You Are Here: Home » Digital » Zombie Accounts, Smear Campaigns: Crisis Management

Zombie Accounts, Smear Campaigns: Crisis Management

In the 14th Century Chinese novel ‘Water Margin’, one of the characters named Li Kui is a famous hero whose reputation is known throughout the country. A bandit named Li Gui assumes the identify of Li Kui in order to attack and rob highway travelers. One day, Li Gui meets the real Li Kui who is upset with the impostor and quickly defeats him in a duel. The story illustrates the danger of using a fake identity to cheat and blackmail others for personal gain.


In modern China, there are many online “Li Guis”: companies or their so-called PR agencies use “zombie accounts” to achieve superficially strong marketing results for themselves, as well as to attack competitors. We already introduced the “first time user tweet ratio” as a reference point for PR managers, but how do we know that the data is credible? When the ratio is large, can we be sure that there is already broad consumer interest over this issue? In short, how can honest companies differentiate legitimate concerns and real complaints from malicious, deliberate attacks?

Example: Smear Campaign Against Zhang Ziyi

This famous online case can serve as a perfect illustration of this point: the smear campaign against the “Crouching Tiger, Hidden Dragon” Chinese movie star Zhang Ziyi.

Zhang was invited to serve as image ambassador for one of our client’s products. At the time the actress was also the subject in a speculative poster outside her home which had been disfigured with black ink. Suddenly, a number of online postings appeared, ruminating about Zhang’s finances and personal life, and questioning her moral integrity.

In the course of a single week, the MSLGROUP China team collected more than 14,000 related posts from various social media platforms. A closer look at the data revealed something interesting: many of the posts were related to each other.

The wording of most posts was identical or highly similar; only a few posts displayed major textual differences.
Page views were high, but response levels were low. With the exception of one lively discussion on leading BBS Tianya, few people seemed to take any real interest.

Most postings were published during short, concentrated time periods. In fact, the postings gave the impression that someone was moving from platform to platform, posting comments in one forum after the other with little or no activity in between.

With our suspicions raised, we took a closer look at the Tianya discussion. The situation looked serious: there were

more than two million page views and some 12,000 responses!

But when we looked at the data, we discovered a number of questions:

Two-thirds of the people using highly negative language about Zhang Ziyi, including the originator of the discussion thread, had registered their accounts within the last four weeks. The online identities used to attack Zhang did not discuss many other topics; the only topic of interest it seemed was to promote a local sports brand!

The negative commentary about Zhang Ziyi was a deliberate and orchestrated malicious attack for some purpose.

Identifying Zombie Attacks

This pattern is a general one; most internet identities launching attacks on brands are “zombie accounts”. We have established the following rules of thumb for identifying zombie attacks:

  • Registration is recent, usually 2-3 weeks
  • The account lacks original content
  • Content is business related, especially brand promoting
  • Content is identical or similar to other comments
  • Content is only posted during working hours

What to do when you encounter them

Many accounts show similar behaviours such as writing about a similar topic within a short period of time. If we find that a certain issue is not real stakeholder discontent, we need to treat it differently:



This is an excerpt from our recent report ‘The Art of Weibo Crisis Management’. To download it, visit:

Leave a Comment

Leave a Reply

Your email address will not be published. Required fields are marked *