Vaccine Disinformation: Part Two

Download the report here

In ongoing efforts to protect the public from COVID-19 disinformation, Cyabra continuously analyzes the thousands of conversations taking place across social media regarding COVID-19 vaccines. Following the first report of our vaccine disinformation series, part two of the series contiues to highlight disinformation regarding vaccine side effects as well as campaigns undermining effectiveness of specific vaccines.


The segmentation of the 390,000 profiles that Cyabra scanned for this report is presented below. Profiles that used negative sentiment text are labeled as “Bad Actors” by Cyabra. Facebook is the social media platform with the highest percent of fake profiles that referenced the COVID-19 vaccine. Facebook also has the highest percent of profiles that used negative sentiment language in referencing the vaccine. However, a greater number of coordinated online campaigns were could be found on Twitter in comparison to Facebook.


Cyabra analyzed the content of both real and fake profiles and detected several tweets discussing the same topic. The tweets refer to a case in Boston where a doctor who took Moderna’s vaccine had allergic reactions. Cyabra sampled 1,976 profiles that participated in this discourse, 7% of which are fake profiles. Below are examples of the retweets by fake profiles Cyabra scanned.

Cyabra also analyzes the connections between real and fake profiles and divides them into communities. Cyabra’s “community” function highlights profiles that are highly connected in various forms. Cyabra analyzed the behavior of the scanned profiles and divided them into communities that contain profiles with similar behavior. The division of the profiles is based on many reasons, such as the number of friends and followers, the profile creation date, and the absence of picture profiles.

Cyabra found one community of fake and real profiles with similar behavior tweeting positively about AstraZeneca’s vaccine. The community contains 165 profiles, 94% (155 profiles total) within it are fake. The images below show the community of the fake and real profiles spreading positive content about AstraZeneca’s vaccine and a few examples of said content.

Below is another example of a Cyabra community; this one is based on followers. The profiles inside this community follow each other to a high degree. Often, a community of profiles following each other indicates they are spreading the same message. Most profiles in this community expressed criticism of the Russian vaccine “Sputnik.” Cyabra analyzed the connections, behavior, and text of these profiles and discovered many Bad Actors (profiles that used negative sentiment language). The Twitter community contains 647 profiles spreading negative content about Sputnik’s vaccine, claiming it’s dangerous. Below is an image of the community against Sputnik and examples of content shared by its profiles.


Cyabra continues to monitor the online discourse surrounding the COVID-19 vaccine on several social media networks with its proprietary AI-powered platform. This report is a part of an ongoing effort to map potentially harmful social media orchestrations, and discussed initial results found by Cyabra on Facebook, Twitter, and VK. Cyabra identified over a hundred fake profiles contributing to an online discussion about a Boston doctor who experienced a harsh response to Moderna’s vaccine. Additionally, Cyabra also found several interactive online communities using fake profiles to spread their message. One community of fake profiles is spreading claims favorable to AstraZeneca and its COVID vaccine. Another community discussed the possible dangers of the Russian vaccine, “Sputnik.” Cyabra will monitor the response to the vaccines rollout on social media on an ongoing basis and pinpoint and report on inauthentic behavior online.


Vaccine Disinformation Report 2020

Download the full report now

With COVID-19 vaccines currently being developed and deployed worldwide, the public now faces its next public health challenge- that of disinformation.

In efforts to shed light on some of the ongoing fake campaigns circulating on social media, Cyabra used its AI based solution to scan these conversations to gain a deeper understanding of these campaigns. Focusing on Facebook and Twitter, Cyabra analyzed the online behavior, connections, and messaging of 132,000 profiles. Here, we found nearly 18,000 fake profiles (13.5%). Based on Cyabra’s experience with disinformation campaigns, this percentage of fake profiles indicates the presence of an online disinformation campaign. Cyabra typically encounters around seven to ten percent of fake profiles.


Cyabra’s tools analyze the connections between each profile in order to understand the impact and reach of each profile. The image below is a cluster from Cyabra’s dashboard representing the main profiles participating in the vaccines discourse on Twitter and the manner in which they are connected. The red nodes represent fake profiles; the green nodes represent real profiles. The bigger the node, the more connections the profile has.

While the visual link analysis depicted above shows all of the profiles that interacted with one another (following, replying, or retweeting), the images below represent segmented profiles, otherwise known as “communities.” Cyabra’s “community” function highlights profiles that are highly engaged with each other and share the greatest number of connections and, often, a common theme. The themes that Cyabra uncovered relating to COVID-19 vaccines are presented in the images below. Analyzing all of the fake profiles, Cyabra discovered three Twitter communities comprised of fake profiles tweeting three distinctive sets of messaging. Two of these fake campaigns actively spread favorable tweets about AstraZeneca’s vaccine while criticizing other companies developing vaccines. The third fake campaign disputes the existence of COVID-19 and attacks the utility of all COVID-19 vaccines.

Community A: Anti-Vaccine

The anti-vaccine community contains 136 fake profiles that are actively spreading negative content against all COVID-19 vaccines.

Community B: Pro-AstraZeneca (1)

Community B contains 239 fake profiles circulating positive content about AstraZeneca’s vaccine progress and positive content about the company.

Community C: Pro-AstraZeneca (2)

Community C also praises AstraZeneca but spreads harmful content surrounding Pfizer’s COVID-19 vaccine. This community contains 220 fake profiles.

Cyabra did not find a significant difference on Facebook between topics discussed by real profiles and the ones discussed by fake profiles. However, a trending topic that stood out amongst fake Facebook participating in the COVID-19 vaccine discourse was Bitcoin. The image below represents an example of the system’s classification of subjects, with subjects used by real profiles shown in green and ones used by fake profiles shown in red.

Figure 7 – Cyabra’s topics division into real and fake profiles from the system 

While the real profiles did not discuss anything relating to Bitcoin, fake profiles used the subject of Bitcoin numerous times. Cyabra analysts found that these fake profiles spread content on Bitcoin for advertising as a part of a fake campaign.

Below is an image from Cyabra’s platform showing the connections between the fake profiles on Facebook that posted about Bitcoin in discussions relating to COVID-19 vaccines. The fake campaign is taking advantage of the online interest in COVID-19 vaccines to promote a Bitcoin website. The fake profiles identified posts related to COVID-19 vaccines with high engagement and replied to them with promotional content about Bitcoin sites and Telegram groups.

Aside from communities, there is also merit to doing a deep dive of the most influential profiles. In a disinformation campaign, there are typically three types of profiles with the highest impact in a fake campaign: 1.The most content: The more posts, replies and shares a profile creates, the more influence it has in shaping the conversation, both within the campaign and with profiles that are only partially connected to the campaign. 2.The most connections: The more connections a profile has, the more it can control what people within the campaign see. 3.The most engaged: Profiles that are the most active in a campaign can shape the way people who are new to the subject perceive it.

Cyabra marks the connections between fake and real profiles to emphasize which fake accounts “break through” the fake profile sphere and can influence real profiles. Understanding which fake profiles have the highest number of real connections is another method to understand which fake profile has the most influence.

The most connected fake profile on Twitter is esme_hornbeam, with 63 fake connections. The system labeled the profile as fake due to a large percentage of its content being retweets, and its bot-oriented behavior. To identify any content possibly linked to the subject, Cyabra extracted multiple tweets that the profile tweeted about the COVID-19 vaccines.

Figure 9.1 – The most connected fake profile


With COVID-19 vaccines currently being developed and deployed worldwide, the public now faces its next public health challenge- that of disinformation. In efforts to shed light on some of the ongoing fake campaigns circulating on social media, Cyabra scanned 132,000 accounts where advanced AI uncovered multiple, harmful agendas. Within this sample, 18,000 profiles were fake, resulting in a significant reach of each of these disinformation campaigns. With two of the fake Twitter campaigns favoring the AstraZeneca COVID-19 vaccine, the misleading agenda intended to promote the vaccine as superior to the other COVID-19 vaccines in development. The third Twitter disinformation campaign, and perhaps the most dangerous, attacked the existence of the Coronavirus and all COVID-19 vaccines, claiming that the Coronavirus does not exist and is a guise by governments planning to control human actions. Additionally, Cyabra identified another campaign of fake profiles on Facebook that exploited the online interest in COVID-19 to advertise Bitcoin.

As disinformation becomes a more prevalent threat, Cyabra continues to monitor the disinformation surrounding COVID-19.

Chinese Disinformation Campaign on Twitter

Download the full report


With a long history of diplomatic tension between China and Australia, relations in the first half of 2020 significantly deteriorated. In April 2020, Australian Prime Minister Scott Morrison called for an international investigation on the origins of the coronavirus, leading the Chinese government to dub this proposal as political manipulation. Since then, the two countries have entered a fierce trade war. Most recently, China imposed up to a 212% tariff on Australian wine imports, effectively cutting Australian winemakers from their largest market.

On November 19, Australia released a long-awaited report alleging that Australian troops had committed at least 39 unlawful killings in Afghanistan during the war. Tensions between Australia and China erupted further this week over the subsequent tweet by Zhao Lijian, a Chinese foreign ministry official and spokesman, who tweeted a fake photo of an Australian soldier holding a knife to the throat of an Afghan child. The text beneath the photo reads: “Don’t be afraid, we are coming to bring you peace!”

Cyabra conducted a randomized sampling of the profiles that engaged with this tweet, uncovering an orchestrated disinformation campaign originating from China.

Analyzing nearly 1,500 profiles that engaged with Lijian’s tweet, Cyabra detected that 57.5% of the accounts that engaged with the tweet are fake accounts working together to spread the harmful narrative published by Lijian.

The majority of these profiles were flagged as fake by Cyabra for many reasons, including the unusually low quality of the profiles analyzed.

Upon further analysis, Cyabra discovered that many of these accounts were only created in November 2020 and have one single tweet – a retweet of Lijian’s original tweet for the purpose of amplifying this post. The images below represent examples of these low quality, fake accounts created in November.

Lijian’s tweet reached an exceptionally high number of profiles due to the amplification of the post by the large network of fake accounts engaging with Lijian’s tweet.

Cyabra’s platform also analyzed the connections between these profiles. Below is a visual of the “cluster” surrounding the tweet and its engagement, in which the red nodes represent fake profiles and the green ones are real profiles.


Given the extraordinarily high number of fake accounts that engaged with Lijian’s tweet, it is clear that this is an orchestrated disinformation campaign. This network of profiles worked together to spread and influence the wider public. Cyabra’s experts conclude that there is a high probability that a single, malicious entity (possibly a state actor based on the nature of the online campaign) orchestrated and managed all of the fake activity surrounding this tweet.