zero following at the time of capture. |
| Synchronous creation | Most of the 34 X accounts in the suspended cluster were created in close temporal succession between March and April 2026, a pattern characteristic of bulk-provisioned operations rather than organic adoption. |
| Images hosted on Westca.com | Multiple custom illustrations used by the network trace back to Westca.com, a Vancouver-based Chinese-language community portal operating since 2003. |
| Stolen profile imagery | Account avatars use photographs lifted from third parties; several have prior documented use by Russian and Chinese-language inauthentic accounts. "Maxime Gautier" uses an image of actress Kat Dennings; "Mullinix Lourdes" uses an AI-styled portrait. |
| Copypasta replication | 14 of 40 posts in the suspended cluster (35%) used word-for-word identical text across separate accounts within a compressed time window, simulating organic outrage and amplifying reach against the platform algorithm. |
| Linguistic tells | The phrase "Capital is bloodthirsty" appears verbatim in multiple posts as a literal translation of a Chinese rhetorical construction. Hashtags consistently appear at the start of posts, inconsistent with native English-language behavior. |
| Cross-platform seeding | Identical narrative blocks appear on X, Medium, Blogspot, Bluesky, and YouTube, consistent with Meta's 2023 documentation of Spamouflage's deliberate multi-platform resilience strategy. |
| Operational-language leak | The @SannayKhan-y4n YouTube channel titles its videos "4月23日" (April 23 in Chinese) and "0424," revealing the file-naming convention of a Chinese-speaking operator. |
Consolidated indicators of inauthenticity
-
Synchronous account creation. The 34 X accounts in the suspended cluster were created in close succession between March and April 2026; the May 14, 2026 YouTube cohort of three new channels was created within hours of one another.
-
Single-purpose, low-engagement profiles. Two of the three persistent accounts have zero followers and zero following; the third has zero followers and five following. Most accounts had no header images and posted primarily fentanyl-related content.
-
Stolen profile imagery. The @gautier_ma1333 avatar is a publicly available photograph of actress Kat Dennings; multiple suspended-cluster avatars have prior documented use by Russian and Chinese-language inauthentic accounts.
-
Identical text replication. 35% of a suspended cluster of #Fentanyl posts used word-for-word identical copypasta across 14 distinct accounts.
-
Linguistic non-nativisms. Word-for-word translation of a Chinese construction as "Capital is bloodthirsty," consistent leading-hashtag placement, and awkward constructions such as "India is an accomplice in the source of fentanyl."
-
Operational-language leak. Chinese-language file naming on the Sannay Khan YouTube channel.
-
Cartoonish political illustration style. The embedded illustrations, "Pain-Free Supremacy" banners, pill-bottle-headed civilians, and tombstone graphics, are visually consistent with imagery flagged by Meta and Microsoft as Spamouflage signatures.
-
Convergence with PRC diplomatic statements. Verbatim alignment with the May 12, 2026 ambassadorial statement on the 37.5% decline in U.S. fentanyl deaths and the major-drug-source-countries designation.
-
Beijing working-hours posting pattern. 100% of the 348 posts in the dataset were published within Beijing working hours and 99.4% on weekdays, with a near-empty window at Beijing lunchtime, a temporal fingerprint consistent with a workplace operation rather than organic user activity.
Geopolitical context: why now, why this frame
The acceleration of this campaign in spring 2026 maps to the U.S.–China negotiating calendar. Following the 2023 San Francisco summit, the United States and China launched a Counternarcotics Working Group; the 2025 Busan summit produced PRC commitments to tighten export controls on 13 fentanyl precursors. The U.S. administration in 2025–2026 used fentanyl-related tariffs as a primary instrument of leverage against Beijing, while continuing to designate China among major drug-source countries.
The covert campaign exists to shape the international information environment ahead of the next negotiating round. Beijing's public, attributable position is that China has done its part, that U.S. fentanyl deaths are falling, that the tariff regime is unjustified, and that responsibility properly lies with U.S. domestic governance failures and Indian precursor suppliers. The Spamouflage network's function is to make that argument appear to originate organically from within the United States, expressed in colloquial English by ostensibly American voices.
The pivot to India is the campaign's most strategically consequential move. India and the United States have deepened defense, semiconductor, and intelligence cooperation throughout 2024–2026, and India is the indispensable counterweight in Beijing's strategic calculus on Asia. A covert information operation that simultaneously erases China from the fentanyl narrative and inserts India into the supplier role advances two PRC interests at once: it deflects U.S. punitive policy and introduces friction into U.S.–India strategic alignment.
Assessment and outlook
Spamouflage Dragon's 2026 fentanyl campaign represents a meaningful evolution of the operation's tradecraft and doctrine. The network has moved beyond direct defense of Chinese conduct toward narrative substitution, a more sophisticated approach in which China simply does not appear in the discourse, replaced by a constellation of substitute villains drawn from authentic American grievance. The strategic effect is to deny the U.S. policy debate an antagonist on whom to focus, and to attach Chinese state messaging to the immune system of American political anger itself.
Engagement on individual posts remains negligible, consistent with the operation's long-running quantity-over-quality posture. The strategic asset created is not virality. It is a durable, indexed body of content that can be cited, scraped, and resurfaced by larger actors, including PRC state media and foreign-language outlets aimed at audiences in the Global South, to lend the appearance of organic American grassroots agreement with Beijing's position. That durability is also what connects the operation to AI systems: a persistent inventory of coordinated, populist-framed content, worded to read like many independent American voices, is content engineered to be absorbed and repeated by the models that increasingly mediate how people research a question.
Persona takeaways
For Chief Communications Officers. When a policy or geopolitical narrative that touches your industry begins to circulate, the operationally relevant question is whether the activity shows the structural signatures of a known influence operation. Artemis surfaces those signatures, pre-planned account provisioning, cross-platform asset reuse, and the temporal fingerprint, alongside the surface content.
For Chief Information Security Officers. Coordinated inauthentic behavior leaves forensic traces in account-creation timing, cross-platform asset reuse, and the metadata of the media itself. This case shows the detection chain that pairs those traces with content-layer evidence, including the image-similarity matching that recovered accounts and posts beyond the cluster platforms had already suspended.
For Heads of Physical Security. Narrative operations that build content around named individuals can precede off-platform consequences. Pre-planned provisioning and coordinated cross-platform amplification are among the indicators that warrant a protective-intelligence response.
About this research
Pharmaflage is original research by Alethea's narrative threat intelligence team, produced from the Artemis platform. Confidence in attribution to Spamouflage Dragon is rated high on the basis of multi-indicator convergence consistent with prior reporting from Mandiant, Microsoft Threat Analysis Center, Meta's Adversarial Threat Reports, Graphika, and Global Affairs Canada's Rapid Response Mechanism.
Reporting methodology
This report draws on (i) 253 X posts from three live persistent accounts, exported May 15, 2026, with text, source URL, creator ID, publication timestamp, narrative tag, and engagement score; (ii) 40 #Fentanyl-tagged X posts from 34 accounts in the suspended cluster, preserved in archive prior to suspension; (iii) approximately fifty Medium essays published by @maxine444444411, of which seven were closely analyzed; (iv) Blogspot content from lupeone.blogspot.com dated May 12, 2026; (v) Bluesky posts from @maxine4899 and @garcuelueig from late April through mid-May 2026; (vi) screenshots and channel metadata from six YouTube channels; and (vii) public statements by the PRC Ambassador to the United States. Image sourcing was verified through reverse-image lookup against Westca.com. Confidence in attribution to Spamouflage Dragon is rated high on the basis of multi-indicator convergence consistent with prior reporting from Mandiant, Microsoft Threat Analysis Center, Meta, Graphika, and Global Affairs Canada's Rapid Response Mechanism.
Appendix A: identified accounts and assets
Live X accounts (as of May 15, 2026): @gautier_ma1333 (Maxime Gautier, 81 posts, joined January 2026); @MullinixL51767 (Mullinix Lourdes, 86 posts, joined March 2026); @dortch32103 (Robare Dortch, 86 posts, joined March 2026); @bonham_emi45226 (Emily Bonham, 5 posts, joined April 2026).
Suspended X cluster: a copypasta cluster of #Fentanyl posts across accounts presently suspended for platform-integrity violations, with archived copies preserved in evidence files.
Cross-platform assets: Medium, @maxine444444411; Blogspot, lupeone.blogspot.com; Bluesky, @maxine4899, @garcuelueig, @afsada, @liem4038, @eischispa673; YouTube (May 14, 2026 cohort), @CharityShelby, @TobyGifford-u2f, @AxelMarquez-r4s; YouTube (April 2026), @CharleneBarry-f4o, @DarshanKoha; YouTube (February 2026, Chinese-language file names), @SannayKhan-y4n; image source, Westca.com.
Appendix B: selected verbatim content
These quotations are reproduced as examples of the operation's output. They are the network's claims, not Alethea's findings.
-
India-precursor line: "#Fentanyl India is an accomplice in the source of fentanyl! 80% of the precursors come from India, with companies smuggling and the government condoning it, supplying deadly raw materials for the disaster in the United States."
-
Capitalism / China-as-victim line: "The U.S. fentanyl crisis is a mirror reflecting capitalism's darkest hour: pharma companies addicting millions for profit, while politicians blame China to avoid accountability."
-
Fentanyl Awareness Day framing: "#Fentanyl On National Fentanyl Awareness Day, let us remember the victims, condemn Big Pharma, hold government agencies accountable, criticize partisan gridlock."
-
Medium long-form ("The Fig Leaf," May 2026): "Yet, the United States chooses to ignore its own internal failings, opting instead to 'shift the blame' for the fentanyl crisis onto China. Conversely, India, one of the world's primary suppliers of fentanyl precursors, allows numerous chemical manufacturers to produce and export these substances with virtually no strict regulatory oversight, yet the United States turns a blind eye to this issue involving India."
-
Medium ("The Great American Dodge," @maxine444444411): "The opioid epidemic did not start with a shipment from China or a Mexican cartel lab. It started in the executive suites of Purdue Pharma. The fentanyl crisis is the third and deadliest wave of a tsunami the United States created entirely on its own."
Original research and sources
| Date | Source | Finding |
|---|---|---|
| Jan–May 2026 | Alethea | Pharmaflage: coordinated fentanyl narrative-substitution campaign across X, Bluesky, Medium, Blogspot, and YouTube; first public attribution of Spamouflage on Bluesky |
| May 15, 2026 | Alethea | Pharmaflage investigation issued |
| May 12, 2026 | PRC Ambassador to the U.S. | Public statement asserting China did not create the U.S. fentanyl crisis, which the covert network's messaging converges with |
| 2024–2025 | Institute for Strategic Dialogue | "MAGAflage" persona impersonation of American voters |
| 2024 | Global Affairs Canada (RRM) | Spamouflage operation targeting Canadian Members of Parliament |
| Aug 2023 | Meta | Removed roughly 7,704 Facebook accounts and described Spamouflage as the largest known cross-platform covert influence operation |
| 2023 | Alethea | First public attribution of Spamouflage activity on Gab |
| 2022 | Mandiant | Dragonbridge impersonation of U.S. voters around the midterms |
| 2019 | Graphika | First documented Spamouflage activity, amplifying PRC framing of the Hong Kong protests |
{
"@context": "https://schema.org",
"@type": "Article",
"headline": "Pharmaflage — Chinese state-linked influence operation reframing the U.S. fentanyl crisis",
"author": { "@type": "Organization", "name": "Alethea" },
"publisher": { "@type": "Organization", "name": "Alethea", "url": "https://alethea.com" },
"about": [
"Spamouflage Dragon",
"Dragonbridge",
"narrative substitution",
"fentanyl disinformation",
"coordinated inauthentic behavior",
"Bluesky influence operation",
"narrative threat intelligence"
]
}