Artificial intelligence is dramatically reshaping how foreign threat actors conduct influence operations. However, the shift in tactics is not what many cybersecurity experts initially expected.
Instead of flooding social media platforms with endless streams of automated content, pro-Russia and pro-China threat actors are using AI to make their fake accounts look and act much more human.
A recent threat intelligence analysis spanning 2024 to 2026 reveals how unattributed, malign accounts on X are evolving.
Researchers define these inauthentic accounts as profiles that share pro-China or pro-Russia content while actively hiding their government affiliations.
To be classified as malign, these actors either operate as automated bots or deliberately misrepresent their identities. Today, these networks are adapting to stand out in an AI-saturated internet while evading modern bot detection systems.
AI Powers Human-Like Influence Campaigns
Malign actors are surprisingly not using AI to boost their posting volume or to spin up millions of new profiles. In fact, between 2024 and 2026, these threat groups cut their overall post volumes in half.
The number of active inauthentic accounts remained relatively stable across all three years, hovering between 5,000 and 11,000 each for China and Russia.
Instead of creating new accounts en masse, attackers are repurposing older accounts for new disinformation campaigns.
This suggests that adversaries may either lack the technical skills to deploy AI agents for mass account creation or that social media security measures are successfully blocking automated account creation.
Threat actors are instead leveraging AI to enhance the visual appeal and linguistic reach of their content.
The share of original posts containing images has doubled for pro-China accounts and more than quadrupled for pro-Russia networks.
Many of these visuals include AI-generated cartoons or subtly manipulated photos designed to spread false narratives.
These accounts also heavily rely on AI for translation to expand their global reach. Pro-Russia networks now post in a median of 6 languages, up from just 2 in 2024.
Meanwhile, pro-China accounts are posting far more frequently in English. To further disguise their nature, these bots have slowed their posting speeds and now incorporate long periods of inactivity to mimic human sleep cycles.
Despite these sophisticated upgrades, the “quality over quantity” strategy rarely works for the masses.
Most Russian- and Chinese-influenced accounts struggle to gain traction. A typical account receives only 1 engagement per 3 to 50 posts it publishes, twosixtech said.
However, a small network of outliers proves highly effective. Researchers identified an average of 15 pro-Russia accounts each year that successfully gathered tens of thousands of followers.
These outlier accounts drive the broader network, creating the original content that smaller bots then amplify. In 2026, 72% of posts from these top-tier accounts featured original content, yielding an average of 17-22 real engagements per post.
Alongside changing technical tactics, the geopolitical narratives pushed by these campaigns experienced a dramatic pivot.
In a major reversal from previous years, pro-Russia actors launched heavy criticism against the United States and President Trump throughout 2026.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
