Skip to main content
Netherlands News in English

Main navigation

  • Top stories
  • Health
  • Crime
  • Politics
  • Business
  • Tech
  • Culture
  • Sports
  • Weird
  • 1-1-2
Image
Stock image of three people holding phone with Instagram icon
Stock image of three people holding phone with Instagram ico - Credit: IgorTishenko / DepositPhotos - License: DepositPhotos
Crime
cybercrime
phishing
social media
Instagram
NOS
NOS Stories
Gwenda Nielen
Robert van der Noordaa
Trollrensics
Joost Gijzel
DataExpert
Stef Snakkers
VexTrio
aqulas.me
Saturday, 25 January 2025 - 08:15

Share this article:

Opens in a new window Opens in a new window Opens in a new window Opens in a new window Opens in a new window Opens in a new window

Criminal network behind sexy gifs in comments on news media's Instagram posts: experts

Broadcaster NOS noticed a flood of sexy gifs in the comment section of its youth platform’s Instagram posts. According to experts, a cybercrime network is behind these gifs of women in bikinis, aiming to scam users and undermine news media.

“We’re also seeing similar comments on other news channels on Instagram. We asked Meta, the company behind Instagram, whether they knew more about this. But we didn’t get a response. We then called in several security experts to investigate further,” Stef Snakkers of the broadcaster’s youth platform, NOS Stories, said.

They found that all the accounts posting sexy gifs under news media’s posts refer to the same domain, aqulas.me, Joost Gijzel of DataExpert told the broadcaster. “These websites all come from a server in the Russian city of Saint Petersburg.” Gijzel’s research showed that tens of thousands of sites are connected to this server and they can all be traced back to one criminal organization - VexTrio. “The goal is actually to just blackmail you. To download data, phishing. Ultimately, it is one big cybercrime gang.”

Many of the gifs are posted by accounts named some variation of “sweet bunny.” The goal is to entice people to click through to the underlying website, mostly porn sites, said Robert van der Noordaa of Trollrensics, which investigates disinformation and troll networks on social media. “You are often presented with a menu that allows you to download pornographic photos or videos. You are then asked to leave information and pay money for this content.”

According to Gijzel, phishing is not the only goal of these cybercriminals. They are also out to undermine the credibility of news media. “These gifs make you, as a visitor, take the comment section of these news platforms less seriously, and as a result, the news media themselves as well,” he said. “The idea is that it will be less interesting for visitors. The real reactions disappear between the gifs and that makes you less inclined to follow these news accounts.”

“It is a well-known tactic to ensure that people no longer want to interact in the comments of reliable media,” agreed Gwenda Nielen, an expert in the field of online manipulation. “By discouraging users from posting serious reactions to news items with these types of reactions.”

More like this

Image
Meta
Facebook, Instagram still unable to effectively combat simple phishing scams
Image
Middle section of a young woman scrolling on a smartphone
“Addictive design”: Instagram & Facebook violating EU rules, says European Commission
Image
Odido's headquarters building in The Hague. Undated
Voice of fake IT employee links Dutch criminals to Odido hack
Image
Social media platform X (formerly Twitter) on the Google Playstore
Court rules X must give privacy researcher access to personal data in privacy case
Make NL Times your top Google source

Follow us:

Latest stories

  • Council of State strongly opposes plan to scrap asylum distribution law
  • Video: Escaped monkey from Beekse Bergen still on the loose after nearly a month
  • Dutch U.S. ambassador sends Venezuelan opposition leader’s plane back during the flight
  • No free water at Arnhem festival where high heat injured five; Water cost over €14/liter
  • Netherlands summons Russian ambassador over Russia's hacking of military supply routes

Top stories

  • Ter Apel asylum center area declared safety risk zone after recent stabbings, fights
  • Suspect in ABN Amro worker's fatal stabbing also harassed four other women
  • New public transport strikes looming as contract talks stall
  • Explosion at apartment complex in Woerden; Dozens of homes evacuated
  • Dutch SMEs investing less due to high costs and inconsistent gov't policy: study

© 2012-2026, NL Times, All rights reserved.

Footer menu

  • Change Privacy Settings
  • Privacy Policy
  • Contact
  • Partner Content