A forged malicious social media post supposedly of President Ferdinand “Bongbong” Marcos Jr. that was spread online prior to the 22 July State of the Nation Address (SoNA) was traced to the Chinese Communist Party (CCP) based on an exhaustive research by a Canberra-based think tank.

The Australian Strategic Policy Institute (ASPI), a defense and strategic policy institute, said the deepfake video was the latest salvo in a persistent online smear campaign targeting Marcos and his policies this year.

Another audio portraying him previously as confrontational was, according to the President’s office, disseminated by a foreign actor.

The covert social media campaign instigated by the Chinese government “appears to be spreading a deepfake video seeking to undermine support for Philippines President Ferdinand Marcos Jr., according to new research conducted by ASPI.”

“China is conducting the campaign amid a high-stakes standoff with the Philippines over claims in the South China Sea,” it added.

The Chinese operations were previously conducted by trolls in China but now influential Filipino bloggers have been tapped.

Hours before the SoNA, a video of Marcos appearing to take illicit drugs was circulated on social media.

The video was a deepfake and was soon debunked by security authorities, but it was shared quickly across social media and fueled anti-Marcos’ sentiment.

ASPI said it has identified a network of coordinated fake accounts across X and YouTube amplifying the video.

“We assess the accounts as very likely linked to the Chinese government. In recent months, President Marcos has defied the Chinese government’s increasingly aggressive attempts to block Philippine Coast Guard resupply missions to the BRP Sierra Madre, an old ship that is grounded near the disputed Second Thomas (Ayungin) Shoal and accommodates a Philippine garrison,” according to the paper.

The ASPI indicated the CCP had previously deployed covert social media campaigns to interfere in Philippine politics, “but this new campaign promotes the dissemination of content created by domestic actors, demonstrating a novel sophistication and insight into the Philippines’ information environment.”

It also suggested links between criminal online gambling syndicates and the Filipino groups that are sharing the deepfake video amid the ongoing scandal involving Philippine Offshore Gaming Operators that are entirely operations of Chinese groups.

“This further reveals the extent of the CCP’s foreign malign influence and interference across Southeast Asia,” the paper said.

It cited Claire Contreras, a video blogger known to be a critic of Marcos, as being the first to share the video.

“Contreras, a Filipino-American who calls herself Maharlika, initially teased the video on her Facebook page on 21 July before livestreaming it at a pro-Duterte rally in Los Angeles the next morning.”

The ASPI paper indicated that Contreras has since made the livestream private, but another YouTube video surfaced, depicting the event with her leading the crowd calling for Marcos to resign.

The National Bureau of Investigation (NBI) has launched a probe into the origin of the deepfake video.

ASPI said Contreras “might have created it herself since deepfake face-swapping technology has become ubiquitous and readily accessible. On her ‘Boldyak TV’ YouTube channel, there are videos of her face superimposed onto films such as Wonder Woman, Black Widow and The Hunger Games.”

Amplification work

It said that regardless of how the video was created or acquired, there was strong evidence the CCP sought to amplify its content.

Since 25 July, ASPI has identified at least 80 inauthentic accounts on X that have reshared the deepfake video of Marcos, which it assessed as likely linked to Spamouflage, a covert social media network operated by China’s Ministry of Public Security.

“For example, one account named Lisa Carter shared the Marcos deepfake video with the text, “#Marcos Drug Abuser.” (The comma, subtly different from an English comma, is a double-byte character commonly used in East Asian language fonts, such as Chinese, Japanese and Korean.)

ASPI said the same account posted images of Guo Wengui, a Chinese businessman who has been targeted in previous Spamouflage campaigns.

The paper related to ASPI, on YouTube, has identified at least 11 videos posted by accounts linked to the Spamouflage network, almost all of which have already been suspended.

The version of the deepfake video uploaded to X and YouTube appears to be a screen recording of Contreras’ 22 July livestream on her Boldyak TV YouTube Channel.

“Almost all the accounts on X and YouTube were created in 2024 and were active only during Beijing business hours from 9:19 a.m. to just before 4 p.m., with less activity from 12 noon to 2 p.m., presumably a lunch break. They typically have female Western names, such as Susan Jones or Leesa Tydeman,” ASPI said.

The Australian group said the timelines of the accounts revealed other ongoing propaganda and disinformation campaigns targeting the Philippines and amplifying CCP positions.

“These include claiming that the US is using the Philippines in a proxy war against China. Accounts also amplified op-eds in Taiwanese and Hong Kong media sites about a book asserting China’s sovereignty claims over most of the South China Sea,” it added.

The book, by Anthony Carty, an academic at the Beijing Institute of Technology, was published by the New Star Press, a foreign-facing propaganda publishing organization owned by the China International Communications Group and managed by the Central Propaganda Department.

The book has been promoted overtly by Chinese state media, state-affiliated journalists and diplomats.

The commentaries all shared by the Spamouflage accounts, authored by an unknown freelancer using the name Lin Yuting, revealed for the first time a new tactic by the Spamouflage network: seeding articles in legitimate news outlets before amplifying them across social media, according to the research paper.