Dual influence ops hit Philippine activist pages
A Philippine military-linked network red-tags activists as communist insurgents while Chinese Spamouflage exploits the same pages to attack President Marcos, both using coordinated inauthentic Facebook profiles.
Sourcedfrlab.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Two coordinated influence operations independently targeted the same Philippine activist Facebook pages in 2026, but with opposite objectives. A domestic state-aligned network, assessed with moderate confidence to be connected to the Armed Forces of the Philippines' 2nd Civil-Military Operations Battalion, attacked pages run by Filipino leftist groups—including the League of Filipino Students and Kilusang Mayo Uno—to discredit them through "red-tagging," falsely linking them to the communist insurgency. Meanwhile, Chinese Spamouflage profiles flooded the same pages' comment sections with anti-government content attacking President Ferdinand Marcos Jr. and promoting Vice President Sara Duterte, treating the activist pages as unwitting platforms rather than targets.
Both operations deployed hundreds to thousands of inauthentic Facebook profiles using AI-generated images and formulaic comments. The domestic network operated through six connected Facebook pages created in early 2026, all specializing in counter-messaging against the Communist Party of the Philippines and its affiliated groups. Evidence linking the operation to the 2CMOBn includes military pages following the network's assets, amplification profiles engaging with military company pages, coordinated messaging campaigns, and profiles displaying military imagery or listing the battalion as their employer. The Chinese operation, part of the broader Spamouflage network previously attributed to Chinese law enforcement by Meta, amplified narratives about government corruption, Marcos's alleged drug use, and the Marcos-Duterte rivalry.
The convergence highlights persistent vulnerabilities in Meta's enforcement against coordinated inauthentic behavior in the Philippines, years after major takedowns in 2020. Both operations exploited the same targeting mechanisms—comment flooding, coordinated reactions, and group amplification—that should be detectable at the platform level. The dual exploitation particularly endangers activists already facing real-world violence from red-tagging practices, while the Chinese operation's sophisticated knowledge of domestic politics demonstrates evolving foreign interference capabilities. Meta's recent decision to hide post-share transparency has further complicated researchers' ability to track malicious content distribution.
Mentioned in this report
Source reporting: https://dfrlab.org/2026/06/30/two-coordinated-networks-one-domestic-one-foreign-target-the-same-philippine-facebook-pages
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs