Google’s security team has removed hundreds of news sites and domains from Google News for running pro-China content sourced back to a handful of companies allegedly working together as part of an influence operation.

Google’s Threat Analysis Group (TAG) and security subsidiary Mandiant published a report detailing the operations of Glassbridge, which they say is an umbrella group of four companies based in China that operate hundreds of inauthentic news sites and newswire services. 

All of the sites push pro-China narratives in a “highly coordinated manner.” Google said it has blocked more than 1,000 Glassbridge sites from Google News and Google Discover since 2022. 

“The inauthentic news sites operated by GLASSBRIDGE illustrate how information operations actors have embraced methods beyond social media in an attempt to spread their narratives,” the company said. 

“By posing as independent, and often local news outlets, [information operations] actors are able to tailor their content to specific regional audiences and present their narratives as seemingly legitimate news and editorial content.” The researchers said they have observed similar behavior from Russian and Iranian campaigns.

The PR companies and newswire firms typically hid their roles or misrepresented their content as local and independent news coverage. The campaign is likely connected to the Chinese government based on the “consistency in content, behavioral similarities, connections across firms, and pro-PRC messaging,” Google said. 

The investigators found inauthentic news domain names targeting countries across Eastern Europe, the Middle East, Africa, Asia, as well as the U.S. — particularly directing some content at the Chinese-speaking diaspora.

The four companies — Shanghai Haixun Technology, Times Newswire, Durinbridge, and Shenzhen Bowen Media — bulk-created hundreds of domains posing as independent news outlets around the world, and they all published largely the same content. The companies often shared the same content, reproducing press releases among the separate networks of fake news websites.

The sites either republished articles from the Chinese outlet Global Times or created pieces centered around Beijing’s territorial claims in the South China Sea, Taiwan, the Falun Gong, the Xinjiang region, the Covid-19 pandemic and the Association of Southeast Asian Nations (ASEAN). 

Google said they blocked the sites because they violated policies around “deceptive behavior” and “editorial transparency.” The company was unable to fully attribute the campaign to any specific actor, noting that this is likely an example of a growing trend where countries use private PR firms to run information operations — allowing governments to obscure their role and have plausible deniability. 

Some of the observed content came from Dragonbridge, another influence operation Google has spotlighted several times over the last three years.  

Google has released multiple reports since 2022 spotlighting China’s efforts to create fake news websites and YouTube channels to push narratives supporting the government’s initiatives.  

‘Spammy and repetitive’

The most prolific of the companies is Shanghai Haixun Technology, sometimes referred to simply as Haixun. Google’s TAG said it has removed more than 600 policy-violating domains linked to the firm from Google News. The company’s sites targeted English and Chinese-speaking audiences in Brazil, India, Japan, Kenya, Korea, Malaysia, Saudi Arabia, Singapore, Spain, Russia, Thailand, Qatar and Vietnam. 

The company also took down a “limited number” of YouTube channels tied to the group. In July 2023, Mandiant found that Haixun was using content from Times Newswire and another service to spread pro-Beijing content through legitimate news outlets. 

“Mandiant also identified Haixun’s use of freelance services such as Fiverr to recruit for-hire social media accounts to promote pro-Beijing content,” they wrote. “Haixun’s inauthentic news sites are generally low quality, and much of the content on the domains is spammy and repetitive. Mixed in with ‘filler’ articles on topics such as the metaverse, the sites publish news content that is politically aligned to the views of the Beijing government.

Content related to exiled businessman Guo Wengui on Boston Journal, a website linked to Shenzhen Bowen Media. Credit: Google

The report notes that researchers at Citizen Lab previously identified a pro-PRC coordinated influence campaign they called “Paperwall” that operated a network of more than 100 websites in 30 countries that falsely masqueraded as local news outlets. 

Google said in February it removed several domains from appearing on Google News that were part of Paperwall. The sites copied articles from local news outlets and mixed in articles from PRC state-controlled media, press releases, conspiracy theories and other content. 

In the recent campaign, Google researchers observed Times Newswire pumping out troves of articles that spread claims the U.S. is conducting biological experiments on humans and specifically attacked Chinese virologist Yan Limeng — a doctor who became well-known for her controversial and disputed claim that COVID-19 was made in a Chinese lab. 

The Google research builds on previous reports this year warning of a concept researchers call “Pink Slime” — where the internet is increasingly being overrun with fake “news” websites producing largely AI-created content or propaganda from countries like Russia, China and Iran. 

The issue has been exacerbated by the emergence of tools like ChatGPT and the decimation of legitimate local journalism across the U.S. and other countries.