One of the most professional media outlets in Macedonia, Sloboden Pechat, which publishes an eponymous daily newspaper and associated very popular online media outlet, has had its Instagram profile locked this past week. The profile is also among most popular the country, with nearly 70,000 followers. Currently, it can’t be be viewed publicly unless you’ve already followed it.
This is not by choice of the editors or the team managing the profile, but because they have been forced into this situation. For more than a week, Sloboden Pechat has been the target of a coordinated bot attack on Instagram. The attack is extremely sophisticated, not simple at all, involving multiple layers and evolving over time. In a statement for Meta.mk, representative of the targeted media outlet said that the goal is to make them less visible, with the attackers attempting to trigger what is known as a “shadow ban.”
Censorship from the shadows
The Sloboden Pechat editorial team explained that the attack activated an invisible “sanction” imposed by Meta (U.S. company that owns Facebook and Instagram), which restricts all interactions and the reach of the profile as an automatic reaction. According to them this occurs because of a sudden spike in activity on their Instagram account, coming from suspicious profiles. In practical terms, this means that suddenly many people can no longer see the posts from affected profile.
“In such cases, the profile is not officially blocked, but its visibility is significantly restricted without the user receiving any notification. Although the profile can still post and interact normally, the posts stop appearing in the public feed, they don’t show up on the Explore page, and new followers have a harder time finding the account, resulting in a sharp drop in views and engagement,” the Sloboden Pechat editorial team told Meta.mk.
As they further explained, this phenomenon often happens when platforms automatically detect a large surge of unusual activity in a short period of time. In the case of Sloboden Pechat, it initially involved numerous comments from suspicious Instagram accounts—something Meta’s systems interpret as potential abuse. Then the attack transformed into something different, indicating that the entire operation was coordinated and well-planned, with a clear goal: to silence Sloboden Pechat on Instagram.
An army of bots says ‘like’
The attack began on November 6 around noon. The attackers’ initial activity was to leave hundreds of comments from suspicious so-called bot accounts under the posts on the attacked profile. All the comments were identical and contained only the word “like.” As Sloboden Pechat notes, a few days earlier they had already noticed other suspicious profiles commenting on their content.
In most cases, the usernames of these accounts that posted comments were generic, sounded unusual, and included illogical numbers. These characteristics indicate automated activity. More precisely, these are not real people, but software-driven accounts used to post comments.
During the attack, readers began to notice that something strange was happening, because the posts showed hundreds of comments, yet only a few were actually visible. One follower even asked, “Is someone testing bots in the comments?”
After several hours of detection and analysis, the editorial team concluded that this was a coordinated action—a cyber attack on their Instagram profile. The comments contents had absolutely no connection to the topics of the Instagram posts. They were left under every post, regardless of the content.
“The posts covered different subjects; in fact, that’s how we realized it was a coordinated bot attack, because the comments became more frequent and started appearing under every new post as soon it was published,” Sloboden Pechat told Meta.mk.
Although the newsroom currently has no concrete information about the perpetrators of the cyber attacks, they believe the goal is to reduce trust in the outlet and diminish its visibility in the public sphere.
“At this moment we don’t have precise information, but the goal is clear: to reduce the visibility of Sloboden Pechat and to undermine trust in the media,” the editorial team added.
The case has already been reported to the Cyber Security Unit of the Ministry of Interior.
Aid from the audience
But reporting to law enforcement didn’t stop the attack. At that point, the attack entered its next phase: the bots began generating a massive and unexpected number of likes on Sloboden Pechat’s Instagram posts. And those who work professionally with Instagram know that likes cannot be controlled or deleted the way comments can. The only solution is to “lock” the profile. This means that if someone wants to follow the profile, they now need an approval from the administrators.
To protect themselves from the attack, Sloboden Pechat said it became necessary to lock their official Instagram profile, which was the first time ever.
“For the first time in all these years, the main Sloboden Pechat profile is now locked. This makes things somewhat easier for us, but it is far from an ideal solution, because now our reach is limited only to the people who already follow us, our posts cannot be shared in Stories. Meanwhile our follow requests list shows over 999 requests from suspicious profiles. The bot attack hasn’t stopped; it’s only been ‘mined,’ meaning we’ve closed the door on them,” they say.
Although this measure temporarily stabilizes the situation, it limited the ability of the outlet to communicate with the broader public.
In an attempt to overcome the restrictions caused by the “shadow ban,” the Sloboden Pechat editorial team decided to be transparent and involve its audience in the solution. They called on readers to help by interacting with a specific post—and it worked. They say that although the bots temporarily slowed down the algorithm, with the audience’s support, the outlet’s voice grew stronger.
“What was meant to be an attack turned into proof that a community that believes in truth, freedom, and independent journalism stands behind Sloboden Pechat. And so, we managed to fight back with a kind of ‘guerrilla’ response. But what about media outlets that have loyal readers, but not such strong influence on social networks? How would they defend themselves from such malicious attacks?” they ask.
Bots as a new propaganda machine
Božidar Spirovski, a cybersecurity expert and founder of the platform BeyondMachines, says that defending against bots on social media today is almost impossible because of rapid technological development and the easy availability of services for creating them.
“It is almost impossible to defend yourself from bots. This is a paid service, and there are countless such services around the world. The algorithm triggers a shadow ban thinking that the owner is self-promoting through bots, and precisely because of that, someone can easily abuse it,” Spirovski says, adding that the essential question is why the attack happened at that particular moment.
“The main question is: why is this happening? I would ask myself what post was the target of the attack? Why at that moment? Was there a post that was painful enough for someone?” Spirovski asks.
According to what can be seen from the posts currently available from November 6 on Sloboden Pechat’s Instagram profile, the initial bot comments were left on a post (related to news article) about the meeting between Skopje’s new mayor, Orce Gjorgjievski, and the former mayor, Danela Arsovska.
Spirovski emphasizes that the Sloboden Pechat Instagram profile has enough “reach” to receive support from its community, but that from a technical standpoint, there is practically no solution they can implement on their own, as everything depends on the platform.
“There is no technical way for an Instagram profile to deal with bots. It remains in the hands of the social network. But the real question is whether the platform wants to do something about it,” Spirovski says.
As he explained, bots are usually created to generate profit, promote certain content, or suppress certain content.
“Bots are created to automate the goals of whoever sells their services. They are designed to make money, promote a website, or in this case, to suffocate content. These are the most basic mechanisms. But bots can be much more complex—they can post real content, post fabricated content with a specific purpose, even talk to each other and create the illusion that a certain topic is trending. That is already a powerful form of propaganda,” the cybersecurity expert concluded.
