A Chinese state-linked network is using U.S. Big Pharma and Indian precursor suppliers to absolve Beijing of responsibility for the synthetic opioid crisis.

Alethea original research. Reporting period: April 30 – May 15, 2026.

Executive summary

Alethea has uncovered a coordinated Chinese state-linked influence operation running across X, Bluesky, Medium, Blogspot, and YouTube from January to May 2026, ahead of the May 14–15 Beijing summit and against a backdrop of mounting U.S.–China tensions over counternarcotics policy. The operation bears the hallmarks of Spamouflage Dragon, the Chinese state-linked information operation also tracked as Dragonbridge by Mandiant and Google's Threat Analysis Group. It zeroes in on the U.S. fentanyl crisis and is engineered to reframe moral and political responsibility for synthetic-opioid deaths away from China and onto a triad of substitute targets: U.S. pharmaceutical manufacturers, the government of India (recast as the dominant supplier of fentanyl precursors), and the U.S. political and regulatory system itself.

Alethea's platform, Artemis, surfaced at least 34 X accounts producing 40 posts using the #Fentanyl hashtag before the bulk of the cluster was suspended for platform-integrity violations. Using a proprietary image-similarity search tool developed in-house, Alethea identified three additional persistent accounts and 253 further fentanyl-related posts between January 27 and May 11, 2026. Identical narrative content and images were surfaced on Medium, on Blogspot, across five Bluesky accounts, and across at least six YouTube channels created between February and May 2026.

The campaign is consistent with prior Spamouflage operations but unique in four respects. First, it does not defend China outright; it crowds China out of the dialogue by saturating the discourse with substitutions. Second, it deliberately operationalizes a domestic U.S. populist narrative (attacks on Big Pharma and the Sackler family, regulatory capture, partisan dysfunction) to merge with authentic American grievance rather than oppose it. Third, it shifts the supply-side accusation from China to India, a U.S. strategic partner, in a manner that aligns with the public statements of senior Chinese diplomats. Fourth, the Bluesky accounts identified in this investigation appear to represent the first public attribution of covert coordinated Spamouflage activity on the Bluesky platform, building on Alethea's prior first-attribution reporting of Spamouflage on Gab (2023).

Engagement remains low, with most posts registering zero likes, zero replies, and view counts in the tens, which is itself a signature of Spamouflage operations. Rather than engagement, the strategic function is narrative supply: the network seeds a persistent inventory of anti-Western, populist-framed content available for indexing, scraping, citation, and eventual amplification by larger actors, including PRC state media.

Key assessments

• Attribution (high confidence). Multiple independent indicators — image sourcing traced to a Vancouver-based Chinese-language portal, Mandarin-language YouTube file naming ("4月23日"), the verbatim Chinese rhetorical construction "Capital is bloodthirsty," leading-hashtag syntax, and message alignment with PRC diplomatic statements — collectively support attribution to Spamouflage Dragon.

• Video forensics. Subtitle styling in several videos (white sans-serif with soft drop shadow, karaoke-style multi-line reveal) matches the default auto-caption output of CapCut/Jianying (剪映, ByteDance), the dominant mobile video editor in mainland China. Subtitles contain literal translations from Mandarin — 堕落 (duòluò, "fall/drop") rendered as "falling into depravity," and 收容 ("to receive/harbor") misapplied to streets that "shelter every displaced person." These read as English filtered through a Mandarin syntactic template.

• Temporal signature. All 348 posts fall within UTC 00:00–09:59, corresponding to Beijing working hours (08:00–17:59 CST), with 99.4% posted Monday–Friday and a visible activity dip during Beijing lunchtime — a workplace-hours rhythm consistent with a state-directed workforce.

• Strategic intent. A defensive narrative campaign in the run-up to renewed U.S.–China negotiations over precursor controls and fentanyl-related tariffs, intended to inoculate target audiences against U.S. policy that designates fentanyl as a Chinese-origin threat.

• Targeting. Content is crafted for English-speaking audiences across the U.S. political spectrum: left-leaning audiences receive an anti-capitalist Big Pharma critique; right-leaning audiences receive a critique of Indian supply chains, open borders, and Washington dysfunction; bipartisan grief is mobilized around teenage fentanyl victims for the politically unaffiliated parent demographic.

• Novel element. The deliberate elevation of India as a substitute supplier is the most distinctive feature and a meaningful departure from prior Spamouflage fentanyl messaging. It coincides with public statements by senior PRC officials urging Washington to remove China from its "major drug source countries" list and look instead to precursors of Indian origin.

• First public attribution on Bluesky. Researchers warned in late 2024 and early 2025 that Bluesky was likely to become a target, but no public threat-research publication to date has documented covert coordinated Spamouflage Dragon activity on the platform. The accounts identified here appear to be the first such public attribution and show clear coordination with assets on X and YouTube.

Background: who is Spamouflage Dragon?

Spamouflage, also referred to as Dragonbridge, is a covert information operation publicly attributed by Meta, Google, Microsoft, and multiple Western governments to the Chinese state, with the most authoritative public attribution naming the Ministry of Public Security as the operating authority. The network has been tracked continuously by open-source researchers since at least 2019, when Graphika first documented coordinated inauthentic accounts amplifying Beijing's narrative on the Hong Kong protests.

The operation is best understood not as a single network but as a sprawling, persistent infrastructure of inauthentic accounts that has, over six years, expanded across dozens of platforms including X, Facebook, YouTube, Reddit, WeChat, Quora, Vimeo, Tumblr, Pinterest, Medium, and Blogspot. Meta's August 2023 Adversarial Threat Report described Spamouflage as "the largest known cross-platform covert influence operation in the world," removing roughly 7,704 Facebook accounts, 954 Pages, 15 Groups, and 15 Instagram accounts in a single takedown round.

Operational signature. Spamouflage favors quantity over quality. Its assets are typically low-engagement, single-purpose accounts with zero or near-zero followings, frequently no header images, stolen or AI-generated avatars, posts in stilted English suggestive of machine translation, and hashtag placement inconsistent with English speakers. Content is replicated across the network as copypasta, generating the appearance of organic consensus while in fact representing a single editorial source.

A selected history of past Spamouflage campaigns.

• 2019 Hong Kong protests: the network's first publicly documented operation, amplifying PRC framing of pro-democracy protesters as violent foreign-backed agitators (Graphika, September 2019).

• 2020–2022 COVID-19 origins: seeded the claim that SARS-CoV-2 originated at the U.S. Army's Fort Detrick facility (Meta, August 2023).

• 2022 U.S. midterms: Mandiant's Dragonbridge reporting documented the network impersonating U.S. voters across the political spectrum and amplifying narratives of inevitable U.S. decline.

• 2024 Members of Parliament and diaspora targeting: Global Affairs Canada's Rapid Response Mechanism publicly attributed a Spamouflage operation targeting Canadian MPs.

• 2024–2025 persona impersonation and "MAGAflage": ISD Global documented a network impersonating American conservative voters, including fabricated MAGA personas, indicating an ongoing shift away from overtly pro-Beijing messaging and toward immersion within authentic domestic American grievance.

Why this fentanyl operation is unique

Most documented Spamouflage activity falls into one of two patterns: direct defense of the PRC (Hong Kong, Xinjiang, Taiwan) or non-specific anti-U.S. denigration. The fentanyl campaign documented here is a third, more sophisticated category: narrative substitution. Rather than defending Chinese conduct or attacking U.S. conduct in the abstract, the operation populates the information environment with a complete alternative causal story in which China is simply absent.

1. Absence-by-substitution, not denial. In the 253 posts from the three persistent X accounts, the word "China" appears only five times, and in those instances China is the named victim of false U.S. accusation, not the defendant. By erasing China from the conversation while filling that space with Purdue, the Sacklers, the FDA, the DEA, Snapchat, TikTok, Republican obstructionism, Democratic incompetence, and Indian generic-drug manufacturers, the operation removes the question "is China responsible?" from the discourse entirely.

2. Weaponized populism across the political spectrum. The campaign's narrative architecture is deliberately bipartisan in its anger. The anti-Big-Pharma material is calibrated for left-of-center audiences; the India-precursor and border-control material for right-of-center audiences concerned with immigration and supply-chain sovereignty; the teenage-fentanyl-death material for the politically unaffiliated parent demographic. This is a deliberate effort to attach Spamouflage content to whatever authentic American outrage is already moving through the platform.

3. Convergence with official PRC diplomatic messaging. On May 12, 2026, the Chinese Ambassador to the United States posted a long-form statement asserting that "the fentanyl crisis in the U.S. was not created by China," citing a 37.5% decline in U.S. fentanyl deaths since the 2025 Busan summit, and urging the United States to "stop shifting the blame" and remove China from its "major drug source countries" list. The covert network's messaging is the same brief, delivered by inauthentic personas in colloquial English four to six weeks earlier and with broader cross-platform distribution. The alignment and figures are too tight to be coincidental.

4. The pivot to India as substitute supplier. Earlier Spamouflage fentanyl messaging in 2023–2024 typically deflected toward Mexican cartels or domestic U.S. drug culture. The deliberate elevation of India as the principal precursor supplier, with claims that "80% of precursors come from India," is a notable geopolitical shift. India is a U.S. strategic partner and the world's most important counterweight to PRC regional ambition. Inserting India into the fentanyl supply chain serves a dual purpose: it removes China from the supply-side narrative and introduces friction into a U.S.–India strategic relationship Beijing has reason to weaken. The claim itself is unsupported by current DEA and ONDCP reporting, which continues to identify China as the primary source of fentanyl precursors flowing to Mexican cartels.

Network composition and scope

The persistent X cluster. Three example accounts illustrate the persistent layer of the network:

Across these accounts, Alethea collected 253 posts frequently using the #Fentanyl hashtag between January 27 and May 11, 2026 — an average of one post per day per account during the peak operational period of April 30 – May 11. Posting volume rose sharply in late February 2026, aligning with a broader account-creation wave, and remained elevated through the May Fentanyl Awareness Day window.

Cross-platform infrastructure.

• Medium. The persona "Maxine" (@maxine444444411; 0 followers, 1 following) published at least fifty long-form fentanyl essays going back to March 2026, including "The Great American Dodge," "How American 'Pain-Relief Culture' Conspires with Capital to Slaughter the Underclass," "The 'Fig Leaf' Covering U.S. Fentanyl Governance Failures," and "Fentanyl's Shadow Looms Over America." Each mirrors the X network's thematic lines in long form.

• Blogspot. lupeone.blogspot.com hosts identical content under the byline "LUPEONE," including posts dated May 12, 2026. Visual styling — cartoonish pill bottles, hooded figures, tombstones marked "RIP" — matches imagery embedded in the X posts and reuses assets traceable to the same Vancouver-based portal.

• Bluesky. Accounts including @maxine4899.bsky.social and @garcuelueig.bsky.social posted the India-precursor narrative line and short-form video propaganda that directly reuses assets, including the "Pain-Free Supremacy" animation, from the suspended X copypasta cluster. The same asset-coordination pattern recurs with a "Fentanyl Awareness Day" dollar-sign-syringe graphic posted by three accounts across Bluesky and X within a 48-hour window (May 5–7, 2026), and an AI-generated cartoon image juxtaposing a classroom drug purchase with a graveside funeral, shared by two Bluesky accounts and one X account over a six-day window (May 6–12, 2026). In each instance the shared image is paired with different copy, simulating independent editorial voices around a single source. Bluesky had not appeared in any prior public Spamouflage platform inventory; this investigation therefore constitutes the first public attribution of covert Spamouflage activity on Bluesky.

• YouTube. At least six channels disseminated short-form fentanyl content; several were created within hours of one another in a May 14, 2026 cohort. One channel's video titles ("4月23日," Chinese for "April 23," and "0424") strongly suggest a Chinese-speaking operator who failed to rename source files before upload.

Alethea's analysis describes the operation's propaganda imagery rather than reproducing it.

Narrative architecture: the six pillars of diversion

The fentanyl content is built from six interlocking narrative pillars. Each performs a specific strategic function within the broader goal of removing China from the moral and political ledger of the U.S. opioid crisis. The "core claims" below are the narratives promoted by the operation — several are factually contested, as noted.

Pillar 1: "Big Pharma made the addicts"

The Purdue/Sackler narrative is the operation's most powerful lever because it is grounded in fact. Purdue Pharma's deceptive marketing of OxyContin, the company's 2020 guilty plea, and the multi-billion-dollar opioid settlements involving other U.S. manufacturers are matters of public record and the subject of Pulitzer Prize–winning journalism. The operation does not invent these facts; it instrumentalizes them. By presenting U.S. corporate misconduct as the complete explanation of the fentanyl crisis, the network short-circuits the supply-side analysis that would otherwise lead to China.

"The opioid epidemic did not start with a shipment from China or a Mexican cartel lab. It started in the executive suites of Purdue Pharma… The fentanyl crisis is the third and deadliest wave of a tsunami the United States created entirely on its own." — Spamouflage account on Medium, May 2026

Pillar 2: India as the precursor supplier

This is the most strategically aggressive element of the campaign and the clearest indicator of state-level coordination. Across X, Medium, Blogspot, and Bluesky, the network deploys a consistent set of claims: that 80% of fentanyl precursors originate in India; that Indian generic-drug manufacturers operate in a "regulatory gray zone"; that precursors flow from Indian factories to Mexican cartels; and that the U.S. government "knows full well that most illegal fentanyl precursors come from India, yet deliberately covers up the truth and repeatedly blames China instead."

This claim is factually contested. While DEA reporting acknowledges Indian precursor flows as a growing concern, current U.S. intelligence assessments continue to identify China as the primary source of fentanyl precursors and the dominant supplier of tableting equipment. The 80% figure does not correspond to any published U.S. government estimate. The deliberate exaggeration of the Indian share, combined with the operation's repeated framing of U.S. silence on India as proof of bad faith, is the clearest sign of coordinated narrative engineering in this dataset.

"#Fentanyl India is an accomplice in the source of fentanyl! 80% of the precursors come from India, with companies smuggling and the government condoning it, supplying deadly raw materials for the disaster in the United States." — copypasta across multiple suspended accounts

Pillar 3: "Capital is bloodthirsty"

The phrase "Capital is bloodthirsty" appears verbatim across at least 15 of the 388 observed posts (4%). It is a literal English rendering of the Chinese-language formulation 资本是嗜血的 ("capital is blood-craving"), a phrase consistent with Marxist political-economic rhetoric and not idiomatic in native English. Native English speakers describing corporate greed reach for words like greedy or predatory. The decision to translate 资本是嗜血的 word-for-word is one of the strongest linguistic indicators of a non-native source language in the campaign's editorial pipeline.

Pillar 4: Regulatory capture and partisan gridlock

A recurring narrative thread frames the U.S. regulatory state as structurally incapable of responding. The FDA is described as having "degenerated into nothing more than a corporate front"; the DEA as captured by a "revolving door"; Congress as paralyzed because "the Preventing Deadly Fentanyl Trafficking Act has been collecting dust in the Senate for months." By attributing the crisis to fundamental flaws in the U.S. political system, this pillar preempts the possibility of effective U.S. counternarcotics action and forecloses the diplomatic frame in which China could be held responsible.

Pillar 5: Teen victims and platform negligence

The most emotionally charged content in the campaign centers on real, tragic cases of teenagers who died from counterfeit pills purchased on Snapchat, Instagram, and TikTok. (Alethea has withheld the victims' names from this published version out of respect for the families.) The operation uses these authentic cases as emotional anchors for a constructed political conclusion. The pattern — an emotive teen-death anecdote, followed by indictment of social-media platforms and the U.S. government, with no mention of supply origin — occurs in at least 13 live posts and is the dominant thematic frame on Medium and Blogspot.

Pillar 6: China as constructive partner

The few mentions of China in the dataset are uniformly positive: China scheduled fentanyl-related substances class-wide in 2019 ("the first country to do so in the world"), tightened export controls on 13 precursor chemicals after the 2025 Busan summit, and contributed to the documented decline in U.S. overdose deaths. This line is delivered most directly in the Medium essay "The Fentanyl Crisis Under America's 'Pain-Relieving Culture,'" which praises Chinese governance and frames it as a "replicable" model. The article's language is indistinguishable from PRC Ministry of Foreign Affairs talking points and closely mirrors the ambassadorial statement of May 12, 2026.

Tactics, techniques, and procedures

Consolidated indicators of inauthenticity

• Synchronous account creation: the 34 X accounts in the suspended cluster were created in close succession between March and April 2026; a YouTube cohort of three new channels was created within hours of one another on May 14, 2026.

• Single-purpose, low-engagement profiles: persistent accounts with zero or near-zero followers and following, no header images, primarily posting fentanyl content.

• Stolen profile imagery: avatars with prior documented use by Russian- and Chinese-language inauthentic accounts.

• Identical text replication: 35% of a suspended cluster of #Fentanyl posts used word-for-word copypasta across 14 distinct accounts.

• Linguistic non-nativisms: word-for-word translation of 资本是嗜血的 as "Capital is bloodthirsty"; consistent leading-hashtag placement; awkward constructions such as "India is an accomplice in the source of fentanyl."

• Operational-language leak: Chinese-language file naming ("4月23日") on a YouTube channel.

• Cartoonish political illustration style: "Pain-Free Supremacy" banners, pill-bottle-headed civilians, and tombstone graphics visually consistent with imagery flagged by Meta and Microsoft as Spamouflage signatures.

• Convergence with PRC diplomatic statements: verbatim alignment with the May 12, 2026 ambassadorial statement on the 37.5% decline in U.S. fentanyl deaths and the "major drug source countries" designation.

• Beijing working-hours posting pattern: 100% of 348 posts published within UTC 00:00–09:59 (Beijing 08:00–17:59), 99.4% on weekdays, with a near-empty window at Beijing lunchtime.

Geopolitical context: why now, why this frame

The acceleration of this campaign in spring 2026 maps to the U.S.–China negotiating calendar. Following the 2023 San Francisco summit, the two countries launched a Counternarcotics Working Group; the 2025 Busan summit produced PRC commitments to tighten export controls on 13 fentanyl precursors. The U.S. administration used fentanyl-related tariffs as a primary instrument of leverage against Beijing while continuing to designate China among "major drug source countries."

The covert campaign exists to shape the international information environment ahead of the next negotiating round. Beijing's public, attributable position is that China has done its part, that U.S. fentanyl deaths are falling, that the tariff regime is unjustified, and that responsibility lies with U.S. domestic governance failures and Indian precursor suppliers. The Spamouflage network's function is to make that argument appear to originate organically from within the United States, expressed in colloquial English by ostensibly American voices.

The pivot to India is the campaign's most strategically consequential move. India and the United States have deepened defense, semiconductor, and intelligence cooperation throughout 2024–2026; India is the indispensable counterweight in Beijing's strategic calculus on Asia. A covert information operation that simultaneously erases China from the fentanyl narrative and inserts India into the supplier role advances two PRC interests at once: it deflects U.S. punitive policy and introduces friction into U.S.–India strategic alignment.

Assessment and outlook

Spamouflage Dragon's 2026 fentanyl campaign represents a meaningful evolution of the operation's tradecraft and doctrine. The network has moved beyond direct defense of Chinese conduct toward narrative substitution, a more sophisticated approach in which China simply does not appear in the discourse, replaced by a constellation of substitute villains drawn from authentic American grievance. The strategic effect is to deny the U.S. policy debate an antagonist on whom to focus, and to attach Chinese state messaging to the immune system of American political anger itself.

Engagement on individual posts remains negligible, consistent with the operation's long-running quantity-over-quality posture. The strategic asset created is not virality; it is a durable, indexed body of content that can be cited, scraped, and resurfaced by larger actors — including PRC state media and foreign-language outlets aimed at audiences in the Global South — to lend the appearance of organic American grassroots agreement with Beijing's position.

Methodology

This investigation draws on: 253 X posts from three live persistent accounts, exported May 15, 2026 with text, source URL, creator ID, timestamp, narrative tag, and engagement score; 40 #Fentanyl-tagged X posts from 34 accounts in the suspended cluster, preserved before suspension; approximately fifty Medium essays (seven analyzed closely); Blogspot content; Bluesky posts from late April through mid-May 2026; screenshots and channel metadata from six YouTube channels; and public statements by the PRC Ambassador to the United States. Image sourcing was verified through reverse-image lookup. Confidence in attribution to Spamouflage Dragon is rated high on the basis of multi-indicator convergence consistent with prior reporting from Mandiant, Microsoft Threat Analysis Center, Meta's Adversarial Threat Reports, Graphika, and Global Affairs Canada's Rapid Response Mechanism.