Hello again from the Open Measures team. We’ve had a busy August, pushing new features to our platform and working on some exciting research. The big news is that our company was acquired by Everbridge, an industry-leading critical event management platform, and we’re very excited about it. You can learn more about that in the announcement we shared yesterday.

Subscribe now

Here’s a look back at the research articles we published in August. We’ll keep this one short and sweet.

What We’re Reading:

• The rise and fall of Automata (Decoherence Media)

• AI-generated Costco employees got over 100 million views on Facebook and Instagram (Indicator)

• Subtlefakes: Slightly Altered Nonconsensual AI Images Are Taking Over X (404 Media)

• Paid actors, AI writing: How a new kind of video business cashed in on America’s divided politics (Semafor)

Before you go…

• Open Measures was cited in news articles from NPR and Decoherence Media. Be sure to check those out!

• Rest in peace to music legend Dolly Parton.

Open Measures is joining Everbridge, an industry-leading critical event management platform trusted by thousands of organizations worldwide, to provide security, safety, and communication teams a more complete picture of the threats and narratives that matter to them most.

When Open Measures was founded in 2021, with grant funding from the Mozilla Foundation, Start.coop, and Google Jigsaw, our team came together to solve a problem: disinformation and other online harms tend to first take shape on the unmoderated internet – on Telegram channels, fringe forums, and alternative platforms – long before the mainstream notices. We built a solution to make that space visible, designed for the researchers, press desks, enterprises, and civil society organizations that hoped to hold the otherwise hidden actors there accountable.

With this acquisition, we will have even more resources to deliver on our mission. Here’s why:

Our reach and impact will expand exponentially. Everbridge works with organizations managing critical events at a scale we couldn’t reach alone. Folding our social risk intelligence platform into that ecosystem means more organizations get earlier warnings about the narratives and coordinated activities that often precede real-world harm, which has always been important to us.

Our research – supporting journalists, academic researchers, and corporate teams alike – will continue without interruption. Over the years, Open Measures has been cited in NPR, The New York Times, the Washington Post, Bloomberg, The Guardian, and our findings have aided the work of organizations like ProPublica, Bellingcat, and Bridging Divides Initiative as well as researchers at Oxford and NYU. To preserve the trust our researchers have built, and with Everbridge’s enthusiastic support, we’ll continue producing the same quality reporting and coverage we always have.

The entire team will remain the same. It was critical to us that our entire team – from research to engineering to operations, international contractors to executives – would be retained through acquisition. Every member of our team remains on board and energized to continue this work.

Open Measures will still be Open Measures. We’ll continue our work developing cutting-edge software and pioneering research with the same branding and feel that the industry is used to. We’ll maintain our identity in all that we do (including our much-acclaimed merch – IYKYK).

After many conversations with Everbridge, the deal we’ve arrived at is designed to ensure that our mission will outlive our acquisition.

Before closing, we’d like to reflect on some of the work that we’ve been most proud of to date:

• Our research into 4chan’s “Adult Requests” board – one of the internet’s largest and fastest-growing venues for nonconsensual AI-generated explicit imagery – helped spark wider scrutiny and culminated in its coming offline. The board has stayed offline for months with no sign of returning.

• The New Arab partnered with Open Measures’ researchers and leveraged our platform to analyze roughly 4.4 million Telegram posts across 86 channels, uncovering how Israeli settler militias in the West Bank raised more than $3.75 million through nonprofits since October 2023. That reporting helped lead to the UK, Canada, Norway, New Zealand, and Australia sanctioning two of the named organizations in June 2026, and the investigation was later shortlisted for a 2025 Amnesty Media Award.

• Our 2026 AI Threat Landscape Report mapped how AI-enabled cybercrime moves across platforms, finding that 4chan serves as a discovery hub generating 300–350 related posts per day, while Discord hosts invite-only R&D servers, and Telegram increasingly functions as a commercialization layer for these tools.

• ProPublica and FRONTLINE’s investigation into the neo-Nazi Terrorgram network relied on our platform to help identify the coordinated and dangerous online activity tied to the network.

From our entire team: thank you to everyone who chose us to help with their hardest problems, believed in our platform, and trusted a small, worker-owned company to punch above its weight. As Open Measures enters this new chapter, with the same team and platform organizations have come to depend on, our work will continue.

Subscribe now

You can read that story, below:

Subscribe now

The WNBA has seen unprecedented growth in recent years, credited in large part to fans’ excitement for rising star players like Indiana Fever guard Caitlin Clark and Atlanta Dream forward Angel Reese. In 2025, the WNBA drew record-breaking attendance and television viewership, the highest that professional women’s basketball has seen in the United States since the league’s inception.

But the WNBA’s growth has also come at a cost to its players, who have reported being increasingly targeted by online commenters’ bigoted hate, personal harassment, and violent threats. The problem has grown so severe that the WNBA launched a dedicated task force meant to address the issue, which has implemented new security protocols, online threat-monitoring programs, and mental health resources for teams and players.

WNBA officials and many top players, like Clark, have repeatedly condemned threats made against members of their league, and have publicly denounced those who have sought to hijack public conversation to promote hateful and demeaning rhetoric. But those remarks have done little to quiet toxic commentary, which has devolved into a “rinse-and-repeat drama” over the summer.

Hyperpartisan News Blogs Drive Divisive Rhetoric Around WNBA

Conservative political figures have intensified their focus on the WNBA this summer, leveraging drama in the league to promote their movements’ longstanding and divisive “culture war” narratives targeting minority groups. Since June, largely egged on by hyperpartisan media, their rhetoric has grown more aggressive and earned buy-in from Republican lawmakers.

We used our platform’s Timeline tool to search for posts mentioning the WNBA across nine platforms dominated by right-wing political communities since May 24, finding that the daily volume of posts we identified per day drastically increased throughout the summer.

Between May 24 and Aug. 24, users on those nine platforms shared more than 14,000 posts mentioning the league. Over the three-month period we analyzed:

• May 24 to June 24: 536 posts (~4% of total posts)

• June 25 to July 24: 3,446 posts (~24% of total posts)

• July 25 to Aug. 24: 10,125 posts (~72% of total posts)

We identified a similar trend in the number of comments shared to websites that use Disqus, the web’s most-popular third party commenting and discussion platform. Between May 24 and Aug. 24, more than 46,000 comments on Disqus-enabled sites mentioned the WNBA.

Using our platform’s Activity tool, we found that the vast majority of Disqus comments mentioning the WNBA during our analysis period were shared on right-wing political news blogs, which ran a slew of inflammatory stories about the league this summer.

Of the 15 sites where the highest volumes of Disqus comments mentioning the WNBA appeared, 10 were hyperpartisan political news blogs. Together, those 10 publishers saw more than 27,000 comments – more than 58% of all Disqus comments we identified.

Initial Narratives Targeting WNBA Alleged Anti-White Racism

As seen in the Timeline chart above, discussion of the WNBA across platforms that harbor right-wing political communities began to surge in late June, as hyperpartisan media outlets ran stories highlighting fouls that Black WNBA players committed against Clark, who is white, and allegations that referees were calling a disproportionate number of fouls against Clark during games. Political actors cited those stories to fuel narratives suggesting the WNBA was racist against white people and that Clark was being targeted on the court on the basis of her race.

Those narratives surged through right-wing communities after June 25, when Phoenix Mercury forward Alyssa Thomas made contact with Clark’s throat during a game. The collision, which Thomas called a “complete accident,” was subsequently upgraded to a Flagrant Foul 2 penalty and resulted in a one-game suspension for Thomas.

In the following days on the platforms we analyzed, we identified thousands of users sharing disparaging remarks about the WNBA, Thomas, and referees. Using Research Assistant to summarize dominant themes across more than 5,500 posts in the week after the foul occurred, we found that the dominant narratives that emerged from the incident centered on racial grievances and prejudices against LGBTQ+ people.

Example posts promoting these narratives include a June 27 post from right-wing radio host Wayne Allyn Root on Truth Social:

Wow is there anti white hate and racism in WNBA. These black ladies hate a white lady superstar. They openly beat the crap out of her in front of tv cameras- and her teammates do nothing. Because she is white. This is allowed in America? Disgusting!

A June 25 comment shared on an article on the right-wing news outlet Townhall, via Disqus:

Black lesbians are black first, violent second and so rabidly racist, they cannot embrace or accept the only positive, real basketball player to hit the WNBA. Now, the WNBA has been exposed for what it is, a racist schoolyard brawl, where the blacks throw punches and elbows every chance they get, hoping to get rid of the white girl. Talk about a problem race, who has exhibited 27 years of failure on their own, and are trying to regain their failure these past two years by destroying Caitlin Clark.

And a June 25 comment shared on an article from the far-right news outlet Breitbart News, via Disqus:

The WNBA commissioner, an lgbt, has told head coaches to have goons on their teams harass and foul Clark incessantly, and try to injure her.

Then the commissioner laid an edict to the refs. to look away, don’t call it, LIE that they didn’t see it.

[...]

The league is made up of YES it’s true...men(trans players), lgbt and low IQ women.

They can’t have a straight white christian girl playing at a high level and is THE MOST popular player in the league.

Weeks later, a group of 11 GOP lawmakers sent a letter to the WNBA expressing concern that fouls against Clark – which they described as “attacks” – were “racially motivated,” adding that the league’s failure to protect Clark may have violated federal civil rights laws.

After fouling Clark, Thomas said she received death threats and was accosted with racial slurs; she also criticized WNBA commissioner Cathy Engelbert for not doing more to address threats players receive. Indiana Fever coach Stephanie White called the abuse hurled at Thomas “absolutely unacceptable,” adding that she believed most of the toxicity surrounding the WNBA wasn’t coming from its fans, but rather from online communities pushing “divisive, hateful narratives.”

Sophie Cunningham’s Anti-Transgender Comments Ignited Weeks of Partisan ‘Culture War’ Attacks on WNBA

Racialized commentary surrounding Clark and the WNBA persisted in right-wing media for weeks after the June 25 foul that set it off. Then, in late-July, one of Clark’s Indiana Fever teammates thrust the league into the crosshairs of contemporary right-wing media’s most excitable culture wars: transgender athletes competing in women’s sports.

On July 21, ESPN published a lengthy profile of Indiana Fever guard Sophie Cunningham, which quoted her voiced opposition to allowing transgender athletes to compete in women’s sports. Cunningham explained she wanted to “protect young girls in a locker room, or young girls in sport who shouldn’t have to go against biological men.”

Cunningham’s remarks, which echoed false anti-LGBTQ+ movement talking points that seek to portray transgender people as sexual predators who target children, elicited anger across the WNBA – a league that currently has no transgender players. Her comments, and their negative reactions, dragged the WNBA into the crosshairs of right-wing media’s longstanding anti-LGBTQ+ “outrage machine.”

Conservative political activists rallied to support Cunningham as she drew pushback from WNBA colleagues and the league’s fans. The Trump Administration lauded her in social media posts and public statements, anti-transgender activists like Riley Gaines appeared at Indiana Fever games, and former NBA players Enes Kanter Freedom and Royce White cynically declared they were women and would be submitting themselves for the 2027 WNBA draft.

Across the platforms we analyzed, right-wing communities lauded Cunningham as a heroic figure, and framed criticism of her comments as attacks on “truth.” In subsequent weeks, we also saw those communities incorporate Cunningham into their prior narratives alleging the WNBA was racist against white people, following fouls that the league’s Black players committed against Cunningham during games. Other prominent narratives disparaged Cunningham’s critics, praised right-wing activists who rallied to support her at games, and hyped the former NBA players who declared they were women who wanted to play in the WNBA.

The highest volume of posts related to Cunningham’s remarks surrounded an Aug. 12 meeting where a WNBA task force met to discuss the increased hate and harassment plaguing the league since it became an unwilling focal point in right-wing political commentary disparaging transgender people. Conservative social media personalities falsely claimed the meeting was meant to determine “what a woman is” and lambasted the league when it did not issue a statement along those lines.

Then, in mid-August, the r/WNBA subreddit banned new posts about Cunningham that were unrelated to basketball and filtered out new posts from users who had not been active in the community before. In an Aug. 16 post, moderators explained the rules were in place [sic] “so the subreddit will not be over-ran with trolls or brigaded.” Across several alternative platforms, right-wing communities cited the decision as proof of the league’s supposed political bias and framed it as a censorship issue.

Over the most recent month of our analysis period, we saw that right-wing news outlets and the communities that read them latched on to an array of inflammatory narratives surrounding the WNBA and transgender athletes, keeping the narrative active for several weeks. At the time of writing, anti-WNBA narratives are still circulating in hyperpartisan media and online communities – with more staying power than many outrage cycles we’ve previously analyzed.

WNBA Express Frustration with WNBA’s Response to Attacks

As the WNBA has attempted to respond to the months-long outrage campaign targeting the league this summer, users on platforms that harbor large left-wing political communities criticized its handling of the situation.

Some of the criticisms faulted WNBA commissioner Engelbert, as seen in this July 30 post on BlueSky:

If we’re talking about this moment in America where so many supposed-leaders (organizational, electoral, cultural, etc.) have failed to rise to the occasion, we shouldn’t just focus our ire on politicians!

Cathy Engelbert is a consultant masquerading as a commissioner.

Other users faulted the league for what they perceived as efforts to pacify its right-wing critics, as seen in this Aug. 8 post on Bluesky:

Pretty wild that the WNBA is deciding apparently to squander all the good will it built with the community who has spent an obscene amount of money on tickets and merch and formed the base of their success. Even if you don’t give a fuck about human rights (🫠), this is just a bad business decision!!!

We also saw hundreds of posts from Bluesky users who expressed resentment that the WNBA was being forced to deal with these sorts of controversies to begin with. A Sept. 30 post from a Bluesky user who said they were a fan of the league read:

Been a fan of the WNBA for years, and what the racists and homophobic/anti-trans bigots have done to the league and the attention it gets the last three years is so fucked. They are trying to steal our fun and fuck them all for it.

And an Aug. 14 post on Bluesky read:

I HATE it when people say “the culture wars” or “the discourse” are ruining the WNBA. BE PRECISE. Right-wing fascists are introducing misogyny and bigotry through their narratives and demands, in an effort to delegitimize an organization full of popular black women who vocally champion inclusivity.

Our Take

Women’s professional sports are experiencing a global surge, attracting new audiences, opportunities, and resources for teams and athletes. But that growth has also elicited previously unseen amounts of online hate and harassment against players, who typically have fewer resources available to detect and mitigate threats than men’s sports teams do.

Much of the controversy surrounding the WNBA this summer has revolved around longstanding “culture war” tropes employed by right-wing media and political figures to disparage minority groups, and that rhetoric has predictably elicited torrents of online hate against its players. And while the WNBA and its biggest stars have attempted to distance themselves from bad-faith critics, Cunningham’s anti-transgender comments effectively dissolved whatever barrier separated them.

Online threats against athletes – particularly women, racial minorities, and LGBTQ+ players – are a growing issue in professional sports. Open Measures’ platform is designed to assist monitoring and analysis across dozens of alternative platforms where online harms can arise, and our team will continue to monitor for threats as the landscape evolves.

Subscribe now

Subscribe now

What is Disqus?

Disqus, launched in 2007, is the internet’s largest third-party commenting and discussion platform, providing online publishers with simple tools for facilitating and managing audience engagement on their websites. According to Disqus’ company’s website, hundreds of thousands of websites use the platform and its users share tens of millions of posts each month.

The platform’s design enables online publishers to host comment sections on their sites without having to develop proprietary web infrastructure and data management systems to do so. Disqus also networks all publishers using its platform together, enabling users to create and use a single account to engage with content on many publishers.

Throughout its lifespan, Disqus has faced criticism for tracking its users and mishandling their data. Journalists and researchers have also noted that Disqus has struggled to enforce its rules regarding toxic content – particularly hate speech – and have suggested that hyperpartisan right-wing publishers that elicit high volumes of such material wield outsized influence over the platform.

Open Measures’ Disqus Coverage

Open Measures added Disqus comments to our collections in February. Due to the platform’s infrastructure, we are able to collect comments shared across all Disqus-enabled websites, enabling our users to monitor and analyze activity across thousands of communities in a single spot.

Our Disqus collection contains approximately 270 million searchable comments at the time of writing, it remains a lesser-understood dataset with unique advantages and use cases for threat intelligence, brand monitoring, and trust and safety teams.

Unique Features and Use Cases

Disqus serves as web infrastructure for many online publishers in alt-media, and platform users use the same account to comment on any Disqus-enabled publisher. In Open Measures’ platform, this makes it possible to trace a user’s activity and comment history across many different publishers, which is useful for a variety of different use cases:

Trust and Safety

• Identifying coordinated campaigns: Using the content of one identified spam post as a query, return all other accounts that posted it and on which publishers – or search for commonly shared URLs to trace spam campaigns executed in comment sections.

Threat Intelligence

• Account Clustering: Identify clusters of accounts created at the same time to expose coordinated activity.

• Identify Emerging Narratives: Analyze comment sections with infrequent moderation to identify emerging narratives before they cross into the mainstream.

Brand and Trend Monitoring

• Sentiment Analysis: Analyze specific audience reactions to any number of news topics across publishers; analyze upvotes or downvotes for additional texture.

• Visualize Narrative Spread: Use time-stamps and user-specific metadata to determine when, where, and how narratives spread across publishers.

Crafting Disqus Search Queries

As with our other sources, Disqus data is searchable in Activity, Discover, and Timeline. For those using our Pro API or Advanced Search, we’ve included a list of key terms for Disqus data below for ease of reference.

disqus: Platform endpoint

author.username: Username

author.name: Display name

content: Post content

url: Original comment URL

forum.url: Site URL

forum.name: Site name

For additional terms and details on query syntax, see the Standard Schema and Endpoints pages in our full documentation (please note that in Disqus queries, “forums” correspond to websites, “threads” correspond to articles, and “posts” correspond to comments).

Our Take

Comment sections on news sites have historically been an under-observed OSINT surface, as each site typically needed to be monitored individually. Open Measures’ Disqus coverage exposes much more of this hidden surface, making it searchable alongside nearly 30 other alternative platform sources.

Heading into the midterms, election officials have reported facing increasing threats with fewer federal resources to defend against them than in recent years. Open Measures will continue to support threat intelligence teams defending our elections, providing access to early threat indicators from the fringes before they materialize.

To better understand how your team might use Disqus data in your work, feel free to book a demo or subscribe to our newsletter for investigations conducted with Disqus data.

A new article and radio segment from NPR’s All Things Considered traces how Andrew Tate spent years cultivating relationships with Trump-world figures and the broader MAGA movement — and how those ties are now being strained as Tate and his brother Tristan fight extradition to the U.K. on criminal charges including rape and human trafficking.

NPR turned to Open Measures senior researcher Jared Holt to explain why Tate became such an appealing figure to Republican politicians and influencers in the first place, and what his current predicament says about the durability of those alliances:

“The Tate brothers have friends on Capitol Hill,” Jared Holt, senior researcher at Open Measures, tells NPR. “There’s people in the Trump administration that have cozied up to them before, people in the MAGA movement that have cozied up to them before, certainly.”

Holt also pointed to the transactional logic behind that support:

To Trump and other politicians, Holt says, Tate is a compelling figure because he offers access to a massive and energetic fanbase dominated by a desirable demographic: young men. And, Holt adds, some of the views Tate expresses align with Trump and his camp.

“It’s like, here’s a couple guys who are promoting the kind of ideals of hypermasculinity and machismo that we would like to promote,” Holt says. “And they seem politically friendly, politically supportive of us. And they have this massive online audience.”

Check out the full article and listen to the segment, here:

NPR

4chan, an imageboard platform where users are anonymous, opened its “Adult Requests” board (also referred to by its URL suffix, “r”) in 2004 as a venue for its users to discuss pornography and request help identifying the sources of sexually explicit images they shared. But in recent years, users on the board grew almost singularly focused on producing and trading synthetic, non-consensual intimate imagery (NCII) created by self-described “wizards” using generative artificial intelligence software.

Subscribe now

Earlier this year, Open Measures published new research exposing the severity of abuse taking place on Adult Requests as the forum was becoming one of the most-active online venues for synthetic NCII – colloquially known as “deepfake porn.” Our findings drove broader recognition of the imageboard’s as a major node in the online ecosystem surrounding NCII abuse and raised questions about how laws against such content could be enforced on smaller platforms like 4chan.

4chan’s site administrators quietly shut down Adult Requests on May 21. Since then, its URL has returned an error page reading: “File not found.” As far as we’re aware, 4chan staff have not publicly explained why they closed Adult Requests or said whether they ever intend to reopen the board.

Adult Requests went dark the same day WIRED published an article highlighting the prevalence of AI-generated nude imagery on the board, and two days after the TAKE IT DOWN Act took effect in the United States – where 4chan is based – criminalizing the publication of NCII and imposing financial penalties on platforms that fail to remove it within 48 hours of receiving a takedown request.

‘It’s Only Fair’: 4chan Users Question Removal of ‘Adult Requests’ and Seek Refuge on Other Boards

The sudden disappearance of Adult Requests has gone mostly unnoticed by 4chan users, but some have shared posts questioning the board’s removal, expressing their desire to migrate their activities onto the site’s other boards.

On May 23, two days after Adult Request vanished, a user posted a thread on the site’s “Very Important Posts” (“vip”) board, where only users who pay for an annual “4chan Pass” can post, asking what happened. The thread only elicited a handful of replies, including a June 17 post that read, in part:

4chan follows US law, and legislation has made AI pornography edits (which was like 90%) of /r/ illegal. There was also a news article highlighting this. And it was taken down shortly after.

On the site’s “Adult GIF” (“gif”) board, which is dedicated to sexually explicit animated images and short videos, users expressed confusion about where the community that frequented Adult Requests had gone. A July 7 post on the Adult GIF board read:

Adult requests board used to be good with new content. No idea where everyone went now

Another post, shared on July 8, read:

kinda unrelated but, since this is an AI thread: what the ever loving fuck happened to the adult requests board? Was there any legal problems with it? Last I checked there were a lot of guys doing threads of AIs nudes of just about any chick they had a photo of. Was [its removal] because of it? Have these threads moved to another board/site?

Another post to Adult GIF, shared on July 9, argued that 4chan users should be able to solicit synthetic NCII on other boards since Adult Requests was unavailable:

Due to the fact that /r/ is gone, I feel like it’s only fair that we’re allowed to make requests on other boards, since we don’t have a dedicated Adult Requests board anymore.

On June 2, a user posting on 4chan’s “Worksafe Requests” (“wsr”) board – a non-explicit version of Adult Requests – said that requests for AI deepfakes should be directed to the site’s “Random” (“b”) board. The Random board has long been saturated with pornography and 4chan lists it among the “NSFW” (not safe for work) boards in its site directory.

Searching for Adult Requests’ ‘Wizards’ on Other Boards

In its final years, most activity on Adult Requests revolved around threads where users submitted images of other individuals (mostly women and girls) and requested synthetic NCII that depicted them. The board’s users adoringly referred to those who fulfilled requests as “wizards.”

That call-and-response dynamic effectively systematized the production of synthetic NCII on Adult Requests, setting it apart from other 4chan boards we observed that contained some similar material.

To assess whether this style of exchange migrated to another part of 4chan after Adult Requests closed on May 21, Open Measures searched for posts that mentioned a variation of “wizard” and at least one variation of a word signaling a request (like “please” or “help”) or a term associated with AI deepfakes (like “nudify”). We limited our search to 4chan’s 18 NSFW boards.

More than 1,100 posts shared on 4chan’s NSFW boards since Adult Requests closed matched our search query. Using our Activity tool to count how many appeared on each of the 18 boards, we saw that more than half appeared on Random (“b”) – a board that is ostensibly open to all kinds of content, but which is mostly saturated with pornography.

Requests for Synthetic NCII on 4chan’s ‘Random’ and ‘Cams & Meetups’ Boards

We used our platform’s Discover tool to take a closer look at the posts our search identified on Random, and found hundreds of posts that appeared to mirror the sorts of requests we previously observed on Adult Requests, as seen in this July 27 post to the board:

Can any wiz help me nudify this whore? She’s got big fat titties that I’ve been itching to see like you wouldn’t believe.

The second-highest concentration of posts matching our query appeared on 4chan’s “Cams & Meetups” (“soc”) board, which serves as a venue for users to seek in-person and online connections related to sex. Similar to posts we identified on the Random board, we saw users on Cams & Meetups seeking to connect with “wizards” who could produce synthetic NCII. We also identified posts from self-identified “wizards” offering to create such material for others, as in this July 28 post to the board:

Comfyui ai wizard. Send a pic of your mom, sister, daughter 18+ and a clip for a face swap.

Many of the posts matching our query on other NSFW boards were false positives, reflecting the fact that communities on 4chan assign non-NCII related meaning to the term “wizard.”

4chan Moderators May Have Increased Enforcement Against Synthetic NCII

Threads on 4chan are automatically deleted to make way for new ones, meaning content on the site is inherently temporary – and especially so on boards that see higher volumes of activity. But in several instances during our research, we identified requests for synthetic NCII in active threads on the site that suddenly became unavailable – sometimes minutes after the requesting posts were made.

Using our platform’s Timeline tool to compare the number of posts matching our search query on Adult Requests, Random, and Cams & Meetups since Feb. 5, we did not see a meaningful shift in activity on Random or Cams & Meetups after the removal of Adult Requests. In fact, the daily volume of posts requesting synthetic NCII from “wizards” on Random and Cams & Meetups actually appeared to decrease, aside from a few days of isolated activity spikes.

This might suggest that 4chan’s moderators are taking down threads requesting synthetic NCII at a higher rate than before they closed Adult Requests, signaling a possible shift in the site’s approach to the issue.

Our Take

Adult Requests was just one of a growing number of online venues for requesting, producing, and trading AI-generated NCII. As regulators around the world enact laws criminalizing the publication of NCII, it appears 4chan may be shifting its approach to policing such content.

While our findings signal that at least some amount of the abuse Adult Request became notable for has also appeared on other 4chan boards, they do not suggest that users of the board have simply relocated to another spot on the site. It’s likely that former Adult Request users, including the “wizards,” have migrated to communities beyond 4chan. Open Measures will continue looking for signals of where they may be headed next.

Additionally, if you can help us understand what might be going on with this keffiyeh-wrapped Cybertruck we saw in the city, please reach out. We can’t stop thinking about it.

Anyway… here’s a look back at the research we published in July.

What We’re Reading:

• The MAGA Media Machine Is Fracturing (The New York Times)

• Hostility Against Local Officials Is Continuing at Elevated Levels in 2026, Disproportionately Impacting Women, Minority, and New Officeholders (Bridging Divides Initiative)

• Instant Access to Trump’s Thoughts Now Costs $100,000 a Month (Mother Jones)

• Google Earth’s New AI Lets Anyone Fabricate Completely Bullshit Satellite Images (404 Media)

Before you go…

• Recent news reports about MAGA figures (including a teleprompter operator) placing wagers on “prediction market” platforms has us thinking about this piece we ran in March.

Subscribe now

Open Measures found that users on Soyjak Party, an anonymous imageboard known for its proximity to extremist and violence-obsessed online subcultures, have discussed the development of at least three AI-powered doxing tools since October 2025. The tools work by performing automated searches across online databases, including those containing breached account information, for the names of individuals that their users submit and compiling any information they find into “dox packages” for users to review.

The tools we found were still online and operational at the time of writing. To minimize their reach, Open Measures has opted not to name them in this article and to redact URLs that appeared in the posts that appear quoted throughout.

Posts discussing these tools first appeared in Soyjak Party’s “/raid/” board, which serves as a dedicated venue for users to solicit others’ help in doxing, harassing, and threatening individuals and entities they identify in their posts. The board’s users disproportionately target individuals and entities associated with minority communities – like Jewish social media influencers and transgender graphic artists – and the threads where they discuss their efforts reliably contain hateful and violent rhetoric about their subjects.

On Oct. 13, 2025, a Soyjak Party user shared a post on the board announcing the release of a specialized doxing tool that used AI to query a third-party database of compromised web account data. In the post, which contained a litany of slurs against minority groups, the user said they built the tool to enable batch searching, source filtering, IP geolocation, DDOS protection, and more.

The post went on to describe an automated browser-based tool for querying breach databases to surface leaked information or credentials for a target individual. The post’s anonymous author explained that they designed the tool to work off a pre-existing API and added functions that enabled batch searching, source filtering, IP geolocation, and other functionalities to assist in doxing efforts.

The post author asked other Soyjak Party users to share “feedback on what to improve” and to use the tool “sparingly” to avoid being noticed by the operators of the third-party dataset it was built on. The board’s users obliged, replying with dozens of posts showing them testing the tool and suggesting improvements, many of which appeared to have been incorporated by the tool’s anonymous developer.

On Nov. 2, 2025, the tool’s creator appeared to spam Soyjak Party’s “/soy/” board, the site’s main discussion board, with posts encouraging its use. The following message appeared 115 times across 31 unique threads we identified:

[TOOL NAME REDACTED] dev here. I am DEFINITELY NOT datamining all requests to the site and sending them to mossad

fr doe you can check the source code yourself if you want and even run locally on your machine. It’s just a wrapper for the [URL REDACTED] API so if you trust that site you can trust [TOOL NAME REDACTED]

Months later, a new AI-powered doxing tool appeared on Soyjak Party. In a post to the /raid/ board on March 6, 2026, a user debuted a “full autonomous, and FREE doxxing AI agent” that was able to “fully dox some people in minutes, with little human intervention.” In a post made seven minutes later, the same tool was also promoted on the site’s /soy/ board:

fully autonomous AI based doxxing is now a thing

what can I add to the prompt to make it act more like a ‘teen

The post included a screenshot of the tool, displaying a system prompt instructing an LLM to surface identifying information on user-provided targets by taking on the role of a “professional private investigator.” The author of the original post claimed in a reply that they had used the tool to produce a complete dox profile on a target “in one prompt” – demonstrating the new tool’s significant capabilities.

Open Measures determined through additional searches that this particular tool was an AI-powered rebrand of an earlier, since-defunct tool that came online in June 2025, per its domain records. (The earliest mention of the now-defunct tool we identified on Soyjak Party appeared in a post shared on the /raid/ board on Sept. 17, 2025).

In the hours that followed, Soyjak Party users shared their excitement about the tool and offered detailed suggestions for improving its user interface and search functionality, as seen in the following replies to the March 6 post:

use rag [retrieval-augmented generation] and give it a pdf of soyspeak. tell it to imitate the slang found in the document

be wary though, ai loves to hallucinate. btw what model are you using? this is definitely gonna get taken down eventually, so make an app version that can use apis to talk to [URL REDACTED] servers

I would suggest an interface improvement. It’s not clear from the landing page that you are sending a prompt to an AI, not conducting a search of database breaches yourself

Our researchers also observed posts that included full dox reports on four private individuals that users said were produced using the tool, all of which were still live on the imageboard at the time of writing.

We also identified a handful of posts on Kiwi Farms – another online forum known for spawning coordinated harassment campaigns – and in a Discord channel that referenced the tools we identified, showing they are also being used by malevolent communities beyond Soyjak Party.

LLM-powered doxing tools represent a major escalation in the online threat landscape. Malicious doxing often intends to intimidate its targets, and the information it turns up can intensify harassment campaigns and drive serious threats like swatting attacks.

When we published our whitepaper on emerging AI threats in May 2026, we noted that agentic tools were advancing quickly enough that tools for automating coordinated harassment campaigns could soon be built and commoditized. The tools our researchers observed on Soyjak Party show this threat is no longer theoretical.

Open Measures will continue to monitor and report on new developments related to online doxing campaigns. Organizations can contact our research team for additional information.

A new article from WIRED examines Laura Loomer's abrupt pivot to championing Ukraine — a country the far-right social media personality previously claimed was "full of Nazi apologists." The reversal rattled some of her own online supporters and raised eyebrows across Trump's online base, irritating existing fractures that have emerged in MAGA media over the last year.

WIRED featured insight from Open Measures senior researcher Jared Holt, who has followed Loomer’s rise in MAGA media for more than a decade. He offered context for understanding her sudden turnabout on Ukraine:

“The primary driver of Loomer’s political posturing is her unwavering adoration of Trump, not a rigid set of ideological beliefs,” Jared Holt, senior researcher at Open Measures, tells WIRED. “While she maintains some core attitudes, including anti-Muslim and anti-immigrant beliefs, she has repeatedly shown a willingness to shift her positions if she believes it will help the president. Trump calls the tune, and Loomer follows his lead.”

Check out the full article, here:

WIRED

Subscribe now

Subscribe now

Folarin Balogun received a straight red card in the United States’ match against Bosnia and Herzegovina on July 1 after referees reviewed slow-motion footage and determined he committed a “serious foul.” The penalty carried a one-game suspension for Balogun, meaning he would not be allowed to play for the U.S. team’s round-of-16 match against Belgium on July 6.

Four days later, on July 5, tournament officials overturned the suspension and confirmed Balogun would be eligible to play against Belgium. Subsequent news reports revealed that the highly unusual decision came after President Donald Trump personally intervened in the matter, asking FIFA president Gianni Infantino to have officials reconsider Balogun’s suspension.

The ruling was met with outcry across the international soccer community, even after Belgium eliminated the United States with a 4-1 victory, resurfacing longstanding concerns over the FIFA president’s extraordinary efforts to satiate Trump ahead of the 2026 World Cup and FIFA officials’ history of corruption. Some have even called for outside investigations into Infantino’s role in reversing the suspension.

Alternative Platform Activity After Balogun’s Reversed Suspension

Open Measures sought to assess how FIFA’s decision to reverse Balogun’s suspension impacted online discussion of the 2026 World Cup and FIFA officials on platforms we monitor ahead of the final match on July 19. While the FIFA World Cup draws a global audience of fans who speak a variety of languages, we limited our analysis to English-language posts, which we surfaced using the following search query:

(FIFA OR “World Cup”) AND (corrupt* OR rigg* OR brib* OR fix* OR scandal* OR fraud* OR “match-fixing” OR “predetermined”)

Our query surfaced posts on nearly every platform we monitor, but the highest numbers of results appeared on Bluesky, Fediverse platforms, Disqus, 4chan, and Telegram. Together, users on those five platforms shared more than 38,000 posts doubting the integrity of FIFA and the World Cup since the tournament began on June 11.

Using our platform’s Timeline tool, we visualized those 38,000 posts since June 11 by daily volume across all five platforms mentioned above. Viewed over time, we were able to observe an activity surge across platforms that followed news reports of Trump’s involvement in the decision to overturn Balogun’s suspension.

Shifting Online Narratives Ahead of 2026 World Cup Final

We used Research Assistant to summarize prominent narratives across the posts we identified between July 8 – two days after the US match against Belgium – and July 15, the date of our analysis. As the discussion about Balogun’s reinstatement controversy subsided, we saw users on platforms we analyzed extend their claims of match-rigging and corruption onto subsequent matches.

As the World Cup moved on, the users we reviewed expressed their beliefs that FIFA was rigging matches to favor Argentina, citing specific video assistant referee decisions, favorable draws, and on-field penalty rulings. Multiple posts referenced the 2015 indictment of FIFA officials on corruption charges.

On the platforms we reviewed, some users also commented that online accusations of match-rigging in the World Cup seemed more pervasive in 2026 than they had in years prior.

What We’re Watching

The World Cup, of course.

FIFA’s unusual decision to reverse the suspension of a United States player after Trump asked the organization’s president to intervene breathed life into longstanding skepticism about the integrity of the World Cup and of FIFA’s leadership. Open Measures will continue to monitor for similar narratives as they evolve across platforms.

Subscribe now

As Open Measures’ chief of staff, I regularly speak with research analysts and threat monitoring teams who use our platform to ask them about their experiences, how it compares to other tools they’ve used, and if there are things we can do to make their work easier. In nearly all of these conversations, professionals share their frustrations that the research tools they rely on lack comprehensive coverage of the sources they need to monitor.

For years, digital threat detection tools were designed to watch for activity on major platforms and flag harmful content when it surfaced at high volumes. But this approach has been rendered obsolete by evolutions in the online landscape, as threat actors have spread out across many niche communities and alternative platforms.

Despite contrary claims, the influence of these relatively fringe spaces has not diminished in recent years; in many ways, their impacts are as pronounced as ever. Even as mainstream platforms have seen a sizable uptick in toxic content after curbing their enforcement programs, alternative platforms continue to serve as vital launchpads for violent extremism, online abuse, cybercriminal activity, disinformation campaigns, and harmful narratives.

But the inherent limits of many tools prevent analysts from seeing the entire ecosystem. Many teams have told us that they’ve tried to address these coverage gaps by using multiple tools at once: a process they describe as time-consuming, imperfect, and emotionally taxing. This piecemeal approach drastically slows their response time, results in them missing important signals, and contributes to analyst burnout.

Teams that broaden their monitoring to include alternative platforms are also forced to contend with reviewing the massive amounts of data they can introduce into their analysis. This concern has become especially pertinent in recent years, as a growing number of threat actors adopt artificial intelligence tools to intensify the impacts of their activities.

Some online monitoring platforms have tried to address these challenges by offering AI-driven features capable of compressing millions of data points into short reports for analysts to review. While the summaries these tools generate can appear comprehensive, few are fully transparent in how they produce their findings or the limitations they possess, making it difficult for analysts to fully trust their outputs.

Most AI-driven analysis tools available today bake in assumptions or make decisions on behalf of the analysts using them that can’t be altered, and the reports they generate often obscure coverage gaps and lack citations for the data points used to form their conclusions. The fixed presets in black-box tools often miss low-volume signals that precede escalations and low-profile threat actors, and they can prove to be wildly inconsistent in their flagging, interpretation, and classification of potential threats – ultimately hurting analysts more than they help them.

Large language models (LLMs) and similar technologies can offer significant time-savings to analysts and threat detection teams, especially those who use tools that include data for alternative platforms and niche communities. But for those tools to be useful, they must be customizable and show the hidden scratchwork behind the reports they generate. Even the best software cannot provide a substitute for human oversight and expert decision-making.

At Open Measures, we recently introduced an LLM-powered tool (Research Assistant) into our platform that seeks to address these gaps with a “human-in-the-lead” design philosophy, where users maintain control over how it gathers data and receive outputs that are clearly explained and auditable. Instead of trying to replicate our users’ expertise and intuition, we’ve aimed to create a tool that empowers it.

The analysts and safety teams I speak with keep asking for the same things: a fuller field of vision across today’s threat landscape and transparent tools that can help them process all that extra data. As the digital ecosystem expands and places additional strain on monitoring efforts, it’s critical that we take those requests to heart and trust that the professionals know best.

Subscribe now

Patriot Front and Active Clubs

Patriot Front is a white nationalist hate group founded in 2017 by Thomas Rousseau, a longtime far-right activist and former member of the now-defunct white supremacist group Vanguard America, alongside other defectors and supporters. Rousseau launched Patriot Front weeks after the deadly “Unite the Right“ rally in Charlottesville, Virginia, amid a flood of critical news coverage and disputes among “alt-right“ leaders about the racist movement’s future.

Rousseau intended for Patriot Front to solve what he considered to be an optics problem for white nationalism. In lieu of overt extremist aesthetics and violent tactics, Patriot Front’s public image is carefully curated, and the bulk of its efforts are dedicated to crafting and disseminating propaganda through flyering campaigns, flash demonstrations, and stylized social media content. To obscure its extreme beliefs, the group employs vague patriotic themes and co-opts mainstream conservative talking points; likewise, its members wear polo shirts and khakis and carry American flags to soften their public image.

Leaked internal documents recently revealed that Patriot Front counted more than 500 people on its membership roster this year and indicated that the membership had roughly doubled in size year-on-year since its formation. The documents also showed that Patriot Front had expanded its previously reported efforts to integrate with white supremacist “active clubs” in order to increase recruitment.

Active clubs are white nationalist groups that frame racist activism as a fitness-oriented “lifestyle” men can adopt to improve themselves while bonding with others. The groups are decentralized and leaderless, adhering to a “white nationalism 3.0“ model popularized by neo-Nazi Robert Rundo in 2020, though individual clubs frequently network with one another through social media and in-person events. As the number of active clubs has grown in recent years, proponents have also launched similarly styled “youth clubs,” which target teenage boys, and expanded the model internationally.

Hundreds of Patriot Front Members Stage Surprise Independence Day Rally in DC

This year, hundreds of uniformed Patriot Front members flocked to the nation’s capital to participate in an unannounced demonstration on the morning of July 4. The group paraded through Capitol Hill, displaying an assortment of American flags and chanting one of Patriot Front’s slogans: “Reclaim America.”

After the march, Rousseau delivered a brief speech in which he explained that the protest was meant to counterprogram the “shallow displays” planned for the nation’s semiquincentennial anniversary, which he claimed were intended to “conceal” the supposed “ethnic replacement” being perpetuated against white Americans. Rousseau said that Patriot Front hoped to spark a racial “revolution” against the “enemies of our people,” whom he specified to include “Jewish cabals,” “Mexican cartels,” “African criminals,” and “homosexual peddlers of vice and exploitation.”

Patriot Front’s protest generated headlines across national news media and reinvigorated longstanding debates about the group. For years, prominent right-wing media figures have baselessly claimed that Patriot Front is a fake organization created by antifascist activists and federal law enforcement to harm the reputations of conservatives who support President Donald Trump.

Over the days that followed their demonstration, Patriot Front and its online allies celebrated the online attention and news media interest they had garnered for their organization. Rousseau appeared on several podcasts after the event to boast about its success and call on his fellow white nationalists to take similar actions.

Active Clubs Share Footage of Patriot Front’s Rally Across Telegram Channels

Following Patriot Front’s rally on July 4, we used our platform to search for posts that mentioned the demonstration across more than 140 Telegram channels directly associated or closely affiliated with active clubs and youth clubs to see how they responded to the rally in the 24-hour period after it occurred.

Upon closer review of the posts we identified, we noticed that 14 different channels affiliated with active clubs had reshared the same post from a Patriot Front-affiliated channel, sometimes in rapid succession. This pattern suggests that a number of active club Telegram channels may be centrally controlled – and provides hints as to which active clubs may be linked to Patriot Front.

The majority of the posts we identified in active club and youth club channels were reshares of the same post from “Patriot Front Sightings”, a Telegram channel dedicated to highlighting the group’s offline activities. (While the channel is clearly supportive of Patriot Front, the account’s bio states that its posts “may contain sentiments not endorsed by the organization.”)

On the morning of July 4, Patriot Front Sightings shared a six-second video clip showing Patriot Front members arriving in Washington, D.C., ahead of their planned demonstration. About an hour and a half later, we saw the post begin to circulate among active club and youth club channels in short bursts.

Within the span of two minutes, the Patriot Front Sightings post was shared by two Telegram channels affiliated with active clubs in Texas and West Virginia, and a channel representing youth clubs across the US (“United Youth”). All times shown have been converted to Central Standard Time:

• 9:28 AM: United Youth (National)

• 9:28 AM: Lone Star Active Club (Texas)

• 9:30 AM: Appalachia Active Club (West Virginia)

Later that afternoon, the post was reshared by another trio of channels affiliated with an active club and youth club based in Kansas City, Missouri:

• 4:32 PM: Heartland Youth Club

• 4:44 PM: Heartland Active Club

• 4:44 PM: Heartland AC Public Chat

Half an hour later, the post was shared by five channels affiliated with active clubs in Florida in a single minute:

• 5:17 PM: Florida Active Clubs

• 5:17 PM: Florida Panhandle Active Club

• 5:17 PM: North Florida Active Club

• 5:17 PM: Central Florida Active Club

• 5:17 PM: SW FLORIDA Active Club

What We’re Watching

Open Measures will continue to track the growing number of active clubs and youth clubs using social media to spread propaganda and recruit prospective members. The rapid succession of identical posts about Patriot Front may indicate that the hundreds of social media accounts we track for such groups are working together more closely than their ostensibly decentralized structure might imply.

Further investigation is needed to confidently affirm the likelihood that channels affiliated with active clubs and youth clubs are run by a smaller number of individuals than they purport to represent, and whether their distribution of Patriot Front propaganda could indicate ties between those channel owners’ and the organization.

Background

The unauthorized buying, selling, and trading of compromised or fraudulent online accounts – known as “account trafficking” – is a persistent concern for platform trust and safety teams and cybersecurity professionals, who have seen illegitimately acquired or created accounts used to fuel a broad range of cybercriminal activities and digital security threats.

Sellers of trafficked accounts typically acquire them through illicit methods, like hacking or phishing, or create them using fake information, sometimes using stolen identities or forged documents. Trafficked accounts are often marketed in bulk quantities in niche communities tied to other forms of cybercrime, and are offered at various prices depending on their attributes (such as age, credentials, and verification status).

Beyond dark-web marketplaces and niche forum boards, trafficked accounts are also marketed to prospective buyers on the encrypted messaging app Telegram. Despite the company’s recent efforts to crack down on illicit activity on its platform, our research has repeatedly found that Telegram remains a top choice for cybercriminal networks selling stolen web data, advertising questionable software, promoting scams, and other nefarious activities.

Our Approach

Open Measures sought to better understand how account traffickers have used Telegram to promote the illicit sale of accounts on U.S.-based tech platforms, using our platform to analyze posts advertising buyable accounts that appeared in our datasets.

To identify Telegram posts tied to likely account trafficking networks, Open Measures built search queries designed to surface posts in our platform that named at least one major U.S.-based tech company or platform across seven industry sectors (1) and included language indicating the sale of accounts for those services (2).

Our searches targeted posts that named one of the companies listed below and contained the abbreviations “WTS” or “WTB” (shorthand for “want to sell” and “want to buy”) or included both a variation on the word “account” and a dollar sign indicating a sale price. We limited our search to posts shared between July 1, 2025, and July 1, 2026, capturing a yearlong period in our analysis.

The companies included in our search queries were as follows, grouped by sector:

• Payment Processing: Venmo, Cash App, Zelle, Authorize.net, Chime, Square, Stripe, PayPal

• E-commerce: Amazon, Ebay, Etsy, Walmart, Target, Wayfair, Poshmark, Depop, OfferUp, TikTok Shop, Instagram Shops, Newegg, BigCommerce, WooCommerce, Squarespace Commerce, Magento (Adobe)

• Social Media: Facebook, Instagram, Twitter/X, LinkedIn, Snapchat, TikTok, YouTube, Twitch, Discord, Reddit, Quora, Threads, Nextdoor, Tumblr, Pinterest, Bluesky

• Artificial Intelligence: Claude, Gemini, ChatGPT, Copilot, Grok, Perplexity AI

• Gaming: Steam, Epic Games, PlayStation, Google Play, App Store, Xbox, Nintendo, Roblox, Minecraft

• Dating: Tinder, Bumble, Hinge, Match.com, OkCupid, eHarmony, Badoo, Grindr, Scruff, AdultFriendFinder

• App Development: Google Play, Apple App Store (with explicit mention of “developer” or “dev”)

Messages in Telegram groups can be set to automatically delete after a preset period of time, and many of the groups where account trafficking posts appeared seemed to be employing the feature – likely to minimize group members’ digital trails and evade retroactive detection from Telegram moderators. Because Open Measures archives posts in these groups before they delete, we were able to review and analyze account trafficking posts over time, allowing for analysis that would otherwise be difficult or impossible to conduct.

What Account Trafficking Looks Like on Telegram

The posts in our datasets engaged in likely account trafficking were typically found in Telegram groups and channels that were self-styled as “over the counter” – frequently abbreviated as “OTC” – cryptocurrency trading groups, where users arrange peer-to-peer transfers of digital assets outside of public exchanges. But upon closer inspection, the “OTC” groups where posts appeared actually functioned as classified boards for black-market and grey-market goods and services.

Users soliciting accounts often used a rough template for their posts, including “WTS” or “WTB” to indicate whether they were looking to buy or sell accounts, listing desired or available accounts on desired platforms, and itemizing preferred methods of payment. Some posts included prices, while others invited prospective buyers to contact them privately.

“Verified” and “Aged” Accounts

Posts from sellers often touted that the accounts they had available were “verified” or “aged”, making them more valuable to potential buyers seeking to exploit them for illicit or illegitimate purposes. Many of the posts advertising e-commerce and payment processor accounts claimed they were “KYC” (“know your customer”) certified, indicating that they had passed legally required identity verification steps.

Many of the posts we identified from users looking to purchase accounts from others stated that they were interested in purchasing them in bulk, with some offering premium rates for accounts that were aged or had higher numbers of followers.

Some of the posts we identified advertised other illicit goods and services alongside likely trafficked accounts, including fraudulent identification and business documents, inauthentic boosting services for social media accounts, and more.

Likely Account Traffickers Shared Millions of Listings in Telegram Posts Last Year

Open Measures’ analysis identified more than 5 million Telegram posts in our datasets that advertised or solicited purchasable accounts for at least one of the dozens of U.S.-based tech companies and platforms included in our search queries. Many of the posts we surfaced advertised several at once.

Our datasets include archives for thousands of Telegram groups and channels, including many that appear to engage in cybercriminal activities, but they do not reflect the totality of Telegram – a massively popular app with billions of users around the globe. Resultantly, the groups and channels they contain provide only a glimpse at the broader ecosystem of account trafficking activity that may be affecting dozens of U.S.-based companies across a variety of tech sectors.

Of the 5,071,864 posts our search queries identified:

• About 83.2% named a payment processing platform (4,221,436 posts)

• About 32.7% named a social media platform (1,656,215 posts)

• About 26.7% named an e-commerce platform (1,354,015 posts)

• About 8.5% named an artificial intelligence platform (429,720 posts)

• About 5.7% named a gaming platform (289,286 posts)

• About 5.6% named a dating platform (282,118 posts)

• About 5% named a web development platform (252,522 posts)

Many of the posts we surfaced with our search queries included lists of accounts for multiple platforms. As such, some posts were counted for multiple sectors.

Using our platform’s Timeline tool to visualize the number of Telegram posts that matched our search queries over time revealed a sudden spike in daily volume in early September 2025. Over the two months prior, we surfaced only hundreds of posts per day from our datasets that matched our queries. From early September onward, the volume sharply increased to tens of thousands of posts per day, largely driven by a handful of accounts that showed signs of automated activity.

We also saw a sharp drop-off in the daily number of posts in late October 2025. The reason for that sudden drop is also unclear, and this dip was not seen more broadly against the whole of our Telegram archives. But within a week of that crash, the daily volume of account trafficking posts rebounded. Since then, the daily volume of posts has remained relatively steady, seeing periods of rise and fall.

Sector-Specific Spikes of Likely Account Trafficking Activity on Telegram in 2025 and 2026

When breaking out the Timeline chart for each of the sectors included in our search queries, we saw that the volume of posts mentioning companies in each industry surged at different times. In December 2025, for example, we saw a sharp increase in the number of posts advertising or soliciting accounts for artificial intelligence, social media, dating, and gaming platforms.

Telegram’s Account Trafficking Ecosystem Appears Driven By Bot Activity

Open Measures found that likely account traffickers appeared to be using Telegram’s bot integration features to scale and facilitate their illicit activities at volumes and frequencies that would be impossible for a human user to replicate. When reviewing posts matching our search queries, we encountered thousands of identical listings for buyable accounts that had been distributed across Telegram channels and groups at intense scales and speeds.

We used our platform’s Activity tool to count how many unique posts matching our search queries were shared by each account. We found that the 15 accounts responsible for the highest number of posts matching our queries shared a combined total of 935,648 posts, making up about 18.5% of all the posts our queries identified.

On closer inspection, we saw that most of the top 15 accounts we identified showed tell-tale signs of automation, sharing hundreds – and sometimes even thousands – of identical posts per day. They uploaded content at all hours for weeks on end, with no apparent breaks for rest. And some saw sudden drop-offs in activity, indicating they may have been abandoned by their creators or taken down by Telegram moderators.

Researchers also observed that total daily activity across the top 15 accounts first ramped up in September 2025: the same period we saw overall activity surge in our datasets. On Sept. 20, 2025 – the day with the highest number of posts matching our query that we recorded – the top 15 accounts we identified contributed about 31.5% of all the posts we identified in our analysis period. This indicates that automated accounts contributed significantly to the total number of posts we identified in our analysis.

Likely Account Trafficking Activity Was Highly Concentrated in Specific Telegram Channels

When we used the Activity tool to filter the results of our search query by the channels and groups where posts appeared, we found that the 15 channels that saw the highest number of messages matching our search query were responsible for the majority of the activity we identified. More than 55% of all the posts our searches identified appeared in one of those 15 channels.

After re-charting these results against all posts that matched our search queries in our analysis period, we also saw that the top 15 channels’ activity closely followed the larger trends reflected in our datasets.

These findings indicate that automated accounts and hyper-active groups and channels played an outsized role in driving likely account trafficking we observed in our datasets, highlighting how traffickers can exploit Telegram’s unique features to further their illicit dealings on the platform.

Our Take

Cybercriminals have centered operations on Telegram for years, drawn to the platform’s unique features, privacy protections, and ease of use. Our findings paint an alarming picture of likely account trafficking on Telegram, a niche economy whose participants use the platform’s automation tools to advance their own likely illicit activities.

Without further investigation, it is difficult to say whether the posts we identified were legitimately offering the accounts they listed for sale. But if even a fraction of the posts we identified represent authentic exchanges of compromised or fake accounts, they present a serious risk for the dozens of companies and platforms they mention.

Recent political developments around the world, like age-limited restrictions on social media platforms, could drive this underground market further – creating additional incentives for cybercriminals to acquire and sell inauthentic accounts through illicit means.

4chan’s “Adult Requests” imageboard was one of the internet’s largest and fastest-growing venues for the nonconsensual trading and solicitation of sexually explicit images generated with AI tools — commonly known as “deepfakes.”

Then, on May 21, 4chan abruptly shut Adult Requests down. At the time of writing, the imageboard has been removed from the site’s index, and its URL returns an error page reading: “File not found.”

We’ve seen Adult Requests go dark before, only to return within days. But this time feels different: more than a month has now passed with no apparent sign it’s coming back.

The closure appears to have largely gone unnoticed by users on 4chan’s other boards, though a handful have voiced confusion over its disappearance and the absence of any explanation.

Earlier this year, Open Measures published an investigation into Adult Requests that exposed the scale and intensity of abuse occurring on the board. It sparked a broader wave of scrutiny — among researchers, policy analysts, and journalists — into its role in the wider ecosystem of nonconsensual intimate imagery (NCII) online.

We’re glad our report helped drive a broader reckoning with this corner of the internet, and we’ll keep watching for where its former inhabitants migrate next.

Subscribe now

As we enter the dog days of summer, here’s a look back at the research we published in June.

But first…

4chan Quietly Pulled ‘Adult Requests’ Last Month. There’s Still No Sign It’s Coming Back.

By Jared Holt

4chan’s “Adult Requests” imageboard was one of the internet’s largest and fastest-growing venues for the nonconsensual trading and solicitation of sexually explicit images generated with AI tools — commonly known as “deepfakes.”

Then, on May 21, 4chan abruptly shut Adult Requests down. At the time of writing, the imageboard has been removed from the site’s index, and its URL returns an error page reading: “File not found.”

We’ve seen Adult Requests go dark before, only to return within days. But this time feels different: more than a month has now passed with no apparent sign it’s coming back.

The closure appears to have largely gone unnoticed by users on 4chan’s other boards, though a handful have voiced confusion over its disappearance and the absence of any explanation.

Earlier this year, Open Measures published an investigation into Adult Requests that exposed the scale and intensity of abuse occurring on the board. It sparked a broader wave of scrutiny — among researchers, policy analysts, and journalists — into its role in the wider ecosystem of nonconsensual intimate imagery (NCII) online.

We're glad our report helped drive a broader reckoning with this corner of the internet, and we'll keep watching for where its former inhabitants migrate next.

What We’re Reading:

• An Influential Time (SPLC)

• Fake Dating Profiles, Real Foreign Influence (NewsGuard)

• Big Trouble on Small Forums: Largely Unknown Small Sites Driving Extremist Violence (GPAHE)

• Dear Media is the vaccine skeptical trojan horse targeting millennial women (Number Two Pencil)

• It Is Trivially Easy to Use Reddit to Manipulate AI Search, Research Suggests (404 Media)

Before you go…

• Check out recent articles in The Atlantic and Hate Comes to Main Street featuring insights from Open Measures researchers.

• Revisit our flash report about the right-wing media “antifa” narratives that set the stage for DOJ prosecutors to charge 15 anti-ICE protesters in Minnesota.

• But perhaps most importantly…

A recent article published in The Atlantic detailed how MAGA media figures have changed their tune around the botched renovation of the Lincoln Memorial Reflecting Pool, presenting those rapidly changing talking points as phases in a 13-step political spin cycle regularly seen in pro-Trump punditry.

Subscribe now

The piece featured insights from Open Measures senior researcher Jared Holt, supported by findings produced with our platform’s new Research Assistant. Holt used the Research Assistant to quickly generate a summary of evolving narratives about the Reflecting Pool across 2,500+ posts in our datasets and talked to The Atlantic to provide additional context and commentary about those findings:

These recurrent steps extend beyond Trump into the broader MAGA coalition. Recently, Jared Holt, a senior researcher at Open Measures, an organization that tracks online extremism, used a generative-AI research tool to spot patterns in posts about the Reflecting Pool by right-wing accounts on a selection of right-wing social-media platforms such as Truth Social. The tool broke down more than 2,500 posts into three buckets:

Phase 1: Triumph and Restoration

Phase 2: Defending the Project

Phase 3: Sabotage and Culture War

“For the MAGA faithful, Trump’s renovation of the Reflecting Pool was supposed to be a shining example of his efforts to restore America from its decaying state,” Holt told me. “When it became clear the renovation had been a disaster, MAGA influencers shifted their talking points to instead portray the situation as being emblematic of their critics’ depravity and derangement.” The pattern, Holt noted, is similar to how the MAGA media system responded to the ICE killings in Minnesota earlier this year, or how it has tried to spin the war in Iran. “The primary function of this media ecosystem is to hype up and pacify Trump’s base. And these days, as public support for the administration craters, it’s doing a lot more of the latter.”

Check out the full article, here:

The Atlantic

Subscribe now

Background

Libs of TikTok is a popular far-right social media account widely recognized for its role in helping to repopularize anti-LGBTQ+ hate and conspiracy theories within the conservative movement, including “groomer” narratives that falsely portray LGBTQ+ people as predatory sex abusers who target children. Since the account was started on Twitter in 2021 by Chaya Raichik, a former real estate agent, Libs of TikTok has amassed millions of followers across multiple platforms and leveraged its audience to inflict real-world harms against LGBTQ+ people and their allies.

The account’s posts routinely encourage ridicule and outrage against individuals and institutions it claims are complicit in “grooming” children for sex abuse or demonstrate the supposedly sinister dispositions of LGBTQ+ people. Among other targets, Raichik has frequently attacked public schools and their their staff, claiming they promote radical ideologies and sexual degeneracy to their students, and posted content containing the contact information for targeted faculty members. Schools and teachers featured in Libs of TikTok posts have faced bomb threats and severe harassment, causing major disruptions and safety risks.

As Raichik’s account grew in popularity with online right-wing audiences, so did her role in guiding the Republican Party’s escalating attacks on LGBTQ+ rights and public education, extending her influence far beyond the confines of any particular social media platform. Raichik and her Libs of TikTok account have directly and indirectly guided the focus of GOP policymakers, right-wing media outlets, conservative activist groups, and far-right extremists – providing them a constant roster of potential villains and hateful narratives to justify antagonizing them. President Donald Trump courted Raichik during his 2024 campaign, and officials in his second administration have consulted her on education policy and public messaging.

In addition to anti-LGBTQ+ rhetoric, the account has also targeted a host of people and organizations in posts promoting anti-immigrant sentiments and hostility toward diversity, equity, and inclusion (“DEI”) policies. And beyond educators and LGBTQ+ people, the account’s posts have elicited threats against private businesses, healthcare providers, and nonprofit organizations.

Libs of TikTok is best-known as an X (formerly Twitter) account, but its digital footprint expands across an array of mainstream and alternative social media platforms, where its self-identified “team” of unspecified individuals (likely including paid employees) distribute their posts to millions of followers.

After Years of Inactivity, Libs of TikTok Suddenly Ascends on Truth Social

Earlier this year, our researchers noticed that Libs of TikTok’s profile on Truth Social, an alternative microblogging site launched by Trump in 2022, had become one of the platform’s most-influential accounts. As our researchers observed Libs of TikTok ramping up its attacks against schools during Pride Month, we sought to examine its influence on Truth Social and how users there have responded to its posts.

Raichik created a Libs of TikTok account on Truth Social in February 2022, coinciding with the site’s public launch. In her first post on the site, she expressed enthusiasm for Trump’s new social media platform: “I can’t wait!! This is really exciting!”

But despite that initial enthusiasm, the Libs of TikTok account has been relatively inactive on the platform for most of its existence. Using our platform’s Timeline tool, we saw that the account has exhibited on-and-off activity since its creation, sometimes going months without posting.

That changed on Dec. 23, 2025. Libs of TikTok returned to Truth Social after a 300-day period of inactivity and began ramping up its daily activity to previously unseen levels. At the time of writing, more than two-thirds of all observed Libs of TikTok posts were shared in 2026. Since rejoining Truth Social, the account has averaged 29 posts per day on the dates it uploaded content. (Libs of TikTok’s account is “usually offline” on Saturdays.)

Libs of TikTok’s Truth Social posts are often word-for-word copies of posts that originally appeared on its better-known X account. Notably, Libs of TikTok does not mirror every popular post made on X onto Truth Social; we were unable to surmise how the account might determine which of its posts to omit.

Libs of TikTok posts have consistently seen high engagement on the platform since the account ramped up its activity late last year. Of the 3,986 posts it shared in 2026 at the time of writing, more than 40% were reshared 500 or more times by Truth Social users. Less than 20% of the posts it shared before 2026 saw such engagement – indicating that Libs of TikTok’s reach on Truth Social has significantly grown since its return.

We performed another search to identify all Truth Social posts in our datasets that were made this year and received 500 or more reshares, then used our Activity tool to group the results by account. At the time of writing, Libs of TikTok had shared 1,578 posts that received 500 or more reshares in 2026 – more than double the number of high-engagement posts the official White House account shared on the platform over the same period.

The only account that shared more posts achieving such traction was the one used by Trump, who owns the site and serves as its primary draw.

Libs of TikTok Routes Truth Social Users’ Focus Toward LGBTQ+ People and Public Educators During Pride Month

We used our platform’s Discover tool to identify every post that Libs of TikTok shared on its Truth Social account between June 1 and June 14 – the first two weeks of Pride Month – and reviewed them to count how many expressed hostility toward others surrounding issues related to LGBTQ+ identity, gender identity, and public education.

Of the 392 posts Libs of TikTok shared on Truth Social during that period, about one-third (131 posts) featured hostile language about the LGBTQ+ community and its allies. Most posts identified in this category highlighted individuals and entities that shared pro-LGBTQ+ messages for Pride Month, often targeting state and local government officials and entities.

About a quarter of the account’s anti-LGBTQ+ posts during the first two weeks of Pride Month expressed outrage at the public education system, which Raichik has long claimed is complicit in “grooming” children for LGBTQ+ people to sexually abuse. Nearly all posts targeting educators named specific schools and faculty members, and several provided contact information that Libs of TikTok followers could use to reach them.

Libs of TikTok’s anti-LGBTQ+ posts targeting public educators were reshared by Truth Social users more frequently than those that targeted individuals and entities unrelated to schools, on average. The 34 anti-LGBTQ+ posts targeting public educators in the period analyzed received an average of about 393 reshares each, while the 97 posts targeting other subjects saw an average of about 336 reshares each.

An additional 14 posts targeted education-related subjects over issues unrelated to LGBTQ+ identity or gender-identity, including posts that attacked schools for allegedly engaging in discrimination against white people, targeted educators who allegedly shared violent rhetoric on social media, and faulted schools for accommodating Muslim students. In total, more than one-in-ten (about 12%) Libs of TikTok posts on Truth Social in the period we analyzed targeted public educators in some way.

As Seen On Other Platforms, Libs of TikTok Posts Elicit Violent Rhetoric Against Their Subjects on Truth Social

Open Measures saw that Libs of TikTok’s anti-LGBTQ+ posts consistently elicited hostile and violent rhetoric from Truth Social users – not unlike the responses it has regularly provoked on mainstream social media platforms – and in turn inspired some users to target the same individuals and entities Libs of TikTok mentioned in their own posts.

Over the first two weeks of Pride Month, Truth Social users reshared the 131 anti-LGBTQ+ posts we identified on Libs of TikTok’s profile a total of 45,965 times and replied to those posts a total of 12,404 times.

Of the posts targeting public educators, the most-reshared was a June 5 post that attacked a female school board director in Bellingham, Washington, who owned a sex shop that planned to host educational sessions for children during Pride Month. Libs of TikTok’s post included the name and photo of the school board director, a picture of her store, a copy of a flyer advertising the classes, and a screenshot of a post it previously shared on X that targeted a high school in the district she oversees and included the school’s phone number.

Truth Social users who replied to that post called for the school board director’s arrest, encouraged one another to report the woman to federal authorities, fantasized about violence against her and her business, and alluded to harassing her further. “She has an address,” one user replied. “We need to put these pedophiles to death,” another wrote. Several users posted that they had called the school; one said they were searching for a phone number for the sex shop.

The Libs of TikTok post targeting a public educator that elicited the highest number of replies in our analysis period was a June 8 post attacking a math teacher and coach at a high school in Fort Worth, Texas, who shared a video discussing her students’ reactions to learning she was in a same-sex relationship. The post named the teacher, included a clip of the video she shared, and listed the email address of the principal at the school she worked for.

In replies to that post, Truth Social users baselessly claimed the teacher was a pedophile, called for her to be fired from her position, and expressed violent fantasies. “LEGALIZE EUTHANASIA,” one reply stated. Another user wrote: “If this EVIL BITCH had done this to my child she wouldn’t be sitting their bragging online because she would be 6 FEET UNDER WITH NOT 1 STRAND OF HAIR ON HER COLD EMBALMED NAPPY HEAD.”

We found that Libs of TikTok’s posts about public educators regularly elicited responses like these from Truth Social users.

After Libs of TikTok posted about a school soccer coach who is a transgender woman, a Truth Social user responded that it was “curb check time.” When it attacked an Oregon school district that displayed a LGBTQ+ Pride flag outside its headquarters, a user called for “public hanging” of education officials. Notably, Libs of TikTok posts that included school and faculty members’ emails and phone numbers regularly elicited replies from users who reported contacting them to voice their disapproval.

In a 2024 interview, Raichik said she does not condone threats against schools featured in her account’s posts and questioned whether people who had sent bomb threats those institutions received were actually her followers.

“We don’t know who’s calling in the threats,” Raichik said in that interview. “I mean, look, bomb threats are bad. I’ve said that a thousand times. People that call in bomb threats should be arrested and investigated. You can’t call in bomb threats. But I just don’t know what – what does it have to do with me?”

What We’re Watching

Libs of TikTok’s posts have consistently elicited threats and harassment against LGBTQ+ people and public educators since its launch in 2022, and the account’s increased activity on alternative platforms expands the potential scale of the backlash it can spark against its targets.

The account’s overnight dominance on Truth Social is particularly notable, since the platform serves as the Trump Administration’s semi-official communications platform. As the account’s owner, Raichik, deepens her ties to the Trump Administration and other Republican Party leaders, posts shared by her Truth Social account could have even greater impacts on pro-Trump officials’ policymaking and rhetoric.

Open Measures’ platform is designed to enable threat-monitoring investigations across dozens of alternative platforms that often go unmonitored. As such, we will continue to monitor and report on harmful activity that occurs on those sites.

What is Telegram?

Telegram is a privacy-oriented, cloud-based messaging app launched in 2013 by Russian-born brothers Pavel and Nikolai Durov. The Durovs developed Telegram amid escalating pressure from the Russian government over their refusals to censor content on VK, seeking to create a secure communications platform that was impervious to government surveillance and speech restrictions.1 While Russian state actors have used Telegram to disseminate their own messaging, Russian officials have limited access to the app in their country, ultimately banning it outright in April 2026.2

The app’s design allows for greater degrees of privacy than other platforms. Telegram allows users to create accounts with anonymous phone numbers, offers limited encryption methods to protect private communications, and spreads its infrastructure across data centers and servers owned by an array of shell companies in multiple jurisdictions – making it more difficult for countries to subpoena user data. In addition to direct communication between individual users, it also facilitates groups and channels, which function similarly to chat rooms and microblogging profiles on other social media sites.3

Since its launch, Telegram has become one of the most widely used apps of its kind, attracting billions of users worldwide.4 Some of its earliest non-Russian users were based in nations with heavy censorship laws and included pro-democracy activists organizing under repressive governments. But Telegram’s privacy features and reluctance to moderate content have also attracted nefarious actors, including repressive regimes, terrorist groups, violent extremist movements, and cybercriminals.5

In 2024, French authorities arrested Pavel Durov and alleged that Telegram’s inaction against illegal content and failure to cooperate with legal investigations amounted to complicity in a host of severe crimes occurring on the platform.6 (Russia also launched its own criminal investigation into Durov for “abetting terrorist activities” in February 2026.)7 After his arrest, Durov announced that Telegram would make greater efforts to comply with valid legal requests and take proactive action against illicit user activity – a significant departure from its longtime “hands-off” philosophy.8

Shortcomings of Policy Changes and Takedowns Meant to Address Cybercriminal Activity

In his first public post after his 2024 arrest, Durov said the criminal charges brought against him were “misguided,” but acknowledged that criminal abuse was occurring on Telegram and said the company was taking down “millions of posts and channels every day” while continuing to work through the “growing pains” of illicit activity on its platform.9 In the weeks after Durov’s arrest, Telegram introduced new reporting mechanisms for users to flag illegal activity and updated its privacy policy, stating that it would disclose users’ phone numbers and IP addresses when it received valid court orders.10 The company also stepped up its enforcement actions against illicit content.11

But cybersecurity professionals have found that Telegram’s policy changes and takedowns have not meaningfully deterred or addressed cybercriminal activities taking place on its platform; some reports suggest the issue may have actually worsened since the crackdowns began.12 Users engaged in cybercriminal activities have reportedly rejoined the platform with new accounts and adopted new tactics for evading enforcement actions in lieu of migrating to other platforms.13

Telegram remains uniquely appealing to would-be cybercriminals today, offering unmatched features that allow for users to start and scale-up their operations with ease and speed. Unlike dark web forums, which can require special software or privileged access, the platform is simple to join. It also allows users to deploy administrative bots in their groups and channels that can facilitate financial transactions, aggregate messages, and interact with members on their behalf. Additionally, its message-forwarding mechanic allows for channel creators and group members to distribute messages far and fast, and for previously-forwarded messages to continue circulating even if a network’s “hub” is taken down.14

Methodology

Open Measures’ datasets include archives for thousands of Telegram groups and channels, including many that appear to engage in cybercriminal activities. Our researchers sought to examine how the channels we collect data for have adapted to Telegrams’s policy changes and takedowns targeting illicit user activity.

To identify a range of potentially relevant posts, we created a broad search query that included cybercrime-related keywords drawn from our prior research and published reports that name known threat actors, marketplaces, and criminal services:

“fullz” OR “fulls” OR “combolist” OR “stealer logs” OR “CVV” OR “CVVs” OR “credential stuffing” OR “LummaC2” OR “Lumma” OR “RedLine” OR “Redline Stealer” OR “Raccoon Stealer” OR “stealer” OR “ransomware affiliate” OR “affiliate program” OR “malware” OR “exploit” OR “payload” OR “dropper” OR “romance scam” OR “investment scam” OR “ghost-tapping” OR “NFC relay” OR “romance scam” OR “investment scam” OR “ghost-tapping” OR “NFC relay” OR “deepfake” OR “face swap” OR “voice clone” OR “BidenCash” OR “Omega Cloud” OR “Observer Cloud” OR “Moon Cloud”

Researchers used built-in tools on the Open Measures platform to analyze the posts that matched our search query and identify trends.

Analysis

Our researchers performed three separate searches with our Timeline tool to visualize the number of Telegram posts in our datasets matching our search query in 2024, 2025, and 2026.

Among channels we collected, daily activity levels remained consistent throughout 2024 – including the months after Durov’s arrest in August – and much of 2025, though we saw a dramatic increase beginning in October 2025. That surge was followed by another series of spikes between November 2025 and January 2026, with elevated activity sustained thereafter.

As illustrated by Telegram’s own data (included below), the platform has steadily increased its overall moderation efforts since May 2024, with average daily account takedowns in 2026 approximately four times the daily average in May 2024. These efforts have been accompanied by periodic enforcement spikes through early 2025 and into early 2026 (with a sustained decline in moderation and no major spikes after Feb. 20, 2026).

Telegram’s self-reported moderation data mirrors our own findings: as the volume of posts matching our query in late 2025 and early 2026 increased, so did Telegram’s reported takedowns. Likewise, Telegram’s declining moderation in mid-February 2026 onward also aligns with the declining volume of query-matching posts our researchers observed.

Though Durov’s arrest in France served as a catalyst for Telegram’s increased moderation, the platform has sustained its efforts in response to increased suspected illicit activity for several years. Though the recent decrease in both posts matching our query and Telegram’s account takedowns might suggest the platform has attempted to address its cybercrime problem, the average volume of posts matching our query remains higher today than in years prior, suggesting cybercriminals are finding ways to adapt to Telegram’s policy changes and increased takedowns.

Trends By Search Period

Activity matching our search queries was led by different sets of groups and channels included in our datasets in 2024, 2025, and 2026. Notably, the names of the dominant groups and channels we observed hosting cybercriminal activities in each period were often misleading, presumably as a strategy to avoid moderation and attract unsuspecting users. Our researchers also observed that groups and channels most active in 2024 and 2025 seemed to use names with similar themes; in 2026, the groups and channels whose posts matched our queries changed, as did their naming conventions.

2024: Cybercrime-themed Spam in Politically-styled Telegram Groups

Throughout 2024, many of the most active groups and channels in our datasets that we observed engaging in likely cybercriminal activities (e.g., spammed advertisements for fraudulent documents and stolen user credentials) were styled after US political themes, most notably “ThePatriotPartyofOH,” “FreeWestVirginia,” and “PatriotPartyOregon.” Volume during this period was moderate, with “ThePatriotPartyofOH” leading with more than 3,000 hits.

2025: Increased Activity and Proliferation of Politically-styled Groups

Throughout 2025, our researchers saw the volume of posts in our datasets matching their search query significantly increase. The previously identified “FreeWestVirginia” channel shared approximately 16,000 posts matching our query (a roughly 30-fold increase from the period before). We also saw approximately triple the number of positive hits in posts shared by the “ThePatriotPartyofOH” channel.

The most active groups in this period that explicitly advertised cybercriminal services included additional channels and groups with “Patriot Party” names or political themes (e.g., “PatriotPartyNewHampshire,” “FreeSouthDakota”). As we observed in the 2024 search period, many posts we identified in other channels were apparent advertisements for cybercriminal services.

2026: Increased Activity, Proliferation of Financially-styled Groups

In 2026, despite Telegram’s reported takedowns of millions of accounts in late 2025, the volume of posts in our datasets matching our query was still dramatically higher than prior years. Researchers identified roughly four times as many posts matching their search query that were shared in 2026 than were shared 2025.

Rather than groups and channels with American political themes, the groups we identified as advertising cybercriminal services were often named after finance and OTC (“over-the-counter”) investing terms, like “otc_investorhub” and “chat_nft.” We also identified a cluster of similar groups styled around employment in Ukraine, like “truework_stkyiv.” The channel that shared the highest number of posts matching our query, “ChekerCCsLive,” was named in reference to “checking” if a stolen credit card or “CC” number is still “live” and usable.

Fraud Services and Scam Recruitment Posts

Our researchers observed that posts in “OTC” channels frequently featured advertisements for apparent financial fraud and money laundering services. Posts shared in the “WTSotc” channel, which shared hundreds of thousands of posts matching our search query prior to its removal, often followed one of several distinct spam formats. The posts we reviewed included offers to provide fraudulent documents, account logins, and money laundering services, and attempts to solicit peer-to-peer crypto transactions with other users.

In Ukrainian-employment-themed groups we identified, such as “truework_stkyiv,” our researchers encountered an array of posts advertising remote work opportunities using language consistent with online “pig-butchering” schemes and romance scams.15

Persistence of ‘Patriot Party’ Channels

While most cybercriminal channels and groups from earlier periods appeared to have been taken down or ceased their activity in recent years, many of the politically-named groups we identified – namely “PatriotPartyRI,” “FreeSouthDakota,” “PatriotPartyNewHampshire,” “PatriotPartyOregon,” and “FreeWestVirginia” – had survived Telegram’s increased moderation efforts and remained active at the time of writing.

Based on activity patterns in our datasets and manual verification, only the “ThePatriotPartyofOH” and “FreeNorthDakota” had been taken down (likely around October 2024 and May 2025, respectively). Other than “otc_investorhub,” all the active groups we identified in 2026 remained active as well.

Conclusion

While Telegram has demonstrated significant efforts to crackdown on cybercrime, it remains a fixture of the cybercriminal economy as illicit actors continue to adapt to its policies to avoid moderation. Despite a slight decline in recent months, the volume of posts on Telegram likely related to cybercriminal activities remains much higher than it was just two years ago.

Telegram’s moderation efforts appear to have done little to reduce overall cybercriminal on the platform – and as our research suggests, the problem is likely to persist as a result of the platform’s infrastructure, which remains unchanged.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.

TLDR

Open Measures found that alternative platform users promoted conspiracy theories attacking a host of pharmaceutical companies that develop vaccines last month after reports that global health authorities were responding to a deadly Ebola virus outbreak in the Democratic Republic of the Congo. With the help of our new Research Assistant, researchers identified harmful narratives targeting several companies.

Subscribe now

Context

The World Health Organization (WHO) declared on May 17 that the spread of Bundibugyo virus, which can cause Ebola in humans, in the Democratic Republic of the Congo was a “public health emergency of international concern” and advised global health authorities to take precautionary measures to limit its spread. In response, medical scientists have expedited research into possible vaccines for the disease.

Amid international alarm over the outbreak, misinformation and conspiracy theories about Ebola have run rampant on social media, following close on the heels of such claims surrounding a hantavirus outbreak aboard a Dutch cruise ship weeks earlier. Some of these narratives have taken direct aim at major pharmaceutical companies, including one actively working to develop an Ebola vaccine.

Our Approach

Open Measures sought to better understand how communities on the platforms we monitor have refashioned grievances against pharmaceutical companies into new narratives and conspiracy theories surrounding the recent Ebola outbreak. The pharmaceutical companies included in our search queries included Moderna, Pfizer, AstraZeneca, Merck, and GSK. We also searched for mentions of “big pharma” in posts discussing Ebola.

Our researchers used Open Measures’ new Research Assistant to generate a report summarizing claims made about major pharmaceutical companies related to Ebola across 24 platforms in our datasets in a month-long period spanning May 4 to June 3, 2026. An excerpt of the report produced by Research Assistant can be viewed below.

Informed by that report, researchers proceeded to use the analysis tools built into our platform to corroborate its findings and explore the themes it identified in greater detail. By using Research Assistant to identify prominent narratives in our datasets in the early stages of their analysis, our researchers saved hours that would otherwise be spent manually reviewing search query results to identify potential leads for their research.

‘Every. Single. Time’: Conspiracy Theorists Fault Pharmaceutical Companies Amid Ebola Outbreak

Open Measures found that hostile narratives about pharmaceutical companies surged across several platforms after the WHO declared the Ebola outbreak in the Democratic Republic of the Congo was a public health emergency and again following reports the Coalition for Epidemic Preparedness Innovations (CEPI) awarded millions of dollars to scientists developing potential vaccines against the disease.

Using our platform’s Discover tool, researchers reviewed more than 650 posts mentioning pharmaceutical companies in relation to Ebola to understand how different companies were being targeted.

Moderna

More than 75% of the posts we identified took specific aim at Moderna, an American pharmaceutical company that specializes in the development of mRNA vaccines. Earlier this year, the CEPI awarded $26.7 million to scientists working with the company to develop vaccines against several deadly filoviruses, including Ebola, and last week gave millions more to fast-track those efforts in light of the recent outbreak.

Health-focus conspiracy theorists have antagonized the CEPI for years, often fixating on its support for COVID-19 vaccine research and the substantial financial backing it receives from the charitable foundation of Microsoft co-founder Bill Gates.

Across multiple platforms, our researchers saw users highlighting reports about the CEPI’s funding of Moderna to insinuate that the Ebola crisis in the Democratic Republic of the Congo was orchestrated to generate profits for pharmaceutical companies and advance supposed sinister agendas of global elites.

A Telegram post shared May 27 pointed to the CEPI’s “perfectly timed investment” as evidence that the WHO’s advisories around Ebola were “propaganda to sell toxic vaccines.” Another Telegram post, shared on May 24, derided Moderna as one of many “pandemic profiteers” that haven’t been “held accountable.”

“Forecasting future pandemics, expanding emergency powers, and rapidly deploying vaccines has become a lucrative global industry,” a May 25 Telegram post mentioning Moderna read.

Other posts that mentioned Moderna made reference to a supposed “playbook” that health officials used to push vaccines on the public, as seen in this Truth Social post shared on May 18:

The same playbook always repeats: Develop “vaccine” → Fearmonger new outbreak → Declare emergency → Gain power & control → push “vaccine” as [the] only solution.

A Gab post shared on May 19 also alluded to this supposed scheme: “The same playbook always repeats. Every. Single. Time.” Another Gab user posted on June 2 that the response to Ebola was following “the same script” used to hype fears about previous outbreaks.

Pfizer

Our researchers also saw users targeting Pfizer, an American pharmaceutical and biotech company that is not among the groups expediting development of an Ebola vaccine. Several posts we reviewed promoted narratives that insinuated the Ebola outbreak was the fault of Pfizer’s COVID-19 vaccine.

A Gab post shared on May 25 declared that the Ebola outbreak was a “Pfizer Adverse Event.” In a May 30 comment shared on a Breitbart News article via the Disqus platform, another user wrote that the “Pfizer Ebola outbreak” was “sponsored by the CIA, NED, and USAID” – referencing three US federal agencies often attacked in “deep state” conspiracy theories. A comment posted to Rumble on May 12 declared that Ebola fears amounted to “fear porn brought to you by Bill Gates and Pfizer.”

Other Companies

Health-focused conspiracy theories about the Ebola outbreak also targeted other pharmaceutical companies, though our researchers identified significantly fewer of those posts than those that targeted Moderna and Pfizer. One such post was a comment shared on a Breitbart News article via Disqus, where a user wrote they would “rather catch Ebola than have anything produced by AstraZeneca jabbed into my body.”

‘Murder by injection’: Anti-Vaccine Users Encourage Refusal of Potential Ebola Vaccines

When reviewing posts mentioning pharmaceutical companies, our researchers also saw users prematurely declaring their refusal of any potential Ebola vaccines and encouraging others to decline them, should they eventually be available.

Wayne Allyn Root, a conservative radio host and longtime Trump ally, shared a Truth Social post on June 1 mocking anyone who might eventually receive an Ebola vaccine:

Good luck to all those dumb-as-a- doorknob sheeple who take it. If it’s anything like Covid vaxx, I’ll never be able to say, “I told you so.” Because it will kill or cripple you.

Similar warnings appeared in other posts. On May 20, a Truth Social user warned: “Be prepared. This is going to be Murder by injection.” Five days later, on May 25, a 4chan user posted: “REMEMBER TO NOT TAKE ANY MRNA VACCINE FOR EBOLA.”

Across platforms, our researchers saw users sharing posts categorically rejecting global concerns about Ebola. From a Gab post declaring Ebola was a “nazi fascist communist satanic ploy” to a BitChute video questioning whether the outbreak would be “what strips US citizens of their Constitutional Rights,” health-focused conspiracy theorists portrayed the deadly outbreak as a ruse meant to advance the interests of sinister liberal elites.

What We’re Watching

Conspiracy theories about medicine can influence believers to make unwise decisions related to healthcare, like forgoing preventative treatments, experimenting with unproven alternative medicines, and skipping routine check-ups. The spread of anti-medicine narratives can also complicate responses to global health emergencies and elicit threats against the individuals and entities leading those efforts, as seen during the COVID-19 pandemic.

Open Measures will continue to monitor developing narratives around the Ebola outbreak as they appear on alternative platforms, where our researchers have repeatedly seen high-impact narratives first appear before achieving wider online spread.

Identify online harms with the Open Measures platform.

Organizations use Open Measures every day to track trends related to networks of influence, coordinated harassment campaigns, and state- backed info ops. Click here to book a demo.