Instagram hacked for the Macedonian media outlet Sloboden Pechat

(Originally published by META.MK , 16 November, 2025)

One of the most professional media outlets in North Macedonia, Sloboden Pechat not only prints and sells a daily newspaper but also runs one of the country’s most-read online media outlets and one of the most-followed Instagram profiles, with almost 70,000 followers. Unfortunately, for the past week, their profile has been locked — meaning it cannot be viewed publicly unless you already follow them.

This was not a choice made by the editors or the team managing the account, but something they were forced to do. For more than a week, Sloboden Pechat has been the target of a coordinated bot attack on Instagram. The attack is extremely sophisticated, multi-layered, and continually changing. The goal, as the media outlet told Meta.mk, is to reduce the profile’s visibility and trigger a so-called shadow ban.

Shadow censorship

The editorial team explained that this amounts to an invisible “sanction” by Meta (Facebook and Instagram), which limits all interactions and reduces the profile’s reach. They say this happens due to a sudden spike in activity on the account coming from suspicious profiles. As a result, many users can suddenly no longer see your posts.

“In such cases, the profile is not officially blocked, but its visibility is significantly restricted, without the user receiving any notification. Although the account can still post and communicate normally, posts stop appearing in the main feed, they are not shown on the Explore page, and new followers have a harder time finding the profile. This leads to a sharp decrease in views and interactions,” the editors of Sloboden Pechat told Meta.mk.

They further explained that this phenomenon often occurs when platforms automatically register a large amount of unusual activity within a short period. In the case of Sloboden Pechat, it initially involved numerous comments from suspicious Instagram profiles, which Meta’s systems interpreted as potential abuse.

Later, the attack turned into something different, indicating that the entire action was well-planned and coordinated, with the clear objective of silencing Sloboden Pechat on Instagram.

An army of bots saying “Like”

The attack began on 6 November around midday. The attackers’ first move was to leave hundreds of comments from suspicious bot profiles under the outlet’s posts. All the comments were identical and consisted solely of the word “Like”. A few days earlier, the team had already noticed suspicious profiles leaving unusual comments.

The usernames of these profiles were generic, strange-sounding, and full of illogical numbers, clear signs of automated activity. In other words, they were not real people but software-generated accounts posting comments.

During the attack, readers began to notice something was wrong: posts showed hundreds of comments, but only a few were visible. One follower even asked, “Is anyone testing bots in the comments?” After several hours of detection and analysis, the editorial team concluded that this was indeed a coordinated attack.

The comments had nothing to do with the content of the posts. They appeared under every post, regardless of the topic. “The posts were on different topics — that’s how we realised it was a coordinated bot attack. The comments became more frequent and started appearing under every new post,” Sloboden Pechat said.

Although the team currently has no concrete information about who is behind the attack, they believe the aim is to undermine trust in the media outlet and reduce its public visibility. “At this moment, we do not have concrete information, but the goal is clear: to reduce the visibility of Sloboden Pechat and undermine trust in the outlet,” the editorial team added.

The case has already been reported to the cybercrime department at the Ministry of the Interior.

Help from the public

But this did not stop the attack. On the contrary, it entered its next phase: bots began giving a massive and unexpected number of likes to Sloboden Pechat’s posts. Anyone who uses Instagram professionally knows that likes cannot be controlled or deleted the way comments can. The only solution is to lock the profile, meaning users must request approval in order to follow you.

To protect themselves, Sloboden Pechat said it was necessary to lock their official Instagram profile for the first time ever.

“For the first time in all these years, the main Sloboden Pechat profile is locked. This makes our work somewhat easier, but it is far from an ideal solution. Now we are limited to people who already follow us. Our posts cannot be shared in Stories, and our ‘Follow Requests’ list contains more than 999 suspicious profiles. The bot attack isn’t over — we’ve simply shut the door on it,” they said.

Although this measure has temporarily stabilised the situation, the media outlet remains restricted in its ability to communicate with a wider audience.

In an effort to overcome the restrictions caused by the shadow ban, the team at Sloboden Pechat decided to transparently inform its audience and involve them in the solution. They called on readers to interact with a specific post, and it worked. Although the bots temporarily slowed the algorithm down, the outlet’s voice was amplified thanks to the support of its audience.

“What was intended as an attack became proof that behind Sloboden Pechat stands a community that believes in truth, freedom, and independent journalism. We managed to deal with it in a ‘guerrilla’ fashion — but what about media outlets with loyal readers but without a strong social media presence? How would they cope with such malicious attacks?” Sloboden Pechat asked.

Bots as a new tool of propaganda

Bozhidar Spirovski, a cybersecurity expert and founder of the BeyondMachines platform, says that defending against bots on social media is almost impossible due to rapid technological development and the easy availability of bot-creation services.

“It’s almost impossible to defend against bots. This is a paid service; there are countless such services around the world. The algorithm performs a shadow ban because it assumes the owner is self-promoting using bots — and that is exactly why someone can abuse it so easily,” Spirovski says, adding that the key question is why the attack occurred at this specific time.

“The main question is: why now? I would ask myself which post was the subject of the attack. Why at that particular moment? Was there a post that was painful for someone?” Spirovski asks.

From the posts currently available on the Sloboden Pechat profile from 6 November, the first bot comments appeared on a post about a meeting between the new mayor of Skopje, Orce Gjorgjievski, and the former mayor, Danela Arsovska.

Spirovski notes that the Sloboden Pechat profile has enough reach to gain community support, but there is practically no technical solution available on their side. Everything depends on the platform itself.

“There is no technical way for a profile to deal with bots. It is up to the social network. But the question is: does the platform want to do anything about it?” Spirovski says.

He explains that bots are typically created to generate revenue, promote specific content, or — as in this case — suppress content. “Bots are designed to automate the goals of whoever pays for them. They can generate income, promote a website, or suppress content. These are the basic mechanisms. But bots can also be extremely complex: they can post real content with a specific purpose, interact with each other, and create the illusion that a topic is popular — and that is already powerful propaganda.”

This publication is the result of activities carried out within the Media Freedom Rapid Response    co-funded by the EU and within ATLIB – Transnational Advocacy for Freedom of Information in the Western Balkans, a project co-funded by the Italian Ministry of Foreign Affairs and International Cooperation. All opinions expressed represent the views of their author and not those of the co-funding institutions.

This content is part of the Media Freedom Rapid Response  (MFRR), a Europe-wide mechanism which tracks, monitors and responds to violations of press and media freedom in EU Member States and Candidate Countries. The project is co-funded by the European Commission.