Rapid Response Mechanism Canada detects second ‘Spamouflage’ campaign targeting Canada-based Chinese-language commentators and their families

March 6, 2025 – Ottawa, Ontario – Global Affairs Canada

Global Affairs Canada today issued the following statement:

“Rapid Response Mechanism Canada (RRM Canada) continues to monitor a new “Spamouflage” campaign targeting several individuals based in Canada. The operation is a more extensive version of the campaign that Global Affairs Canada reported in 2023.

“Spamouflage has been publicly reported over a period of several years by technology companies and threat intelligence experts who have connected the activity to the People’s Republic of China (PRC). RRM Canada has been able to attribute this new campaign, including the bots involved, to the PRC with high confidence.

“As in 2023, this new campaign employs various tactics to intimidate, belittle, and harass individuals based in Canada who are critical of the PRC, including with the use of videos doctored through artificial intelligence (AI) and the release of private information about targeted individuals without their consent (“doxing”). This is the first known instance where a Spamouflage campaign used sexually explicit deepfake photos to target an individual in Canada.

“The most prominent tactic used in the campaign has been to create fabricated (“deepfake”) videos using AI to generate a likeness of a real person, which is then used to promote false narratives. These AI generated videos, which are intended primarily to undermine the credibility of a real person, are posted on YouTube and TikTok.

“The deepfake videos make fabricated claims about the Prime Minister of Canada, as well as other Canadian politicians and public figures. Spamouflage bots then place these deepfakes on publicly visible social media accounts belonging to various departments and agencies of the Government of Canada, multiple media outlets, and political figures, such as the Leader of the Official Opposition. On average, Spamouflage bots post between 100 and 200 deepfakes per day.

“Global Affairs Canada reached out to the victims of this new campaign and engaged with the relevant social media companies, which removed some of the content as it violated their policies and guidelines. New Spamouflage bots continue to be generated, however.

“Global Affairs Canada also raised concerns directly with the Embassy of China to Canada.

“The Government of Canada will be taking additional steps to counter the operation, including re-engaging with social media companies.

“RRM Canada will continue to uphold the strength and resilience of our democratic institutions by monitoring the information environment and by shining a light on threats to democracy.

Quick facts

Spamouflage is a bot network composed of new or hijacked social media accounts that posts and increases the number of propaganda messages across multiple social media platforms, including Facebook, X, Instagram, YouTube, Medium, Reddit, TikTok, and LinkedIn.
The word “spamouflage is a combination of “spam” and “camouflage”, intended to portray the hidden attempts to spread spam-like content and propaganda among more everyday, human-interest-style content.
Spamouflage campaigns are viewed as tactics of foreign information manipulation and interference that could undermine Canada’s democracy and the ability of Canadians to exercise their rights and freedoms free from intimidation.
Established at the 2018 G7 Summit in Charlevoix, Quebec, and located at Global Affairs Canada, RRM Canada leads the G7 RRM and supports Canada’s efforts to counter foreign state-sponsored disinformation.
RRM Canada is an important mechanism that monitors the digital information environment for foreign state-sponsored disinformation and provides open-source data analytics about threats to democracy.
If you wish to report suspected foreign interference activity or other issues of national security concern, the Royal Canadian Mounted Police (RCMP), Canadian Security Intelligence Service (CSIS), and Communications Security Establishment’s Canadian Centre for Cyber Security all have telephone and online reporting mechanisms.
To report suspicious incidents that may be of concern to national security, contact the RCMP’s National Security Information Network at 1-800-420-5805 or by email at RCMP.NSIN-RISN.GRC@rcmp-grc.gc.ca
To report non-urgent potential national security threats or suspicious activities, contact CSIS at 613-993-9620 or 1-800-267-7685 or by completing this web form.
To report non-urgent potential cyber security threats or incidents, contact the Canadian Centre for Cyber Security at 1-833-CYBER-88 (1-833-292-3788) or by completing this web form.
To report a threat or immediate danger, dial 911 on your telephone or contact local police.