The curious case of the lifelong Democrats from China
Why make new fake accounts when you can just steal accounts from real people?
Over the last several months, many U.S. liberals have shifted their primary social media presence from X to Bluesky, and spammers have unsurprisingly reacted by creating fake liberal accounts on the platform. In recent days, a number of oddly similar-looking Bluesky accounts with plagiarized profile photos and duplicate biographies claiming to support the Democratic Party have turned up and begun following random liberal users. In an interesting twist, many of these accounts appear to be hacked.
The accounts in question are part of a spam network that, as of July 8th, 2025, consisted of 22 Bluesky accounts with the biography “Female from China, currently living in the US. Lifelong Democrat. Ban assault weapons immediately 🚫 No spam or solicitation 🚫 Encryption anything 🚫 Porn 🚫 Especially no fake news 🚫 Anything”. Unlike many groups of spam accounts, these accounts were not created in bulk; instead, their creation dates range from April 2024 to May 2025, a span of over a year. Most of the accounts have first names as their display names, which curiously do not match their handles.
Similar accounts with different repeated biographies started popping up recently as well, albeit in smaller numbers. These biographies include “I am a woman from China. I hope there will be no racial discrimination here. I agree with the political views of the Democratic Party. In the political views of the Democratic Party, I see a better US” and “US-——South Korea 1 child Loves traveling, currently living in the US Strongly boycotts Orange, he should step down 🚫Pornography🚫Gift cards🚫Catfish🚫Orange”. (Several additional accounts with the former biography were suspended before I was able to take screenshots.)
During the 48 hours after data was originally harvested, an additional account with the “Lifelong Democrat” biography appeared, and one of the original set of 22 accounts was suspended. Interestingly, another of the original set of accounts, @jsketti.bsky.social, cleared their biography, switched back to a default avatar, and changed their display name to match their handle. What does this particular change signify?
Further digging reveals that many, and possibly all, of the accounts in this network originally had different display names, avatars, and biographies. This is a strong sign that the accounts are hijacked; the mismatch between the display names and handles corroborates this. Ironically, this means that in several cases accounts belonging to real Democratic voters were stolen in order to turn them into fake “Lifelong Democrats”. (The account that removed the duplicate biography may be a case where the original owner managed to regain control.)
Over the last week or so, many of the accounts in the network have posted image posts containing identical photographs. A set of four images of a noodle dish and associated condiments and garnishes is particularly popular, and has been posted by at least eight of the spam accounts to date. Various photos of Paris, many featuring the Eiffel tower, turn up repeatedly as well, along with photos of coffee and various forms of exercise.
Although the rise of generative AI provides spammers the opportunity to produce a near-endless variety of unique images, many spam accounts, including those in this network, still post plain old plagiarized photos. (This does, unfortunately, mean that eight different people did not eat the exact same bowl of noodles.) The spam accounts’ profile images are likewise plagiarized; many have been used as avatars for a variety of accounts on a variety of social media platforms, in all likelihood by other spammers.
