# Dual influence ops hit Philippine activist pages

Published: 2026-06-30 · Severity: medium · Sectors: government-national, non-profit, media
Canonical: https://vorant.io/reports/a27f88ab-acf7-5544-a37a-27687d17c36d/dual-influence-ops-hit-philippine-activist-pages

> A Philippine military-linked network red-tags activists as communist insurgents while Chinese Spamouflage exploits the same pages to attack President Marcos, both using coordinated inauthentic Facebook profiles.

Two coordinated influence operations independently targeted the same Philippine activist Facebook pages in 2026, but with opposite objectives. A domestic state-aligned network, assessed with moderate confidence to be connected to the Armed Forces of the Philippines' 2nd Civil-Military Operations Battalion, attacked pages run by Filipino leftist groups—including the League of Filipino Students and Kilusang Mayo Uno—to discredit them through "red-tagging," falsely linking them to the communist insurgency. Meanwhile, Chinese Spamouflage profiles flooded the same pages' comment sections with anti-government content attacking President Ferdinand Marcos Jr. and promoting Vice President Sara Duterte, treating the activist pages as unwitting platforms rather than targets.

Both operations deployed hundreds to thousands of inauthentic Facebook profiles using AI-generated images and formulaic comments. The domestic network operated through six connected Facebook pages created in early 2026, all specializing in counter-messaging against the Communist Party of the Philippines and its affiliated groups. Evidence linking the operation to the 2CMOBn includes military pages following the network's assets, amplification profiles engaging with military company pages, coordinated messaging campaigns, and profiles displaying military imagery or listing the battalion as their employer. The Chinese operation, part of the broader Spamouflage network previously attributed to Chinese law enforcement by Meta, amplified narratives about government corruption, Marcos's alleged drug use, and the Marcos-Duterte rivalry.

The convergence highlights persistent vulnerabilities in Meta's enforcement against coordinated inauthentic behavior in the Philippines, years after major takedowns in 2020. Both operations exploited the same targeting mechanisms—comment flooding, coordinated reactions, and group amplification—that should be detectable at the platform level. The dual exploitation particularly endangers activists already facing real-world violence from red-tagging practices, while the Chinese operation's sophisticated knowledge of domestic politics demonstrates evolving foreign interference capabilities. Meta's recent decision to hide post-share transparency has further complicated researchers' ability to track malicious content distribution.

## Mentioned in this report

- Threat actors: 2nd Civil-Military Operations Battalion, Spamouflage
- Campaigns: Operation Naval Gazing

Source reporting: https://dfrlab.org/2026/06/30/two-coordinated-networks-one-domestic-one-foreign-target-the-same-philippine-facebook-pages

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a27f88ab-acf7-5544-a37a-27687d17c36d/dual-influence-ops-hit-philippine-activist-pages.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup