Examining Suspected Inauthentic Amplification in Malaysian Media Ecosystems: A Facebook-Based Analysis of Japan–China Tensions Following Sanae Takaichi’s Taiwan Remarks

This report was produced by three researchers from Malaysia: Shine Tan Huey Shyh, Dr. Norizzati Saifuddin, and an independent researcher.

This report was supported by Internews under the Indo-Pacific Media Resilience Program, in collaboration with Doubletink Lab. However, the researchers involved in this project retain full autonomy over their work and outputs, and they hold full authorship and credit for this report.

1. Overview & Focus

This study investigates Facebook user interactions within Malaysian media ecosystems in response to geopolitical tensions, with an emphasis on identifying patterns of potentially inauthentic accounts.

Our observation period spans 7 November 2025 to 31 December 2025, centering on a key regional incident: Japanese Prime Minister Sanae Takaichi’s parliamentary remarks suggesting that Japan could deploy its Self-Defense Forces if China were to attack Taiwan. This statement quickly escalated into a diplomatic episode between China and Japan.

The development of the incident unfolded in distinct phases. On 8 November 2025, Xue Jian, China’s Consul General in Osaka, amplified the controversy by reposting the remarks on social media with a strongly worded comment, which was later deleted on 11 November.

Notably, several international media outlets[1] and fact-checking organisation[2] observed that China’s initial response was relatively restrained in the first week. However, from 13 November onward, China escalated its actions. This included summoning the Japanese ambassador, demanding a retraction, and implementing a series of retaliatory measures such as suspending Japanese cultural exchanges, reducing flights, issuing travel advisories, and halting certain trade negotiations.

Against this backdrop, the issue became a prominent topic in Malaysian international news coverage and Malaysian media Facebook pages for more than two months, generating substantial user engagement.

During this same period, we observed the emergence of a cluster of potentially inauthentic accounts in Facebook comment sections. These accounts displayed similar characteristics and activity patterns, but after a period of activity, many of them disappeared or became inactive, making further tracing difficult. The apparent clustering of their disappearance further adds to the level of suspicion surrounding their behaviour.

2. Research Method

Research Approach and Data Source Selection

This study adopts an exploratory digital investigation approach to examine patterns of Facebook user interactions within Malaysian media ecosystems, with particular attention to the presence of potentially inauthentic accounts.

Drawing on Meta’s policy framework[3], inauthentic behavior (IB) refers to coordinated deceptive activity conducted through networks of misleading or false accounts, often aimed at manipulating user perceptions or evading platform enforcement. When such activities are systematically organized using false identities, they are defined as Coordinated Inauthentic Behavior (CIB). This study uses these definitions as a conceptual reference point to guide the identification of observable indicators of potentially inauthentic accounts.

Despite the diversification of news sources in the social media era, traditional media outlets and their official Facebook pages were selected as the primary data sources. This is because they remain comparatively more authoritative and structured sources of international news, and serve as key nodes shaping public exposure and engagement.

Rather than analysing the news content itself, this study focuses on user interactions and profile characteristics within comment sections. Through these platforms, the study examines how users engage with and respond to international political developments, particularly through observable behavioural and account-level indicators.

Data Collection and Sampling Strategy

The observation period spans 7 November to 31 December 2025, beginning from the emergence of Japanese Prime Minister Sanae Takaichi’s Taiwan-related remarks. While the incident continued beyond this period, the timeframe was limited due to resource and time constraints.

An initial dataset was constructed by systematically searching news articles across major Malaysian traditional media websites in three languages. Besides, the keyword searches were conducted using the following terms.

To ensure consistency between published media reports and social media engagement, all identified news articles from the media websites were matched with their corresponding Facebook posts for further observation.

Media Selection and Focus Narrowing

Preliminary analysis revealed a significant imbalance in coverage across language groups. Chinese-language media outlets demonstrated substantially higher reporting volume on the issue.

For instance, during the observation period, Oriental Daily News and Sin Chew Daily published 125 and 232 articles respectively, while English-language media outlets published fewer than 100 articles and Bahasa Malaysia-language media outlets published fewer than 10.

Figure 1 : Keywords Used for Searches and Number of Related News Articles Across Media Outlets in Different Languages.

In addition to higher output, Facebook posts by Oriental Daily consistently generated greater user engagement (in terms of reactions, comments, and shares) compared to other language media outlets covering similar events.

Figure 2: Oriental Daily News Facebook posts on issues related to Japan and China generally received 2,000 or more reactions from netizens, significantly higher than those of Sin Chew Daily.

During the initial screening phase, potentially inauthentic accounts (IA) were also observed on the Oriental Daily Facebook page. Based on these observations, the study narrowed its primary focus to related Facebook posts and comment sections of this media outlet, to allow for more systematic identification and analysis of IA patterns.

However, to account for Malaysia’s multilingual media environment, comparative observations were also conducted on English-language media outlets, namely The Star and New Straits Times, as well as Bahasa Malaysia media outlets including Berita Harian and Utusan Malaysia.

Preliminary observations identified some potentially inauthentic accounts (IA) on The Star Facebook page, while no significant presence of potential IA was observed on the Bahasa Malaysia media outlets examined. As such, the study focused on The Star as a comparative case to examine whether (1) similar inauthentic account patterns appeared across different language media, and (2) the observed patterns were platform-specific or reflected organic user behaviour.

3. Research Findings

Identification of Suspected Inauthentic Accounts

Within the selected dataset, we found at least 30 suspected inauthentic accounts. More than 24 suspected inauthentic accounts were identified on Oriental Daily’s Facebook posts, while 8 similar accounts were observed on The Star’s Facebook page.

The identification of these accounts was based on a combination of observable criteria as follows:

• Account characteristics (e.g., recent creation dates, incomplete or unusual profile information)
• Activity patterns (e.g. repetitive commenting behaviour, timing similarities)
• Engagement indicators (e.g., interaction frequency across posts)

While some overlaps in narrative tone were observed, the study does not assume coordinated behaviour, but instead focuses on identifying recurring patterns of account presence and activity.

3.1 Newly Created Account

First, a significant proportion of the potentially inauthentic accounts identified on the Oriental Daily News Facebook page exhibited recent creation dates, predominantly between 4 and 30 November 2025, indicating temporal clustering around the early phase of the incident.

Figure 3: Screenshots of a potentially inauthentic account profile commenting on the Oriental Daily News Facebook post, showing that the account was recently created.

However, in the context of the English-language platform, The Star’s Facebook page, “newly created accounts” refer to those established within the past two to three years.

Figure 4: These accounts identified on The Star Facebook page were mostly created around 2023–2024. These accounts typically had very few friends, limited personal activity, and in some cases were located outside Malaysia. For example, Frank Ma’s account shows only 16 friends and is listed as being based in Hong Kong.

3.2 Simultaneous Inactivity and Deletion of Potential Inauthentic Profiles

Notably, many of these accounts were found to be deleted or inactive at least by or before 26 February 2026, limiting the possibility of further traceability. While such removals may reflect platform-level moderation following user reports, they may also reinforce suspicions of inauthentic behaviour.

Initially, these accounts remained active and accessible during multiple rounds of data collection and examination conducted between 6 December 2025 and 12 February 2026. However, approximately twenty days after the final access point — on 26 February 2026 — these accounts were no longer accessible or had disappeared, thereby further complicating tracking and verification efforts.

Figure 5: On 26 February 2026, when we attempted to revisit previously identified accounts, many of these accounts were found to be no longer accessible or had disappeared.

Several authentic users within the comment sections publicly questioned the legitimacy of these accounts. They highlighted anomalies such as recent creation dates, inconsistent profile information, minimal personal posting history, and generic or duplicated profile images.

Some of these tagged accounts were also included in our dataset. These peer-level observations provide an additional layer of qualitative verification, as organic community members independently identified and flagged similar suspicious behavioural patterns.

However, when we attempted to further check on these accounts, they were no longer accessible, as the tags had been removed and the accounts were inactivated.

Besides, the Facebook account “哥哥” was observed on 6 December 2025. At that time, the account was active and its Facebook ID was visible on the profile. On 7 February 2026, the ID had been removed. By 26 February 2026, the account had completely disappeared upon revisiting.

While this pattern may suggest the possibility of intentional account creation and subsequent removal within the November–December 2025 period, the study does not establish this as conclusive evidence, given the absence of platform-level verification.

However, in the absence of access to platform-level verification mechanisms, account deletion alone cannot be taken as conclusive evidence of inauthenticity.

3.3 Stock-generated, AI-generated, or reverse-image, and repurposed celebrity images

Besides, many accounts displayed atypical profile characteristics, including the use of profile images that appeared to be stock-generated, AI-generated or reverse-image that are widely circulated online.

Figure 6: In another instance, the profile image did not appear to represent a real individual. Using HIVE AI, an artificial intelligence tool that assesses the likelihood of AI-generated or non-personal images, the profile picture was classified as highly likely AI-generated (99.9%).

In addition, Google Lens detected visually similar images across multiple websites. These findings suggest that the image is not unique to the user, indicating possible identity ambiguity or a preference for anonymity.

When conducting image searches using Google Image, many profile pictures associated with suspected inauthentic accounts were searchable everywhere rather than original images uploaded by the account holders.

In several cases, Google AI Gemini indicated that these images were frequently sourced from prominent figures or commonly circulated content in popular online memes and social media commentary.

For example, one suspected inauthentic account (“Lanjiaokia”) used a profile image that was linked to the persona “Xavier Uncle,” a figure widely recognised in digital spaces for humorous or relatable meme-based content.

3.4 Repurposed celebrity images or Fictional Character Images

In other instances, profile images were directly taken from well-known celebrities, including Lisa from the K-pop group BLACKPINK and Hong Kong actor Roy Cheung. In addition, some suspected inauthentic accounts used images of fictional characters, such as Pigsy (Zhu Bajie) from Journey to the West. These patterns further suggest the use of non-original or repurposed identity visuals among the identified accounts.

Figure 7: Additionally, the account is shown as an additional profile that doesn’t need a real name, which makes it even harder to figure out the real identity.

Figure 8: Olympigs 2124 A.D. Mars’S account shows many signs that it could be a potentially suspicious profile. These include using a profile picture that using fictional character of Pigsy (ZhuBaJie) from Journey to the West, a Chinese novel published in the 16th century, having a fake name that isn’t personal, and not having any visible social connections.

3.5 Recurring Profile Anomalies

In addition, closer inspection of the suspected inauthentic accounts revealed recurring profile characteristics. A notable proportion of these accounts self-identified as “bands,” “musicians,” or other entertainment-related entities, yet showed no substantive music-related activity, content history, or audience engagement consistent with genuine artistic profiles.

Instead, their activity was disproportionately concentrated in politically sensitive comment threads, particularly those related to Japan–China issues.

Figure 9 : These suspected accounts self-identified as “bands,”or “musicians”, yet showed no substantive music-related activity. Some of them have been flagged and tagged by other users, however the tagged accounts later became inaccessible or removed after 26 Feb 2026.

3.6 Minimal personal posting history

These potentially inauthentic accounts generally showed minimal personal posting history, with limited evidence of ordinary social interactions.

They have vague accounts because they don’t show a clear list of personal friends, but instead, some of them follow a lot of pages and public accounts.

Figure 10: These potentially inauthentic accounts generally showed minimal personal posting history, with limited evidence of ordinary social interactions.

3.7 Usernames exhibiting similar hybrid local slang linguistic styles

Some accounts username also demonstrated similar linguistic styles, including the use of hybrid Malaysian-Chinese slang expressions (e.g. “Abunene,” “懶趴/Kiong Kan,” “秋季別/Jiaksai”), suggesting a degree of localisation targeting Malaysian Chinese audiences.

Figure 11: These potentially inauthentic account names have similar hybrid local slang linguistic styles.

3.8 High-frequency engagement in issue-based discussions

High engagement refers to instances where the same user posts multiple comments within a short period of time. In The Star, few suspected inauthentic accounts demonstrated high-engagement activity by posting multiple comments within the same article and time window.

For example, in The Start Facebook Page, “Olympigs 2124 A.D. Mars”, which features a stock-generated profile picture, was observed commenting on Sanae Takaichi’s news posts from at least 21 November to 22 December 2025. In some instances, the account posted up to six to seven comments containing links within a single post, indicating concentrated bursts of activity.

Figure 12: In The Star, few suspected inauthentic accounts demonstrated high-engagement activity by posting multiple comments within the same article and time window.

3.9 Repetitive anti-Japanese narratives across multiple posts

Observable activity patterns included repetitive commenting behaviour and participation across multiple posts within a short timeframe. For example, in the Oriental Daily News Facebook Page, similar anti-Japanese framing across multiple comments by different suspected inauthentic accounts.

Figure 13: In the Oriental Daily News Facebook Page, similar anti-Japanese framing across multiple comments by different suspected inauthentic accounts.

Similarly, in The Star, these repetitive patterns by the same user posting a similar narrative repeatedly across different posts can be observed. The user consistently posted anti-Japanese narratives, particularly those involving messages of violence and elimination, across multiple posts by The Star. Specifically, some such comments were identified, with two comments posted on 23 November 2025 and another two on 13 December 2025.

Figure 14: The user consistently posted anti-Japanese narratives, particularly those involving messages of violence and elimination, across multiple posts by The Star.

While recurring anti-Japanese narrative elements were observed across multiple comments, this study does not establish evidence of coordinated behaviour or systematic narrative control. Instead, the analysis focuses on identifying recurrent patterns of account presence, timing, and activity within the dataset.

In this data research, we found a total of 21 and 8 suspected inauthentic accounts identified from the Oriental Daily News Facebook Page and The Star respectively, along with their corresponding comments. These appendices are used to illustrate the recurring narrative patterns and thematic framings observed across the dataset.

4. Preliminary Conclusions

A pattern-based approach yields more robust indicators of potentially inauthentic behaviour than isolated account-level observations. In this study, recurring patterns — such as narrative clustering, temporal alignment in account creation, and thematic consistency across comment threads — collectively indicate a likely cluster of suspected inauthentic accounts rather than spontaneous or organic user interactions.

These patterns are further reinforced by converging account-level characteristics, including recently created profiles, minimal personal activity, recurring profile anomalies, the use of non-original or fabricated identity visuals (e.g. stock images, AI-generated images, celebrity or fictional character photos), and usernames reflecting similar hybrid local slang styles. The presence of high-frequency engagement within short timeframes, alongside repetitive issue-based narratives — particularly anti-Japanese sentiments — across multiple posts, strengthens the likelihood of coordinated amplification behaviour.

Although the number of suspected inauthentic accounts identified in this study is relatively limited, their subsequent disappearance presents a notable pattern of concern. A considerable proportion of these accounts became inaccessible over time, having been deleted, deactivated, or otherwise untraceable. While such disappearance cannot be taken as definitive evidence of inauthenticity, the apparent clustering of account removal within similar timeframes suggests a potentially coordinated or non-random lifecycle pattern, thereby strengthening the overall suspicion.

In addition, the findings of this study should be understood within the broader context of platform governance. Meta has publicly identified Coordinated Inauthentic Behavior (CIB) as one of the earliest forms of adversarial threats since 2017. Also, it has noted that the current threat landscape has become increasingly complex and sophisticated, with adversarial actors operating across multiple platforms, adopting evolving techniques, and increasingly leveraging artificial intelligence to obscure identities and amplify influence. Against this backdrop, the potentially inauthentic behaviors observed in this study should be understood not as isolated anomalies, but as part of a broader and continuously evolving ecosystem of coordinated information manipulation.

Footnotes

1. Global Vision, UDN 24h. "The China–Japan Diplomatic Row: Chinese Diplomat Xue Jian's 'Beheading' Remark and Sanae Takaichi's Ambiguous Definition of a 'Situation Threatening Japan's Survival'." 10 Nov 2025. https://global.udn.com/global_vision/story/8662/9129569?from=udn-catelistnews_ch1020
2. FactLink “Viewing ‘Taiwan Contingency’ Through a Taiwanese Fact-Checking Lens: Unpacking China’s Disinformation Playbook Against Japan.” 23 Feb 2026. Accessed 25 Feb 2026. https://www.factlink.tw/p/china-taiwan-japan-information
3. Meta. Policy rationale of inauthentic behavior. Retrieved May 4, 2026, from https://transparency.meta.com/policies/community-standards/inauthentic-behavior/