An Epi Special Investigation on the scam political ads plaguing X users in the UK. Over four days, we detected 425 unique malicious ads, generating over 2.3 million impressions.
From 1 to 4 July, I observed 425 distinct malicious ads that exploited the studio brand of the BBC Radio 4 Today programme and the likeness of Emily Maitlis.
1 July: 82 ads with 816,950 views
2 July: 95 ads with 433,808 views
3 July: 169 ads with 781,802 views
4 July: 79 ads with 319,412 views
Total 1–4 July: 2,351,972 views (avg: 5,534 views/ad)
Some individual ads reported over 70,000 impressions.
The vast majority of the 425 ads matched one-to-one with individual X accounts; ie. around 400 separate X accounts were used for 425 ads.
Interestingly, a large proportion of the accounts were created between 2009 and 2014, with a peak in 2011, and many of their initial tweets posted are scams and malicious links. This tells me that these Twitter accounts have not been recently created or hijacked, but are persistent scam accounts controlled and traded by organised criminals over long periods — decades, in fact.
Ads were published by X accounts originating from 89 countries, most of which X indicates are using VPNs, which obscure their true geographic location.
The ad origins include exotic and unusual countries such as: Afghanistan, Belarus, Mongolia, Palestine, Pakistan, Russia, Somalia, South Sudan, Ukraine, Uzbekistan and Venezuela.
Some important questions that need answers: Why is X allowing ads from a such an exotic variety of countries to reach British users with UK political inspired ads? Why does X let ads be published from accounts hiding behind VPNs, particularly when they acknowledge their use? What are the banks and jurisdictions of the credit cards used to pay for the ads? Why is X permitting ads from regions in active conflict zones, and most concerningly, from countries under comprehensive and targeted US and UK sanctions — including: Afghanistan, Belarus, Russia, Somalia, South Sudan and Venezuela.
Since this investigation, I have observed malicious ads exploiting the likeness of Nick Robinson on the Today programme.
Funnily enough, I will be on the Today programme on BBC Radio 4 on Wednesday morning at 06:50 to discuss my findings. I hope you join me as one of six million listening! On your radio, on BBC Sounds, or on catchup.
UK: Wed 6:50am
US Eastern: Wed 1:50am
US Pacific: Tue 10:50pm
Sydney: Wed 3:50pm
@epiapp @episecurity