How Breadcrumbs From Spamouflage-Linked Assets Led Us to an Accounts-for-Sale Service
Overview
In investigating the Chinese influence operation Spamouflage, we identified an entity generating inauthentic Facebook accounts used in a set of Spamouflage activity, primarily using the name Salva Store. They operate YouTube and Telegram channels to promote the sale of Facebook accounts and social media services, primarily on Meta platforms. Based on open-source indicators, we assess with high confidence that this intermediary is located in Bangladesh.
Key Findings
We identified 47 YouTube channels, seven Facebook accounts, seven Instagram accounts, three X accounts, two Tumblr accounts, and two Bluesky accounts linked to the Chinese influence operation Spamouflage and posting a video, “VENOM: The Blackmail Symbiote.” The video suggests the U.S. president started the Iran war to shift public attention away from the release of government files on late sex trafficker Jeffrey Epstein.
The video was originally posted by an AI-generated Instagram video creator account, Forbidden Clothes, and later by a Chinese military blogger’s Weibo account. Watermarks from both accounts are visible on versions of the video.
Another set of 15 Facebook Spamouflage-linked accounts commented on Facebook posts from the previous set, bringing the total number of Spamouflage-linked Facebook accounts to 23. Three of those commenting accounts featured images with a “Salva Store” logo and a link to the Telegram channel Salva James.
That Telegram channel is linked to five others, as well as two Facebook pages, two web domains, and one YouTube channel, all collaborating to promote the sale of Facebook and other social media accounts. The web domains advertise Facebook and Instagram accounts, Meta ads, and Business Manager accounts, in addition to creating fake Gmail and Hotmail email addresses.
Based on open-source indicators, we assess with high confidence that this activity is based in Bangladesh.