Metamorphosis of a fake account
The weird and wacky journey from cryptocurrency-shilling spambot to propaganda-pushing persona
Inauthentic social media accounts are sometimes created for one purpose and later renamed, purged of content, redecorated, and reused for other purposes. This can happen for a variety of reasons: in some cases, the original operator(s) of an account decide to give it a different mission, while on other occasions an account might change hands to due to being sold or compromised. One often runs across makeovers of this sort in the histories of popular inauthentic accounts. This article explores the case of a Twitter account which began its digital life as a cryptocurrency spambot and then morphed into a purveyor of pro-Russia/anti-Ukraine propaganda with an AI-generated face.
Back in June 2021, a network of newly-created Twitter accounts began spamming the phrase “Requesting faucet funds into <address> on the #Goerli #Ethereum test network via faucet.goerli.mudit.blog”. In the event that this sounds like incomprehensible gibberish to you, these tweets are basically requests to have small amounts of cryptocurrency deposited to specific addresses. It is unknown whether or not the operator(s) of these accounts were successful in gaining any cryptocurrency via this scheme.
This cryptocurrency spam network consisted of 1281 accounts created between June 22nd and June 29th, 2021. (The gap in account creation on June 23rd and June 24th potentially indicates accounts that had already been banned by Twitter, so it is possible that the network was actually larger.) Each account in the network tweeted the spam phrase exactly once, shortly after being created, and then went silent, at least for a time.
Many of the accounts in this spam network used photographs of real people as their avatars. Unsurprisingly, these photos did not depict the operator(s) of the accounts. Google reverse image search revealed that the photographs were plagiarized, mostly from Chinese-language websites. Not all of the accounts had profile photos — some used the Twitter default profile image.
Twitter quickly suspended many of the accounts in this spam network, but others lingered, and at least one of those dormant accounts eventually woke up. The account with permanent ID 1402155943069208576, originally named @HQfDF3DArdOyD52, was renamed to @MoMoSaSa22 at some point prior to May 2022. (Although Twitter handles can be changed, the permanent ID, a 64 bit integer, remains the same throughout the lifetime of a given account.) The account’s avatar was also changed, from Twitter’s default profile image to a StyleGAN-generated face. The video below demonstrates one of the telltale artifacts of these synthetic faces, namely extremely predictable positioning of major facial features. This trait becomes obvious when multiple StyleGAN faces are blended together.
This cryptocurrency spam account’s rebirth as @MoMoSaSa22 was accompanied by a change in content. The account began tweeting pro-Russia/anti-Ukraine material, sometimes accompanied by logical fallacies, such as the false equivalence between the amount of military aid supplied by the U.S. federal government to Ukraine and the condition of a street in San Francisco. The account’s tweets on Ukraine and Russia-related topics went viral on multiple occasions.
The @MoMoSaSa22 account was suspended by Twitter at some point between May 6th and May 8th, 2022, and remains suspended as of the time of this writing. Per comments on Twitter, the operator of this account is a serial ban evader, so it is not unlikely that they have used and lost additional accounts between May 2022 and today. Inauthentic accounts of this sort tend to look legitimate if one doesn’t look too closely, so we can expect this pattern of behavior to continue, especially given that multiple major platforms have recently made it more difficult for users to research this type of activity.
Pedantic footnote: since almost all of the events discussed in this article took place prior to Twitter being rebranded to X, the words “Twitter” and “tweet” are used rather than the current “X” and “post”.