Tracking Illegal Pharmaceutical Sales on Social Media

Nisos continuously monitors mainstream and alternative social media platforms as well as other online communities for individuals and networks conducting illegal activities or violating platform terms of service (TOS). In fostering communication and community among their massive user bases, social media platforms can inadvertently become attractive markets for threat actors looking to exploit them to sell highly sought-after pharmaceuticals. Nisos tracks pharmaceutical sellers’ evolving tactics, techniques, and procedures (TTPs) for soliciting buyers while maintaining anonymity and avoiding automated content moderation.

As of February 17, 2024, the European Union’s Digital Services Act (DSA) went into full effect. The DSA introduced new obligations for social media companies to curb illegal activity. Among other stipulations, social media companies are now responsible for online advertising, working with “trusted flaggers” to remove illegal content, and verifying the identities of third-party sellers to ensure products are not stolen or illegal.

Keeping up with these requirements as nefarious operators continuously change their tactics can be costly and time-consuming for Trust and Safety (T&S) teams. Nisos leverages our cross-platform visibility and analytical expertise to provide comprehensive reporting on TTPs and uproot criminal networks plaguing platform safety.

Cross-Platform Tactics, Techniques, and Procedures

Nisos identified operators (see source 1 in appendix) using common TTPs across traditional social media platforms:

Off-Platform Redirects to Messaging Apps

When marketing prescription drugs on a specific traditional social media platform, sellers are very likely negotiating the actual sales off platform based on off-platform redirects to various messaging apps and the lack of pricing information on platform. The most common off-platform redirects included Telegram, Snapchat, Wickr, and email. Nisos assesses operators provide off-platform redirects to avoid content moderation and prevent account suspension for violating platforms’ TOS.

Nisos observed the term “teleplug,” often displayed as “tele🔌,” short for “Telegram plug.” “Plug” is a slang term describing a high-level drug dealer who deals in larger quantities and a wide variety of pharmaceuticals and illicit substances, alluding to the dealer’s connections. Social media content promoting Telegram accounts or channels selling prescription drugs frequently uses the hashtags teleplug, tele, plug, and/or pluggedin in combination with prescription drug slang or nicknames. The content frequently features photos or videos of drugs, delivery arrival videos from customers, and customer testimonials verifying the seller’s completion of orders. The most common pharmaceuticals associated with “teleplug” were Xanax, codeine, and OxyContin.

Illegitimate Online Pharmacies

Nisos discovered accounts self-identifying as pharmacies and promoting the sale of various pharmaceuticals. Nisos identified these accounts by searching variations and combinations of pharmacy, available and online, alongside the pharmaceutical of interest. These terms frequently appear within accounts’ display names, usernames, and content captions. The pharmacy accounts direct users off platform—typically to domains with display names resembling their usernames—to purchase the promoted pharmaceuticals without a prescription. Many of these illegitimate pharmacies are located worldwide and are not limited to any specific region.

About Nisos®

Nisos is the Managed Intelligence Company. We are a trusted digital investigations partner, specializing in unmasking threats to protect people, organizations, and their digital ecosystems in the commercial and public sectors. Our open source intelligence services help security, intelligence, legal, and trust and safety teams make critical decisions, impose real world consequences, and increase adversary costs. For more information, visit: https://www.nisos.com.