A covert social media campaign operated by the Chinese government appears to be spreading a deepfake video seeking to undermine support for Philippines President Ferdinand Marcos Jr, according to new research conducted by ASPI. China is conducting the campaign amid a high-stakes standoff with the Philippines over claims in the South China Sea.

Hours before Marcos gave a state-of-the-nation Address on 22 July 2024, a video of him appearing to take illicit drugs was circulated by supporters of the previous president, Rodrigo Duterte. The video was a deepfake and soon debunked by Philippine authorities, but it was shared quickly across social media and fuelled anti-Marcos sentiment among hardline Duterte supporters.

ASPI has identified a network of coordinated inauthentic accounts across X and YouTube amplifying the video. We assess the accounts as very likely linked to the Chinese government. In recent months, Marcos has defied the Chinese government’s increasingly aggressive attempts to block Philippine Coast Guard resupply missions to BRP Sierra Madre, an old ship that is grounded near the disputed Second Thomas Shoal and accommodates a Philippine garrison. Duterte, who held office from 2016 to 2022, had a more conciliatory relationship with Beijing, and in April his former presidential spokesperson, Harry Roque, claimed that Duterte had struck at a ‘secret’ gentlemen’s agreement with Chinese President Xi Jinping to keep the status quo in the disputed waters, including a pledge by Manila not to repair Sierra Madre.

The deepfake video marks the latest salvo in a persistent online smear campaign targeting Marcos and his policies this year. A deepfake audio portraying him as confrontational was, according to the president’s office, disseminated by a foreign actor. Duterte has alleged he is a drug addict. When he was in office, Duterte conducted a highly popular war on drugs in which thousands of suspected drug users and other criminals were killed extrajudicially, so illegal drug use is a galvanizing issue among his supporters.

The Chinese Communist Party has previously deployed covert social media campaigns to interfere in Philippine politics, but this new campaign promotes the dissemination of content created by domestic actors, demonstrating a novel sophistication and insight into the Philippines’ information environment.

In the second half of this report, we highlight links between the CCP, criminal online gambling syndicates and the Filipino groups that are sharing the deepfake video. This further reveals the extent of the CCP’s foreign malign influence and interference across Southeast Asia.

Claire Contreras, a video blogger known for criticising Marcos and supporting Duterte, first shared the video. Contreras, a Filipino-American who also calls herself ‘Maharlika’, initially teased the video on her Facebook page on 21 July 2024 before live-streaming it at a pro-Duterte rally in Los Angeles the next morning. She has since made the livestream private, but another YouTube video surfaced, depicting the event with Contreras leading the crowd calling for Marcos to resign (see screenshot below).

Figure 1: Claire Contreras leading chants at a pro-Duterte rally in Los Angeles.

Contreras has a history of spreading false or unsubstantiated allegations of Marcos using illicit drugs. She claims to be an ‘outspoken critic of corruption and injustice’ but the Philippine Drug Enforcement Agency (PDEA) has denied accusations that she has promoted on social media—accusations that Marcos was on a watchlist of suspected narcotics users. Likewise, she has spread alleged leaked PDEA intelligence documents of Marco’s drug use with actress Maricel Soriano. These documents were allegedly leaked by former PDEA agent Jonathan Morales, who says he can no longer remember the source’s identity and was found to be in contempt for lying to the Senate Committee on Public Order and Dangerous Drugs. PDEA Director General Moro Virgilio Lazo told the Senate committee that the documents were fake.

The Philippines’ government is investigating how Contreras acquired the recent deepfake video. She might have created it herself, since deepfake face-swapping technology has become ubiquitous and readily accessible. On her Boldyak TV YouTube channel, there are videos of her face superimposed into films such as Wonder Woman, Black Widow and The Hunger Games.

Regardless of how the video was created or acquired, there is strong evidence that the CCP sought to amplify its content. Since 25 July 2024, ASPI has identified at least 80 inauthentic accounts on X that have reshared the deepfake video of Marcos (see screenshots below), which we assess as likely linked to Spamouflage, a covert social media network operated by China’s Ministry of Public Security. For example, one account named Lisa Carter shared the Marcos deepfake video with the text ‘#Marcos，Drug Abuser’. (The comma, subtly different to an English comma, is a double-byte character commonly used in East Asian language fonts, such as Chinese, Japanese and Korean.) The same account posted images about Guo Wengui, a Chinese businessman who has been targeted in previous Spamouflage campaigns. Other Spamouflage accounts are reposting the video, claiming it is real and, in replies to legitimate accounts’ posts of the video, for a drug test.

Figure 2: Posts by Spamouflage accounts on X about the Marcis deepfake video.

On YouTube, ASPI has identified at least 11 videos posted by accounts linked to the Spamouflage network, almost all of which have already been suspended. The version of the deepfake video uploaded to X and YouTube appears to be a screen recording of Contreras’s 22 July live stream on her Boldyak TV YouTube Channel. Almost all the accounts on X and YouTube were created in 2024 and were active only during Beijing business hours from 9:19 a.m. to just before 4 p.m., with less activity from 12 noon to 2 p.m., presumably a lunch break. They typically have female Western names, such as Susan Jones or Leesa Tydeman.

The timelines of these accounts reveal other ongoing propaganda and disinformation campaigns targeting the Philippines and amplifying CCP positions. Those include claiming that the US is using the Philippines in a proxy war against China. Accounts also amplified op-eds in Taiwanese and Hong Kong media sites about a book asserting China’s sovereignty claims over most of the South China Sea. The book, by Anthony Carty, an academic at the Beijing Institute of Technology, was published by the New Star Press, a foreign-facing propaganda publishing organisation owned by the China International Communications Group and managed by the Central Propaganda Department. The book has been promoted overtly by Chinese state media, state-affiliated journalists and diplomats. The op-eds all shared by the Spamouflage accounts, authored by an unknown freelancer using the name Lin Yuting 林宇廷, reveal for the first time a new tactic by the Spamouflage network: seeding articles in legitimate news outlets before amplifying across social media.

Figure 3: Posts of Spamouflage accounts promoting Anthony Carty’s book on the South China Sea.

China is almost certainly unhappy with the Marcos administration, which has reset the Philippines’ relationship with China and adopted a more assertive strategy over its maritime territorial claims. Former president Duterte initially dismissed the value of a decision of the Permanent Court of Arbitration in The Hague in 2016 that favoured the Philippines and determined that major elements of China’s claims in Philippine waters had no basis in international law. He was reluctant to invoke it.

Under Marcos, the Philippines has also reduced Chinese government financial support for some infrastructure projects, preferring to engage with other partners.

China is likely to continue escalating its influence operations this year in the lead-up to the May 2025 Philippine mid-term general elections. It may, for example, help members of the Duterte family who are seeking senate positions and thus pave the way for one of Duterte’s children to run for president in 2028. In the first half of 2024, there was a significant increase in overt propaganda from Chinese state media exploiting foreigners who pushed China’s lines. There were also attacks by pro-CCP groups against the Philippine Coast Guard seeking to undermine trust in the Marcos administration and policies.

This isn’t the first time that China-backed networks have promoted content supporting Duterte’s political ambitions. In 2020, Meta said it had removed a network originating from China that had posted content supportive of Duterte and his daughter Sarah Duterte’s possible run for the presidency in 2022. According to Graphika, a social media analytics firm, two pages that focused on the Philippines attracted around 57,000 and 40,000 followers. In comparison, the Spamouflage campaign disseminating the deepfake of Marcos has struggled to gain engagement.

As we approach the elections next year, we are likely to see more online operations that are sophisticated and covert, intending to secure a new Philippines Congress with more representatives having favourable views of China.

Since Spamouflage campaigns are typically coordinated with other covert influence operations, it is plausible that the Chinese government directly supported or was notified in advance about the creation of Contreras’s deepfake video. Previous Spamouflage campaigns harassing Canadian politicians amplified articles from Red Maple News, a Chinese-language Canadian media outlet with links to the CCP’s united front and propaganda system. CCP-produced disinformation over Japan’s release of wastewater from the Fukushima nuclear power plant was coordinated with the supposed leaks of fake documents.

The Maisug rallies, in which Contreras premiered the deepfake video, have possible links to Philippine Offshore Gaming Operators (POGOs), which are companies offering online gambling services to markets outside the Philippines and appear to be part of the CCP’s efforts to capture and influence the Philippines’ elite. Maisug means ‘brave, strong, fearless’ in Cebuano language, which is spoken in Visayas in the centre of the Philippines archipelago. The leaders of the Maisug movement include former presidential spokesperson Harry Roque, whom we discuss further below, and former Cabinet Secretary Leoncio ‘Jun’ Evasco Jr, who was a former top leader in the New People’s Army, the armed wing of the Communist Party of the Philippines. The Maisug rallies seek to mobilise political support for Duterte’s family. However, it’s unclear how they are funded, despite being held globally in various Filipino diasporas and sometimes attracting thousands of attendees.

An alleged informer from the Philippines’ intelligence community told Rappler that the Maisug rallies were being bankrolled by POGOs but this hasn’t been corroborated by other sources. According to Rappler’s source, POGOs were providing funds to Maisug rallies through the networks of Michael Yang. He is a former economic advisor to Duterte and a controversial figure in Filipino politics. According to testimony filed for an International Criminal Court case, Yang ran the narcotics trade in Davao, the city where Duterte was formerly mayor, and brokered deals through China’s Belt and Road Initiative.

Yang is a member of various CCP united front work groups such as the Philippine-Chinese Chamber of Commerce Labuan and the China-Philippines Friendship Club. Yang’s brother was implicated in an investigation into the POGOs of Tarlac, Luzon, and for ‘suspicious transactions associated with Alice Leal Guo’, an infamous mayor of Tarlac who has been suspected of working for Chinese intelligence and has now gone into hiding.

Raids on a house used by Chinese nationals linked to the Tarlac POGOs reveal further affiliations between the POGOs with Duterte’s presidential spokesperson, Harry Roque and the Maisug rallies. Roque partly owned the raided house and attended the Maisug rally in Los Angeles where Contreras’s deepfake video was launched. Roque’s Facebook account was one of the first to share Contreras’s video. On it, he continues to claim the video is real.

Roque is often quoted in the Chinese state media tabloid Global Times repeating CCP propaganda talking points that assert the Philippines’ pivot back to the US is a mistake. In March 2024, Roque revealed a previously unknown ‘gentleman’s agreement’ on limiting the resupply of the Second Thomas Shoal between Duterte and China’s leader Xi Jinping. According to analysis of publicly available records of the Chinese Ministry of Foreign Affairs and the embassy in Manila, not even Chinese officials likely believed this agreement existed in 2023 and early 2024. More recently, Alejandro Tengco, the chairman of Philippine Amusement and Gaming Corporation (a government-owned and controlled corporation overseeing and regulating casinos) accused Harry Roque of facilitating a license for, and being the legal head of, a POGO hub in Pampanga that authorities raided for human trafficking, torture and scams. Roque has denied all these claims.

Figure 4: A photo posted on the X account of Harry Roque (left) with Huang Xilian, ambassador of China to the Philippines.

The transnational crimes that POGOs have facilitated and the bizarre case of Alice Guo, a possible CCP agent whose fingerprints match those of a Chinese woman named Guo Huaping, are not unique to the Philippines. A link between the POGOs and the CCP would not be surprising, since there are many other examples of covert CCP influence and intelligence operations involving criminal syndicates across Southeast Asia. Chen Zhi, the chairman of Prince Holding Group, who transformed from an unknown small business owner in his native China to a multi-billionaire Cambodian citizen, has reportedly been involved in alleged forced labour schemes at compounds linked to Prince Group and with covert operations by China’s Ministry of Public Security to lure dissidents to Cambodia. There are also the Kokang criminal families in northern Myanmar, which for more than a decade enjoyed close relations with Yunnan province officials, along with support from Beijing and the military government in Myanmar.

If it’s true that CCP-linked POGOs are bankrolling the Maisug rallies, Manila must investigate the broader network of malign actors advancing China’s interests in the Philippines. There has been some preliminary research on this issue, but more work is needed to map out and publicly expose the entire landscape of actors. This includes civil-society organisations involved in united front work, such as the Asian Century Journal, which repeats CCP propaganda, or the Association for Philippines-China Understanding, which includes Duterte as Hall of Fame awardees.

Moreover, the Philippines has received little overt support from its Southeast Asian neighbours in countering China’s cyber-enabled foreign interference and aggressive activities in the West Philippine Sea. Manilla should instead enhance its cooperation with international partners and multilateral institutions, such as Interpol and Quad countries—the United States, Australia, Japan and India—to share intelligence and coordinate actions against the CCP’s united front system, including transnational criminal organisations linked to the CCP.

As a start, the Philippines and its partners should use the newly arranged meetings of their  national security advisers (NSAs) to focus more on cyber-enabled foreign interference and malign influence in the Indo-Pacific. Australia will need to appoint its own dedicated, autonomous national security adviser, but other Quad partners already have dedicated NSAs or an equivalent, as do Britain, Canada, Malaysia and Thailand.

The Quad should establish a dedicated working group with Interpol to help address the broader security challenges posed by transnational crimes, such as human trafficking, corruption, narcotics and cyber scams in Southeast Asia. This could involve greater collaboration with the Philippines’ National Bureau of Investigation by the Quad’s domestic investigative agencies, including the US Federal Bureau of Investigations, Australian Federal Police, Japan’s National Police Agency and India’s Central Bureau of Investigation. These broader engagements should help support the establishment of an Indo-Pacific Hybrid Threat Centre, which would be a strategic move to build broader situational awareness of hybrid threats.

China’s destabilising activities in the region will require a collective response from the Philippines and partners willing to maintain an open, stable and prosperous Indo-Pacific that is inclusive and resilient. By doing so, the Philippines and other Indo-Pacific nations can safeguard their sovereignty and maintain the integrity of their democracies amidst China’s attempts to undermine social cohesion and equitable economic development.