Thread by @CtrlSec

Let's explain more in details what are the "phantom" accounts 🎥👻used by #ISIS to spread their propaganda

In short, these accounts have hidden tweets -mainly videos- that you can't see on their timeline

Examples of such accounts

https://twitter.com/CtrlSec/status/1071298343110873089

#phantomhubs #opiceisis

Indeed, if we want to be accurate, it isn't in the strict sense a technical glitch.
It's even worse.

#ISIS uses a paying feature of #Twitter : Twitter Business Accounts
to spread its #terrorist #propaganda

@TwitterSafety @TwitterSupport @TwitterBusiness @INTERPOL_Cyber

This standard #twitter feature allows to create tweets in advance for scheduled marketing campaigns.

Such tweets can't be seen in the user tweetline before the starting date of the campaign.

However, they already have an active tweet status (URL).

#phantomhubs #opiceisis

Unfortunately, links of such invisible "planned tweets" can actively be shared by other accts before the date set for the campaign start.

Therefore, ISIS uses this feature to "hide" tweets in its sleeping accounts in order to evade suspensions (most are old hacked accounts btw)

To make things worse, such abusive tweets aren't displayed in the list of available tweets when we want to report this #ISIS account.

Only the oldest innocent tweets, prior to the hack, are proposed here.

@TwitterSupport @TwitterSafety @TwitterBusiness
#phantomhubs

In order to report such #ISIS hub account, we need to find the URL of its latest tweets.
It can only be done when we find its images or videos embedded in other #ISIS accounts and it requires some minimal technical skills to retrieve them because they can't be accessed directly.

Of course, it slows down the reporting and suspension of such #ISIS propaganda accounts, even if @TwitterSupport @TwitterSafety clean them now rather fast (most of the time in less than 2 days) once the hidden tweets URL are exposed.

#phantomhubs #opiceisis

The other aspect of this story which is more troublesome is the fact that #Twitter is paid by pro #ISIS accounts to use this feature.

@TwitterBusiness

Even if we think that @TwitterBusiness can't know in advance that these paid campaigns will indeed contain #ISIS materials

We at least hope they actively cooperate with authorities to find out the persons behind this setup through the financial data they have at their disposal.

A few measures could also help cleaning up the current situation

1⃣ A better preemptive check of accounts asking for a paid campaign: most accounts used by #ISIS are sleeping for at least 3 or 4 years!!!

@TwitterBusiness @TwitterSafety
#phantomhubs

2⃣ Immediate suspension of accounts which are sleeping for 3+ years then starts tweeting at high frequency, most of the time in another language and after an AVI change.
For months, these hacked accounts represent 80% of the current ISIS propaganda
@TwitterSupport @TwitterSafety

3⃣ Sharply limit the broadcast of #ISIS propaganda on #Twitter by a simple change in Twitter code

= Forbid sharing embedded links which are either from "tweets planned at a future date" or from "temporarily restricted accounts"

@TwitterSafety @TwitterSupport @mrdonut

4⃣ Add these tweets "planned at a future date" in the proposed tweets list when reporting an account in order to ease and speed up the suspension of these #ISIS accounts

@TwitterSafety @TwitterSupport @mrdonut