Thread by @conspirator0

For $800, you could be the proud new owner of @coisasqncompro (permanent ID 1221072227120156674), an automated account with 277K followers that mostly tweets pictures. As it turns out, this account is part of a botnet. #SaturdaySpam

cc: @ZellaQuixote

We found a total of 27 accounts tweeting via "Twitter for me memso". Almost all were created in 2019 or 2020, and most have massive numbers of followers. This botnet recently switched automation tools - prior to Aug 10 2020 most tweets were sent via "Jeito".

The automated tweets sent by this network are pretty much all images and videos, many of which (unsurprisingly given the large number of followers) receive large numbers of retweets and likes.

Not all of the tweets sent by the accounts in this network are automated, however. Several of the accounts have tweeted potentially organic tweets containing affiliate links to the download page for the Brave web browser.

(we've seen networks pushing the Brave web browser before - the operator is likely getting paid small amounts of cryptocurrency for each resulting download)

https://twitter.com/conspirator0/status/1248006477148643329

1766569 accounts follow one or more of the 27 accounts in this botnet. Their followers are mostly Portuguese-language and don't look obviously fake; it's possible the goal is to build large followings and then sell off the accounts, as is presently happening with @coisasqncompro.