Since late August 2026, Black Dot Research (BDR) has been receiving multiple emails on our feedback channel, feedback@blackdotresearch.sg, asking for more information about our organisation and to be added to our email updates. Using CleanTalk, a platform that examines malicious online traffic, we found that several of the accounts behind these emails were real, not automated bots and they had engaged in spamming behaviour previously.
On their own, requests to subscribe to a mailing list are unremarkable. What caught our attention was the volume, the repetition and the profile of the senders. It is also not the first time our feedback channel has been used against us.
Operation Overload
Previously, BDR had received multiple spam messages linked to a far more deliberate effort. From late 2024 to present, several emails have been sent requesting fact-checks, however these messages have slowly been replaced by the emails requesting information and “updates” mentioned above.
We noted that the content of these previous emails requesting fact-checks matched those of Operation Overload, a pro-Russian campaign first documented by the research organisations CheckFirst and Reset Tech. Their June 2024 report found that the operation had targeted more than 800 organisations, including through more than 200 emails sent to newsrooms and fact-checkers, often under the subject line “Please check”. Each email urged the recipient to verify multiple news stories or fabricated images, with each email body containing multiple links to be looked at. The goal was twofold: to divert the time and resources of fact-checkers, and to bait them into publishing debunks that would bring the false narrative to a wider audience.
The operation has since grown. A June 2025 follow-up counted more than 700 targeted emails since September 2024, nearly 600 unique pieces of falsified content, and the identities of more than 180 people and institutions misused, with much of the content AI-generated or deceptively edited. Most recently, Debunk.orgpublished a third report on 17 September 2026 analysing more than 1,000 emails sent between October 2023 and April 2026. It found that the campaign now bundles several links, accounts and media items into each message and has spread from Telegram to X, TikTok, Bluesky and Truth Social. On Bluesky, it has used compromised or misused accounts belonging to real journalists, academics and other public-facing users. It has also impersonated Reuters, MSNBC and the open-source investigations group Bellingcat.
What is different this time
The current wave does not look like Operation Overload. The emails do not ask us to verify anything, and they do not carry fabricated images or videos. Instead, they ask to be added to our updates, and they come from real accounts with a history of spam rather than from freshly created addresses. We have not attributed these emails to any actor, and they may yet turn out to be ordinary spam.
However, these emails arrive at a time when Singapore has seen a string of attempts to gather information through approaches that look harmless at first. Investigations by CNA this year have exposed websites posing as Singapore-based think tanks and consultancies that recruit people with government or think-tank experience, including people from other countries.
The approaches follow a pattern. In August 2026, CNA found that Infoassa, a Singapore-registered firm presenting itself as a think tank, had advertised well-paid, part-time roles to people with government, military or policy research backgrounds. Applicants were set writing tests, one of which referred to confidential material on a future Trump–Xi summit. They were offered payment as a “reward” for passing and asked where their information came from. The firm used fabricated staff profiles with what appeared to be AI-generated photos, and its registered address led only to a corporate secretarial service.
Later that month, CNA reported that another purported consultancy, Great Vision, had listed a “Dr Jade Chan” who claimed to have held Singapore diplomatic postings. The Ministry of Foreign Affairs said she had never worked there and reported Great Vision and two other sites to the police. In September, Coordinating Minister for National Security K Shanmugam told Parliament that the government had blocked access to one of them, Global Asia Think Tank, under the Online Criminal Harms Act.
This template is not new. In 2020, Singaporean Dickson Yeo pleaded guilty in the United States to acting as an illegal agent of Chinese intelligence. He had set up a fake consulting company, used a professional networking site to find people whose CVs suggested access to valuable information, and paid them to write reports that he said were for clients in Asia.
Across these cases, the first approach appears to be deliberately discreet whether through a job advert, a writing test, or a request as part of an interview. None of it looks like espionage. Its purpose is to learn who knows what, who will respond, and how far they can be drawn in. As Member of Parliament Yip Hon Weng put it, “the most valuable target may no longer be the classified document, but the mental map”.
What our inbox could give away
A request to join a mailing list is an even lower-stakes opening than a job advert. We are not suggesting that the senders of these emails requesting for information are linked to any of the entities above, but the same logic applies. A reply, even an automated one, confirms that our inbox is monitored. A personal reply would reveal who handles it, their name, their role and how they sign off, which is exactly the kind of detail needed to impersonate us convincingly. Once on our mailing list, a sender receives everything we publish as soon as we publish it, building a picture of which narratives we are tracking, which we are not, and how quickly we respond.
For an organisation that monitors influence operations, an adversarial organisation or individual would be interested in knowing our key pillars of research. Being up to date on what fact-checkers are watching, and how they verify claims, in turn makes producers of harmful content better placed to avoid them.
In the cases explored by CNA above, the opening approach was followed by bigger asks. If whoever is behind these emails follows a similar tactic, later emails might arrive as invitations to collaborate, requests for interviews or surveys about how we verify claims, or offers of paid research work. Each would be harder to dismiss than spam, because each would look like the kind of request a research organisation receives every week.
That is why the pressure on fact-checkers is more than just a nuisance. Singapore’s verification ecosystem is small. Every hour a fact-checker spends sorting manufactured emails is an hour not spent tracking the coordinated campaigns aimed at Singaporeans, and every detail an adversarial party gathers about how we work makes us easier to evade or impersonate.
A possible disruption to Russian bot activity
Campaigns such as Operation Overload rely on more than email. Their content is amplified across social media by networks of inauthentic and automated accounts, so any disruption to that infrastructure is of interest to fact-checkers. We are therefore watching reports that a series of Ukrainian drone strikes on Yandex data centres in Russia in October 2026 coincided with a sharp fall in automated online activity. UNITED24 Media reports that facilities in Sasovo (8 October), Kaluga (9 October) and the Vladimir region (11 October) were hit, causing outages across Russian banks, retailers and news sites. Cloudflare Radar data for Yandex’s network showed automated requests falling to near zero by 11 October, and Ukrainian President Volodymyr Zelenskyy said on 12 October that Russian bot activity had declined. A Czech member of the European Parliament also suggested that online activity supporting Germany’s far right party AfD had dropped.
The evidence is far from conclusive. Cloudflare’s figures measure all automated traffic, which includes search crawlers and monitoring software as well as social media bots, and the drop may simply reflect damaged infrastructure rather than a disruption to propaganda operations. The link to AfD-supporting accounts remains speculation. While we have not seen a significant reduction in the emails reaching our feedback channel following these events, we will continue to monitor the situation.
What comes next
We are treating the current wave with caution. We will not add unverified addresses to our mailing list, and we will continue to monitor the pattern of these emails and compare notes with fellow fact-checkers, including through the Asian Fact-Checkers Network. This, however, does not mean that BDR will be closing feedback channels for the public.
If you have come across any requests for information or suspicious activity being directed at you or your organisation, please write to us at feedback@blackdotresearch.sg.
Details such as the sender’s address, the wording of the request and the date it arrived help us and fellow fact-checkers spot patterns early. In the meantime, we encourage you to be cautious about replying to unsolicited requests for information about your work, and to verify who is asking before you share anything.
