State Funded AI Bot Network Ran 1,200 Fake Swedish Accounts on X

A state actor paid an East Asian company to run a network of about 1,200 fake Swedish accounts on X, according to a report published on 31 August by Sweden’s Psychological Defence Agency, MPF. The accounts posted, commented and shared more than 50,000 times across 2025 and 2026 before X suspended every one of them over the summer.

MPF gave the network the working name Holiday after the accounts’ habit of posting about Allsvenskan matches and summer plans in between the political material. The football talk was camouflage. The politics was the job, accounts taking strongly opposing positions on the same question, some enthusiastically in favour of a proposal, others firmly against, with the effect of making Swedish debate look angrier than it was.

The Central Bank Spotted the First Accounts

The first Holiday accounts were not found by a platform integrity team or a threat intelligence vendor. Sveriges Riksbank found them, shortly after taking part in an exercise MPF ran to help public bodies recognise information influence aimed at their own channels. MPF then established that those accounts belonged to something much larger that was still growing.

Post- och telestyrelsen, the Swedish authority that acts as national coordinator for digital services under the EU’s Digital Services Act, worked with MPF to bring the network to X’s attention. X assessed that the accounts breached its own rules on coordinated inauthentic behaviour and suspended all of them during summer 2026.

Every Account Was More Than Ten Years Old

The tradecraft is where the report earns its reading. Every account in the network was over 10 years old. During spring 2025 they were renamed, traces of their earlier activity were deleted and location data was manipulated so that all of them appeared to be posting from inside Sweden. Profile pictures were generic and AI-generated, follower counts were low and creation dates clustered.

Several of the accounts had done this before. MPF found that they had previously carried different names posted in other languages and targeted audiences in the United States, China and Taiwan. Same infrastructure, different customer, different country.

The 50,000 interactions is the least useful number in the report. Aged, recycled accounts are the product being sold and account age is exactly the signal most organisations still lean on when they judge whether a critic in their mentions is a real person.

The Second Version Learned Sarcasm

MPF splits Holiday’s activity into two phases. Through spring 2025 the accounts worked crudely, consistently for or against the government with fixed interests in immigration, the economy and climate and sustainability, clustering around new policy proposals and statements from ministers and opposition politicians. The network went quiet at the end of 2025. MPF gives three possible explanations for the pause, including changed instructions from the customer and an attempt to avoid detection and does not choose between them.

What returned in spring 2026 was larger and better built. The network had grown to roughly 1,200 accounts, ran around the clock and replied directly to authentic accounts including large Swedish ones. The language had improved to take in sarcasm, humour and sharper rhetoric. The accounts chased whatever was trending among Swedish users that day.

They also joined pile-ons. MPF records the network taking part in coordinated campaigns against Swedish politicians and public figures, government agencies, individual media houses and companies.

Ordered Through Telegram

The supplier MPF describes runs a catalogue business. It advertises and takes orders through Telegram channels, sells populations of hundreds or thousands of ready-made inauthentic accounts and offers to operate a network to the customer’s specification. Price moves with the specification, an account that is several years old, ID verified and carrying real followers costs more than a fresh one. The same supplier sells digital intrusion, doxxing and coordinated smear campaigns.

The report includes indicative price ranges from autumn 2026 for buying engagement on X, Instagram and other platforms. The figures matter less than what the catalogue implies. The barrier to running a credible influence campaign is now commercial rather than technical.

MPF Stops Short of Naming the Buyer

The report states that MPF has evidence a state actor commissioned the network then says plainly that no definitive technical attribution has been made. The supplier is placed in East Asia. The customer is not named.

That distinction is worth more than it looks. MPF separated what it can evidence from what it can prove, in a public document, less than two weeks before a national election, at a point where naming a country would have earned considerably more coverage.

Sweden votes on 13 September. MPF’s published assessment ahead of the vote names Russia as the primary actor behind information influence directed at Sweden including the elections while judging that Swedish elections are not currently a priority target. MPF does not connect that assessment to Holiday and neither should anyone reading the report. Karin Lönnheden, MPF’s head of operations, told SVT that Holiday is not directly linked to the September vote and that the agency published it anyway “because we are so close to the election”.

Baseline Your Own Channels First

MPF’s advice to organisations starts with something unglamorous. Know what normal looks like in your own social channels including followers, likes, comments and mentions per post across a defined period. Without that baseline, a sudden influx of accounts is a feeling rather than a finding.

Watch for the signals MPF lists. Large numbers of accounts posting about the same thing at the same time with similar names or phrasing. Profile pictures that are obviously AI-generated. Wording that reads like machine translation. Generic profile names padded with digits and random letters.

Decide the policy before you need it. Most large platforms publish rules on coordinated inauthentic behaviour and a report filed under those rules is what ended Holiday. If content in your channels breaks the platform’s rules, report it there. If you suspect criminality, go to the police. If you suspect a foreign state actor is behind it, MPF asks to be contacted directly.