The Compromised Host: how a sincere spiritual business becomes relay infrastructure in someone else's cognitive war
A structural analysis of how well-meaning creators end up amplifying cognitive-warfare payloads they would never endorse — and where the leverage points for defence actually sit.
Executive Summary: the threat is structural recruitment, not bad actors — and the defence starts at your outbound stream
This report is not about deceptive spiritual entrepreneurs operating in bad faith. It is about a structural condition: sincere creators serving as relay nodes in cognitive-warfare campaigns they would not endorse if they could see them clearly.
- Recruitment is structural, not moral. A sincere creator can relay a cognitive payload without ever noticing — the campaign needs their trust and reach, not their consent.
- The spiritual market concentrates ideal relay conditions by design — high trust, high emotional engagement, unverifiable sources as a content norm, AI-assisted propagation with no fact-checking layer.
- Payloads are built to bypass conscious inspection. The host installs them through its own learning machinery, so no external filter can intercept the channel.
- The defensive priority is inverted: gating your own outbound stream — the one boundary a creator fully controls — outperforms every downstream fact-check.
- The deepest leverage is the authorship question — not “is this content true?” but “who authored this pattern?”.
The working analogy is the botnet. A botnet is built from ordinary machines whose owners did nothing worse than open an email or install a free utility. The machine then forwards traffic and amplifies attacks its owner would never knowingly support. The owner’s machine is doing the work; the owner does not know. That is the position this report describes: the spiritual creator is the host, the cognitive payload is the traffic, and the audience is downstream.
Three findings from the peer-reviewed cognitive-warfare literature make the mechanism precise. Campaigns run through a five-phase kill chain in which the people who spread the payload need not be its targets — they are forwarders. Payloads are engineered to bypass conscious inspection, so the relay never notices the recruitment. And the most effective transport for a payload is sincere, well-meaning amplification — no infiltration required.
The defence follows from the mechanism. Counterintelligence in this terrain is not about detecting other people’s payloads — that is the easy half. It is about preventing your own emission: gating your outbound stream before it ships. This report maps where that intervention sits among the system’s leverage points, and why the deeper layers pay so much more than the shallow ones.
Situation: the spiritual market is already mapped terrain in a formalised conflict
Cognitive warfare stopped being a metaphor some time ago. A NATO-sponsored study (du Cluzel, 2020, Cognitive Warfare, NATO Innovation Hub) calls the brain “the battlefield of the 21st century”; the European Defence Fund finances peer-reviewed research into how cognitive campaigns are built and run. The military domain has formalised this faster than the civilian one, which means the civilian side can now borrow a tested vocabulary instead of inventing one.
The spiritual and psychic market matters in this conflict for a structural reason, not a moral one. It concentrates, by design, exactly the conditions the research identifies as ideal campaign terrain: high trust, high emotional engagement, unverifiable sources accepted as a content norm, and — since generative AI entered production use for channelling assistance, oracle interpretation, and audience targeting — fast propagation infrastructure with no fact-checking layer above it.
A creator in this market is therefore not a bystander to cognitive warfare. Structurally, they occupy one of its most valuable positions: a trusted voice with a devoted audience and no institutional verification gate between inbox and output.
Analysis: the payload arrives laundered, and the host’s own learning machinery performs the final install
The clearest model of a cognitive campaign is the Cognitive Cyber Kill Chain from Plaza et al. (2023), a systematic review published at the ARES conference:
| Phase | What happens | Who it touches |
|---|---|---|
| 1 · Reconnaissance | Map the audience’s beliefs, vulnerabilities, media habits | The eventual audience |
| 2 · Preparation | Craft payloads that fit the mapped vulnerabilities | — |
| 3 · Distribution | Seed through controlled channels | Upstream sources |
| 4 · Expansion | Payload travels through people who are not the main target | The creator |
| 5 · Persistence | Repeated exposure locks the effect in | The audience |
The phase that concerns this report is expansion. Plaza’s wording is explicit: the payload disseminates through individuals who need not be the primary target. Their role is to receive and forward. The spiritual creator is rarely the target of a campaign — by the time a payload reaches them, it has been laundered through trusted channels, workshops, and frameworks, and arrives wearing plausible context and emotional resonance. The creator re-encodes it in their own voice, gives it their audience’s trust, and amplifies.
Why does the relay never notice? Deppe and Schaal (2024), analysing NATO’s cognitive-warfare doctrine, surface the load-bearing definition: cognitive warfare uses information to activate subconscious processes, making it difficult for the conscious mind to perceive that a threat is present at all. This is what separates it from propaganda or ordinary persuasion, which want the target to consciously change its mind. Cognitive warfare wants the change to pass unnoticed. The host’s discernment is not failing; the payload is built to route around it.
And the amplification is genuinely sincere. Paziuk et al. (2025), studying the Russia–Ukraine information environment with linguistic-marker detection, document well-meaning followers amplifying a payload — believing they are helping, warning, awakening. Their finding generalises: wherever a community combines high trust, high engagement, and weak verification norms, well-meaning amplification becomes the dominant transport. The community does not need to be infiltrated. It only needs the right shape.
One more structural piece completes the mechanism. A botnet needs command-and-control — something that issues instructions and collects output. In this terrain there is no server to take down. The esoteric tradition calls the equivalent an egregore; our Consciousness Virtualisation Platform model treats it as a stateful container: a self-sustaining collective with emergent survival logic and no single controller. Instructions are not pushed from outside — they are aggregated from the hosts’ own outputs and redistributed back as identity, status, belonging, urgency.
The install step is the subtle part. Repeated, emotionally weighted engagement with those redistributed signals is ordinary learning: what the conscious mind rehearses, it eventually commits to deep-pattern storage. The collective never writes to the host’s patterns directly — the host writes them, using its own internalisation pathway, while believing it is simply recognising what is true. The committed pattern then surfaces as inherited knowing: a feeling of having always known, of receiving something ancient. The host produces content from it, in their own voice, with full sincerity. The instruction has become the host’s truth — and no external boundary can intercept a channel that runs through the host’s own cognition.
Evaluation: the deeper the intervention layer, the more leverage — most defences stop at the surface
Mapping the case onto a tailored iceberg model, with each tier tied to its band of systems-analysis leverage points, shows where defensive effort actually pays. (For readers who work in the esoteric register: the tiers align with the sephirothic structure, noted in the last column — the same map in a different vocabulary.)
| Tier | What you see in this case | Leverage points | Esoteric register |
|---|---|---|---|
| Superficial events | A viral urgency post; one creator amplifying one payload | 10–12 (weak) | Malkuth |
| Intermediate patterns | The same testimony / binary-sorting / urgency stack recurring across brands | 7–9 | Hod · Netzach · Yesod |
| Structural patterns | Community shape: high trust, no verification norm; the collective operating as distributed command-and-control | 4–6 | Chesed · Geburah · Tiphereth |
| Architectural design | The host’s own commit pipeline; “what comes through is valid” as the content-acceptance gate | 2–3 (strong) | Chokmah · Binah |
| Core model | Who authors your deep patterns — the operator, or the collective? | 1 (strongest) | Kether |
Read bottom-up, the table explains why familiar countermeasures underperform. Debunking a single post intervenes at the surface — the system replaces it within days. Media-literacy training works at the pattern tier — useful, but it still assumes conscious inspection catches the payload, which the Deppe finding says is exactly what the payload is built to evade.
The high-leverage tiers are the ones the market never touches. At the structural tier, the reinforcing loop is the thing to break: every sincere amplification strengthens the collective signal, which deepens the next install, which produces more sincere amplification. At the architectural tier, the intervention is the acceptance gate itself — replacing “what comes through is valid” with an inspectable outbound boundary. And at the core sits the authorship question: a mind whose patterns were written by something other than its operator is running someone else’s code, however authentic it feels. That single reframe — from “is this content true?” to “who authored this pattern?” — is worth more than every downstream fact-check combined.
This is also where the value lands for the reader. The map tells you where you are: suffering at the event tier usually traces to an install several tiers deeper — which is why fighting individual posts, or individual gurus, changes so little.
Recommendation: harden the node — gate your outbound stream before it ships
One precondition, then the practice. Hardening requires permission to have been a host. You cannot audit a system you are still defending; the botnet framing at the top of this report is not a courtesy but the prerequisite for the work. Recruited does not mean culpable — the host’s machine was not asked.
The published countermeasure literature concentrates on the audience side: resilience and education for payload consumers. Both are sound. The node side — the creator at risk of becoming relay infrastructure — needs its own two additions, aimed at the architectural tier where the leverage is:
Gate the outbound boundary. Before any piece of content moves outward, five questions:
- Authority structure — is the authority claim verifiable, or testimony from an unfalsifiable source? Borrowed authority is the most reliable payload signature.
- Binary framing — does the content sort the audience into chosen and unchosen, aligned and unaligned, high- and low-vibration?
- Urgency stack — scarcity (closing window, limited seats) combined with escalating commitment?
- Source of source — can the origin be inspected, or is it sealed behind “channelled”, “downloaded”, “transmitted”?
- Exit cost — does engaging make later disengaging harder?
Pattern presence is not adversarial intent — these markers occur in genuine teaching, news, and advocacy. Their presence is a flag for inspection, not a verdict.
Audit your own stream first. The counterintelligence priority is inverted from what intuition suggests: detecting someone else’s payload is the easy half; preventing your own emission is the load-bearing half. Our Quick-Check instrument scores text across dimensions that map onto the five questions above — it is usually pointed at other people’s content, but its highest-value use is on your own drafts, before publication. It is local, transparent, and free.
Start at the gate, then work inward. The outbound boundary is the one piece of this system a single creator fully controls — and every payload that dies there is one the audience never has to survive.
We analyse structure, not people. Every pattern in this report is at the trope level: specific brands, channels, and teachers exist in the wild, but the patterns are what we examine. The patterns are the artefact.