Source: securityboulevard.com – Author: Nisos
Nisos
Tracking Illegal Pharmaceutical Sales on Social Media
Nisos continuously monitors mainstream and alternative social media platforms as well as other online communities for individuals and networks conducting illegal activities or violating platform terms of service (TOS). In fostering communication and community among their massive user bases, social media platforms can inadvertently become attractive markets for threat actors looking to exploit them to sell highly sought-after pharmaceuticals. Nisos tracks pharmaceutical sellers’ evolving tactics, techniques, and procedures (TTPs) for soliciting buyers while maintaining anonymity and avoiding automated content moderation.
As of February 17, 2024, the European Union’s Digital Services Act (DSA) went into full effect. The DSA introduced new obligations for social media companies to curb illegal activity. Among other stipulations, social media companies are now responsible for online advertising, working with “trusted flaggers” to remove illegal content, and verifying the identities of third-party sellers to ensure products are not stolen or illegal.
Keeping up with these requirements as nefarious operators continuously change their tactics can be costly and time-consuming for Trust and Safety (T&S) teams. Nisos leverages our cross-platform visibility and analytical expertise to provide comprehensive reporting on TTPs and uproot criminal networks plaguing platform safety.
Cross-Platform Tactics, Techniques, and Procedures
Nisos identified operators (see source 1 in appendix) using common TTPs across traditional social media platforms:
Avoiding on-platform overt advertising and sales by providing off-platform redirects to messaging apps, including Telegram, Snapchat, and Wickr.
Promoting pharmaceuticals available without a prescription and directing potential buyers to off-platform domains for purchases through illegitimate online pharmacies.
The use of coordinated inauthentic behavior (CIB) to attract potential buyers.
Sellers in the same network operating accounts across multiple social media platforms are likely to reach a wider audience.
Use of common drug names in posted content and account information, as drug names are searchable across the majority of traditional social media platforms.
Various prescription drugs available for purchase, indicating the sellers are likely not offering their own prescription medication.
Off-Platform Redirects to Messaging Apps
When marketing prescription drugs on a specific traditional social media platform, sellers are very likely negotiating the actual sales off platform based on off-platform redirects to various messaging apps and the lack of pricing information on platform. The most common off-platform redirects included Telegram, Snapchat, Wickr, and email. Nisos assesses operators provide off-platform redirects to avoid content moderation and prevent account suspension for violating platforms’ TOS.
Graphic 1: Sample of pharmaceutical-related social media accounts’ posts
directing potential buyers off platform, where they very likely conduct drug transactions.
Graphics 2 and 3: X account directs users to the Telegram channel
Psychedelic store 420 (dyzxand). (See source 2 in appendix)
Nisos observed the term “teleplug,” often displayed as “tele🔌,” short for “Telegram plug.” “Plug” is a slang term describing a high-level drug dealer who deals in larger quantities and a wide variety of pharmaceuticals and illicit substances, alluding to the dealer’s connections. Social media content promoting Telegram accounts or channels selling prescription drugs frequently uses the hashtags teleplug, tele, plug, and/or pluggedin in combination with prescription drug slang or nicknames. The content frequently features photos or videos of drugs, delivery arrival videos from customers, and customer testimonials verifying the seller’s completion of orders. The most common pharmaceuticals associated with “teleplug” were Xanax, codeine, and OxyContin.
Graphics 4 and 5: Video featuring the “teleplug” emoji symbol advertising the Telegram channel
@strxghtjxcket (top). The video features a positive feedback message regarding a successful
Adderall delivery. The video poster used hashtags associated with teleplug and their Telegram channel (bottom).
Illegitimate Online Pharmacies
Nisos discovered accounts self-identifying as pharmacies and promoting the sale of various pharmaceuticals. Nisos identified these accounts by searching variations and combinations of pharmacy, available and online, alongside the pharmaceutical of interest. These terms frequently appear within accounts’ display names, usernames, and content captions. The pharmacy accounts direct users off platform—typically to domains with display names resembling their usernames—to purchase the promoted pharmaceuticals without a prescription. Many of these illegitimate pharmacies are located worldwide and are not limited to any specific region.
To obtain the complete research report, including endnotes, please click the button below.
About Nisos®
Nisos is the Managed Intelligence Company. We are a trusted digital investigations partner, specializing in unmasking threats to protect people, organizations, and their digital ecosystems in the commercial and public sectors. Our open source intelligence services help security, intelligence, legal, and trust and safety teams make critical decisions, impose real world consequences, and increase adversary costs. For more information, visit: https://www.nisos.com.
The post Tracking Illegal Pharmaceutical Sales on Social Media appeared first on Nisos by Nisos
*** This is a Security Bloggers Network syndicated blog from Nisos authored by Nisos. Read the original post at: https://www.nisos.com/blog/tracking-illegal-pharma-online-sales/
Original Post URL: https://securityboulevard.com/2024/05/tracking-illegal-pharmaceutical-sales-on-social-media/
Category & Tags: Security Bloggers Network,Blog – Security Bloggers Network,Blog
