Someone duped Twitter verification to spread racist disinformation on US coronavirus vaccine

A verified Twitter account impersonating a top World Health Organization official recently alleged that the Trump administration was going to test a coronavirus vaccine on Black Americans without their knowledge or informed consent.

The disinformation scheme originated in May with an account masquerading as Dr. Jaouad Mahjour, assistant director-general of the World Health Organization (WHO), in the latest example of attackers trying to inflame existing tension in the U.S. over issues like vaccines and racism. Tweets included racist tropes against Black Americans, and implied that the U.S. had lobbied WHO to test its vaccines on prisoners, immigrants, and Black Americans.

Twitter has since suspended the account, after WHO representatives told reporters that the account in question didn’t belong to Mahjour. News of the disinformation was first reported by The Daily Beast. Neither Twitter nor the World Health Organization provided comment for this article by press time.

The impersonation appeared to be aimed at eroding trust in a U.S. coronavirus vaccine at a time when the country leads the world in COVID-19 cases. It’s the kind of attack that also appeared to be aimed at amplifying racial divides in the U.S. By alleging a vaccine for a virus that disproportionately affects Black Americans would not obtain informed consent, the campaign plays up America’s racist track record in medical research. In the Tuskegee Study, for instance, the U.S. government observed Black men with syphilis for four decades while withholding treatments and diagnoses without informed consent.

The attack also comes as Twitter and other social media firms have struggled to stop disinformation and account takeovers on their platforms. The attacker who posed as Mahjour apparently was able to dupe Twitter into providing him a blue checkmark, designed to denote that a user is who they claim, raising questions about whether the system — designed to create trust — is totally reliable.

Meanwhile, in the last several months Twitter flagged multiple tweets from President Donald Trump for fact-checking, and just earlier this month penalized Trump’s campaign account for spreading disinformation about the coronavirus.

Possible Iranian links

Exactly who carried out the disinformation scheme remains unclear. The activity, though, resembles the behavior of a network of Iranian disinformation actors, called Endless Mayfly, a group previously highlighted by researchers at the human rights group Citizen Lab. Neither Citizen Lab nor FireEye, which has also researched some of the personas linked with the Mahjour account, directly attributed the Mahjour scheme to Endless Mayfly.

The group is a network of Iran-aligned personas that amplify falsehoods and divisive content about the U.S., as well as Saudi Arabia and Israel, according to a prior Citizen Lab analysis of a disinformation scheme. One of the group’s previous years-long efforts to spread disinformation included masquerading as international media outlets including The Atlantic, The Guardian, Politico, and Bloomberg. In this campaign, Endless Mayfly actors used fake Twitter accounts to amplify their messaging, just as in the case of the faked Mahjour Twitter account.

These same types of tactics appear to be present in the more recent set of activities, according to FireEye’s Mandiant unit. At least one persona that amplified the misinformation from the fake verified WHO account also pushed a fake news article from Israel National News, for instance, Mandiant Threat Intelligence told CyberScoop.

“The account impersonating the WHO official was verified and promoting COVID-19 misinformation; at least one persona promoting that misinformation also amplified the fake Israel National News article,” Cristiana Kittner, a principal analyst at Mandiant told CyberScoop.

2020 elections and geopolitics

Iranian actors have been spreading disinformation about COVID-19 throughout the pandemic, according to the U.S. Department of Defense. This spring, an Iranian group called the International Union of Virtual Media, for instance, spread cartoons and headlines falsely claiming the coronavirus was “a biological war led by Trump to strike at China’s economy.”

The racist disinformation comes amid months of protests against police brutality and racism in the U.S. and appears to play up similar themes from many of Russia’s operations in the buildup to the 2016 U.S. elections that focused on issues related to Black Americans.

The U.S. intelligence community has assessed that the Iranian government seeks “to divide the country in advance of the 2020 elections,” according to an assessment the Office of the Director of National Intelligence issued publicly this month.

Citizen Lab has not attributed Endless Mayfly to the Iranian government.