In a startling new revelation, an influence operation reportedly linked to China has been accused of impersonating a prominent human rights organization on social media to incite political unrest in Spain. The campaign emerged in the aftermath of the devastating October floods in Valencia, which claimed over 200 lives and exposed simmering tensions between the public and the country’s political leadership.
According to a report published by the American social network analysis firm Graphika, the operation, known as Spamouflage, created imposter social media accounts mimicking the Madrid-based human rights organization Safeguard Defenders. These accounts spread incendiary content from November 2024 to January 2025, targeting both the regional and national government with criticism.
The posts, written in both English and Spanish, painted a damning picture of the Madrid government and Valencia Governor Carlos Mazón. The campaign went as far as urging Spaniards to rise up and overthrow their government — a significant escalation in Spamouflage’s activities, according to analysts.
The floods in Valencia, among the deadliest in the region’s history, wreaked havoc on local infrastructure and left entire communities in ruin. Paiporta, a town hit particularly hard by the disaster, became a flashpoint for growing public discontent.
Residents, grappling with the devastation and mourning the loss of loved ones, expressed fury over what they perceived as a botched response by Governor Mazón and other officials. Despite mounting criticism, Mazón refused to resign, insisting that his administration had done everything possible under the circumstances.
Prime Minister Pedro Sánchez and King Felipe VI faced the ire of grieving residents when they visited Paiporta. Crowds of angry locals chased them out of the town, with a far-right group later claiming responsibility for the violence directed at Sánchez.
The political fallout from the disaster laid bare the distrust many Spaniards feel toward their leaders. It was within this environment of chaos and frustration that Spamouflage’s influence operation sought to sow further discord.
Graphika’s report outlines how Spamouflage accounts meticulously impersonated Safeguard Defenders, a legitimate and respected human rights organization known for advocating for the protection of civil liberties in Spain and beyond.
The imposter accounts operated across multiple social media platforms, including Facebook, X (formerly Twitter), BlueSky, and TikTok. Their posts featured doctored videos, misleading infographics, and inflammatory rhetoric aimed at delegitimizing the Spanish government.
One post accused the Sánchez administration of “betraying the people of Valencia” by prioritizing international diplomatic engagements over disaster relief efforts. Another targeted Governor Mazón, portraying him as indifferent to the suffering of flood victims.
“This campaign represents a significant escalation for Spamouflage,” said Graphika’s lead investigator, Maria Thompson. “While the operation has previously focused on spreading disinformation to undermine trust in Western democracies, this is the first instance we’ve seen where they’ve actively called for the overthrow of a government.”
Spamouflage, a term coined by cybersecurity experts, refers to a sprawling influence operation that has been linked to pro-China narratives since its discovery in 2017.
The campaign has been accused of spreading disinformation in the United States, Canada, and other Western nations, often with the aim of undermining democratic institutions and discrediting critical media narratives about China.
Despite widespread allegations, the operators behind Spamouflage have consistently denied any connection to the Chinese government. Beijing has also distanced itself from the operation, dismissing accusations as “baseless smears” intended to stoke anti-China sentiment.
The impersonation of Safeguard Defenders signals a concerning evolution in the tactics employed by influence operations like Spamouflage. By co-opting the identity of a well-respected organization, the campaign sought to lend credibility to its messaging and manipulate public sentiment more effectively.
“Trust is a critical component in information warfare,” explained Dr. Javier Martinez, a cybersecurity expert at the University of Barcelona. “By masquerading as a legitimate human rights group, the operators behind Spamouflage were able to tap into pre-existing frustrations and amplify calls for radical action.”
The campaign’s calls for government overthrow are particularly alarming, as they mark a departure from the more subtle attempts at disinformation that have characterized past operations.
“These are not just idle provocations,” Martinez added. “They are calculated attempts to destabilize a nation already grappling with political and social upheaval.”
The Spanish government has condemned the influence operation and vowed to take decisive action to counter the spread of disinformation.
In a joint statement, the Ministry of the Interior and the Ministry of Digital Affairs announced the formation of a task force to investigate the Spamouflage campaign and strengthen Spain’s cybersecurity defenses.
“We will not tolerate attempts to undermine our democracy or exploit the pain of our citizens for nefarious purposes,” the statement read. “Those responsible will be held accountable.”
Social media platforms implicated in the campaign have also pledged to cooperate with authorities. Facebook, X, and TikTok confirmed they have taken steps to remove the imposter accounts and are enhancing measures to detect and prevent future influence operations.
The Spamouflage campaign serves as a stark reminder of the evolving threat landscape in the digital age. As disinformation campaigns become more sophisticated, governments, civil society, and tech companies must work together to safeguard democratic processes and public trust.
“This is not just a Spanish problem,” warned Thompson. “It’s a global challenge that requires a coordinated international response.”
For Safeguard Defenders, the impersonation ordeal underscores the need for greater vigilance in protecting the reputations of legitimate organizations.
“We are appalled that our name was used to spread lies and incite unrest,” the organization said in a statement. “We remain committed to our mission of defending human rights and will not be deterred by these cowardly attacks.”
