Instagram bot campaigns target activists and media in Western Balkans ^{CEFR B2}

Coordinated bot campaigns targeted activist and media Instagram accounts in the Western Balkans during November 2025. Meta.mk News Agency documented near-simultaneous operations in pieces published on November 16 and November 23, 2025. The campaigns sought to exploit automated moderation and ranking systems to reduce visibility and silence critical voices.

In Serbia the Students in Blockade movement reported a sudden spike of suspicious followers on its main profile, which has over 1 million followers, and parallel hits on faculty and department profiles. Investigators, including student Balša Bulatović and Professor Djordje Krivokapic of the SHARE Foundation, said two tactics were used: a rush of fake, often foreign, accounts added as followers and coordinated mass reports alleging inappropriate content to trigger automatic account locks. Krivokapic described the incident as manipulative abuse of platform mechanisms, not a classical hack, and noted hundreds of thousands of new followers from "eastern markets," suggesting significant resources and organisation. The attackers’ identity remains unverified, and experts said platforms share responsibility to prevent such abuse.

The North Macedonia outlet Sloboden Pechat faced a related campaign earlier in November. Its Instagram account, with nearly 70,000 followers, received hundreds of identical bot comments containing only the word "like" and over 999 suspicious follow requests. Usernames included odd numbers, indicating automation. The attack escalated to mass liking, which is difficult to reverse, and the outlet temporarily locked its profile. Editors asked readers to interact with specific posts to restore reach; the response showed community support.

Cyber-security expert Božidar Spirovski of BeyondMachines warned that paid bot services are widespread and hard to defend against. He said algorithms can treat such activity as self-promotion and impose penalties; bots may be used to promote, monetise or suppress content and to create false impressions of what trends. Platform action and public reporting were crucial to limit damage in both incidents.