Alberto Fittarelli

🚨 NEW REPORT: We @citizenlab.ca analyze the covert influence ops run by the Israeli firm BlackCore on behalf of the Angolan government. We obtained access to their training documentation. Their claims are shocking - or are they? citizenlab.ca/research/bla... 🧵

reuters.comTaiwan security agency flags rise in Chinese disinformation ahead of local electionsChina spread more than 2.5 million pieces of disputed or false online information targeting Taiwan in the first nine months of this year, the island's top intelligence ‌agency said, accusing Beijing ...

“Beijing often created narratives through official media outlets before amplifying them through ‘online troll armies’ and public relations firms to sow discord among Taiwanese people. It said the tactics ‌included ⁠content farms, AI-generated videos, fake accounts and coordinated comment flooding.”

Alberto Fittarelli reposted

Michela Wrong

@michelawrong.bsky.social

Worth reading the entry on Robert Kabera in this HRW report detailing the extraterritorial dangers faced by Rwandan dissidents. 3 years later, Kabera is found beheaded in Uganda. #F1: this is Rwanda's trademark, not motor racing. www.hrw.org/report/2023/...

hrw.org“Join Us or Die”In the 115-page report, “‘Join Us or Die’: Rwanda’s Extraterritorial Repression,” Human Rights Watch documents a wide array of tactics that, when used together, form a global ecosystem of repression, ...

Alberto Fittarelli reposted

Ron Deibert

@rondeibert.bsky.social

NEW @citizenlab.ca report We uncovered an Israeli firm using online ads to run vast spy operation This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. 45 devices at @aljazeera.com confirmed infected citizenlab.ca/research/how...

citizenlab.caExposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen LabThis is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Ca...

radar.cloudflare.comBot Traffic from AS13238 | Cloudflare RadarBot Traffic trends and insights from AS13238 YANDEX Yandex LLC.

We all have wishful thinking - it’s arguably our main and most dangerous bias. Keeping it in check is a skill that must be trained. Constantly.

Social Media Lab@socialmedialab.ca

So there currently a raging debate on X, Bluesky & other platforms where people are using a drop in Cloudflare's YandexBot traffic to claim that right-wing online engagement is falling. radar.cloudflare.com/bots/as13238... That conclusion doesn't follow from the data.

Alberto Fittarelli reposted

Kris Ruijgrok

@krisruijgrok.bsky.social

Insightful report by CitizenLab @fittarelli.com on how Israeli IO company BlackCore trained government officials in Angola and supervised their IO campaign. citizenlab.ca/research/bla...

citizenlab.caBlackCore’s Influence Operations for Hire - The Citizen LabIn this research note, we examine the digital infrastructure of BlackCore, an Israeli influence-for-hire company. We describe how we identified a BlackCore campaign consisting of a training program pr...

Alberto Fittarelli reposted

Organized Crime and Corruption Reporting Project

@occrp.org

occrp.orgIsraeli Firm May Have Run Angola Influence CampaignCitizen Lab uncovers a 14-week campaign in Angola using AI-generated personas, deceptive posts, and a phantom news site to revamp state messaging.

Israeli Firm May Have Run Angola Influence Campaign www.occrp.org/en/news/isra...

Alberto Fittarelli reposted

Raphael Satter

@raphae.li

citizenlab.caResearch Note: BlackCore’s Influence Operations for Hire - The Citizen LabIn this research note, we examine the digital infrastructure of BlackCore, an Israeli influence-for-hire company. We describe how we identified a BlackCore campaign consisting of a training program pr...

New: @citizenlab.ca's @fittarelli.com, @jsrailton.bsky.social & Maia Scott take a deep dive into the Israeli disinformation firm BlackCore. Among their findings: They accidentally left a spreadsheet detailing their Angola information operations exposed to the web. citizenlab.ca/research/bla...

Then just two weeks ago, Meta released their H2 Adversarial Threat Report, which included disrupting an IO firm from Israel running the *same exact campaigns* that BlackCore was exposed for, including in Angola. Meta doesn't name the firm - but how likely is it to be a pure coincidence?

Key takeaways: ☢️ IO firms are the threat we continue to underestimate. We @citizenlab.ca will keep researching them. 🌍 They are a global thing. Do not think they only are in certain countries. Remember #PAPERWALL? 🤖 AI is already making them harder to detect. Let's make AI harder for them to use.

You probably won't be shocked to hear that one of BlackCore's main avatars in Angola, "Gancho Atalaia", was an AI-generated middle-aged man depicted while pensively reading a tome on "ciência política". Nor that "Dorivaldo Kiala" was not a real Angolan political activist.

But you may be surprised by the engagement levels they were proud to show their clients. Almost 20k reactions, 230 comments, and 90 shares for a single BlackCore's linked Facebook post. And: 630K views, 90% of which by non-followers of the page! The red markings are theirs.

Their proposal was pretty specific and, at times, even technical. It even included modules on how to run advertisement campaigns linked to the covert IO on both Meta's platforms and TikTok.

But what was even more revealing was their final report to the client. In it, BlackCore claimed to have run a continuative 14-week program including the deployment of live assets on the target platforms. It showed examples. And it boasted of its successes.

On a subdomain of their website, BlackCore explicitly advertised *deception* as a service. Dominating the discourse w/avatars? ✅ Getting real people to engage with fakes? ✅ Disrupting dissenting, legitimate narratives? ✅ Are 100K to 1M monthly messages enough? ✅ Oh, and influencer partnerships.

But one more thing particularly stood out. BlackCore offered training programs for clients to run their own local campaigns independently. A source gave us access to documentation from one of them: a training program and its related operations supporting the government of Angola domestically.

We set out to analyze BlackCore's online presence and digital infrastructure, so to understand more about their modus operandi. The amount of publicly available information on their tactics was staggering, and it gave us an unprecedented view on how private covert IO firms truly operate.

theguardian.comFrance accuses Israeli firm of interfering in Scottish elections and targeting SNPCyber agency says BlackCore targeted John Swinney, as well as interfering in New York and French elections

BlackCore positioned itself as an expert actor in the covert influence operations industry. "Influencing perceptions" on behalf of clients is one of their stated goals. But before you're tempted to ask - isn't that what strategic political communications does? Let's move on to their next website.

BlackCore has been exposed before. Notably, in June this year the French government - via their counter-influence operations agency Viginum - accused the Israeli firm of being behind interference in elections in Scotland, New York City, a few African countries, and of course France.

Alberto Fittarelli reposted

The Citizen Lab

@citizenlab.ca

9 Sept

1/ Citizen Lab researchers @noura.bsky.social, Shaila Baran, @mmichae1sen.bsky.social and @sanstis.bsky.social analyze how intersecting identities of gender and sexual orientation shape experiences of digital transnational repression in a special issue of the Journal of Online Trust and Safety.

agentsofinfluence.substack.comSuddenly, Foreign Influence Research Is Good AgainWhat X’s Chinese bot takedown tells us about the counter-disinformation infrastructure we dismantled

3 Sept

The bigger news may be that X still has a Safety team. Glad to hear that. Noting that we @citizenlab.ca notified the platform of multiple proven IO networks at this point (#PRISONBREAK, #JUICYJAM, etc) without receiving any response or seeing any action on them.

Nelly@nellyp.checkfirst.network

X announced that its Safety team had investigated “suspected Chinese inauthentic accounts involved in influence operations” […] a bot farm of approximately 200,000 accounts, including 200 accounts posting about American AI and energy policy. But … agentsofinfluence.substack.com/p/suddenly-f...

politico.comIsraeli PR wants to answer your ChatGPT questionsFrench PR firm Havas Media, which runs the lion’s share of Israel’s FARA-registered foreign influence work in the U.S., appears to have stood up an “institute” aimed at feeding LLMs positive informati...

17 Aug

As it's been said many times by now, the covert influence rush is now no more on individual voters, but on Large Language Models. What better way to scale covert influence up in 2026?

openai.comDisrupting malicious uses of AIOur latest threat report examines how malicious actors combine AI models with websites and social platforms—and what it means for detection and defense.

1/ In Feb 2026, OpenAI reported on a doxxing website, which since 2023 had been exposing Chinese activists and dissidents. Unsurprisingly, the company attributed that activity to Chinese law enforcement. We @citizenlab.ca had been looking at it for a while and have some extra details. 🧵

8/ It's then obvious that a much broader ecosystem of PRC operations exists out there that awaits to be discovered. Most will have zero impact. But it depends on how we calculate impact: is it polluting the web and its AI crawlers? Is it pushing dissidents to silence? Or burning through gov budget?

9/ Thanks to the @citizenlab.ca Senior Research Fellow @lokman.org, also a co-author on our HKLEAKS report, for his contribution in flagging and researching this more recent doxxing campaign.

openai.comDisrupting malicious uses of AIOur latest threat report examines how malicious actors combine AI models with websites and social platforms—and what it means for detection and defense.

6/ A closer look reveals another familiar playbook: that of PAPERWALL. A "local news" site in fact channeling anti-dissident harassment and pro-PRC, unsourced "op-eds", mixed with the unattributed lifting of real articles from actual international media to lend credibility to the whole thing.

citizenlab.caPAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content - The Citizen LabA network of at least 123 websites operated from within the People’s Republic of China while posing as local news outlets in 30 countries across Europe, Asia, and Latin America, disseminates pro-Beiji...

7/ On Gem Herald, "Archie Watson" is the sole author of articles that, when not stolen elsewhere, are labeled as 100% AI-made by verification tools like @pangram.com . The articles often push familiar narratives.

openai.comDisrupting malicious uses of AIOur latest threat report examines how malicious actors combine AI models with websites and social platforms—and what it means for detection and defense.

4/ "Reveal Scum", the contents of which I won't show, followed the HKLEAKS playbook almost to the letter. Completely anonymous, with good operational security. A couple of generic Wordpress usernames ("Autumn" and the Chinese equivalent for "admin"). Anonymous hosting on US and Canada-based infra.

openai.comDisrupting malicious uses of AIOur latest threat report examines how malicious actors combine AI models with websites and social platforms—and what it means for detection and defense.

5/ But like for HKLEAKS, they made mistakes. For about a month and a half in 2023, the website resolved to the same IP address as just 1 domain. Gem Herald [WARNING: open with caution] claims to offer Australian audiences "Real Aussie news. No fluff." It's also flagged for malware by Maltrail:

citizenlab.caBeautiful Bauhinia: "HKLeaks" – The Use of Covert and Overt Online Harassment Tactics to Repress 2019 Hong Kong Protests - The Citizen LabIn August 2019 a wave of websites and social media channels, called “HKLEAKS,” began “doxxing” the identities and personal information of pro-democracy activists in Hong Kong. While the creators of th...

2/ The domain revealscum[.]com was registered in 2023 and became active almost immediately. It followed a playbook we have already described that same year in our report on HKLEAKS. Exposing as much private information as possible, framing it in the most damaging way for the target.

3/ OpenAI identified it as part of a much larger effort to target dissidents (and the Japanese PM), revealing the enormity of its scale in terms of human and technological resources deployed by the actors.

occrp.org‘I terminated this channel’: Inside the Fake Copyright Racket Silencing News OutletsHired hands in an underground takedown market are charging up to $5,000 to scrub reporting from social media by filing fake copyright claims.

6 Aug

As I mention in my comment to this investigation by @jdowsea.bsky.social and @occrp.org, coordinated false reporting is an almost invisible, and therefore incredibly underestimated censorship threat to civil society - and to anyone bothering those who will pay for the service.

Organized Crime and Corruption Reporting Project@occrp.org

‘I terminated this channel’: Inside the Fake Copyright Racket Silencing News Outlets www.occrp.org/en/news/i-te...

Alberto Fittarelli reposted

The Citizen Lab

@citizenlab.ca

3 July

1/ NEW REPORT: Former Member of the European Parliament Stelios Kouloglou was repeatedly hacked with NSO Group’s Pegasus spyware while serving on the EU committee investigating Pegasus and other spyware abuses in Europe. Full report: citizenlab.ca/research/mem...

citizenlab.caEspionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus - The Citizen LabWe found that former Member of the European Parliament Stelios Kouloglou was hacked with Pegasus spyware while serving on the PEGA committee, which investigated Pegasus and other spyware abuses in Eur...

Alberto Fittarelli reposted

Ron Deibert

@rondeibert.bsky.social

3 July

NEW @citizenlab.ca report: Member of 🇪🇺 Euro Parliamentary committee (#PEGA) tasked with investigating spyware abuses himself hacked with Pegasus spyware 👇 citizenlab.ca/research/mem...

Alberto Fittarelli reposted

Alan Jagolinzer

@jagolinzer.bsky.social

27 June

Replying to @jagolinzer.bsky.social

• a cowardice problem where people like you and me, who have sworn oaths to uphold existing laws, have become unwilling to intervene and prevent blatant criminal actions because we fear losing status, losing money, being harassed, or emotional and physical abuse to ourselves or our families.” (8/8)

redbridgeintel.substack.comCall It What It Is: Foreign InterferenceIf a hostile state ran this sort of operation to swing our vote, we'd call it foreign interference. It's time we did.

19 June

“If a hostile state ran AI-generated sockpuppet networks to swing our politics, we would call it foreign interference and respond with the full machinery of state.” So let’s call it precisely that.

bellingcat.comTracing Digital Links Between Viory and Ruptly - bellingcatBellingcat found mulitple links between the digital infrastructure of Viory and Ruptly news agency, a branch of Russia Today.

5 June

Some great digital sleuthing here.

Bellingcat@bellingcat.com

NEW: @elisethomas.bsky.social reveals multiple links between Viory, a video news agency supplying national press agencies across Africa, Asia and the Middle East and Ruptly news agency - a branch of sanctioned Russian propaganda outlet Russia Today. www.bellingcat.com/news/2026/06...

Alberto Fittarelli reposted

Kerim Friedman 傅可恩

@kerim.one

3 June 2025

On this June 4th, wishing for a world with more people willing to stand in front of the tanks, and less who are willing to drive them.

Alberto Fittarelli reposted

The Citizen Lab

@citizenlab.ca

29 May

Doctoral fellow Swantje Lange @swantjelan.bsky.social spoke with the Hasso Plattner Institut @hpi.bsky.social about sophisticated surveillance campaigns being used to exploit mobile networks, sharing that “the mobile network is highly opaque and extremely complex.” hpi.de/en/article/r...

hpi.deResearchers uncover espionage in mobile networksLike a spy movie: Researchers from HPI and the University of Toronto reveal how surveillance actors exploit mobile networks to track people worldwide.